Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper is dedicated to the problem of spurious correlations. The work systematically studies fundamental questions such as how many spuriously correlated training points are necessary for a neural net to get biased towards learning it. Specifically, it investigates the domain in which spurious correlations are rare. Interestingly the study indicates that even a single spuriously correlated sample can bias the learning of a neural network. Finally, the authors highlight three regularization methods for mitigating spurious correlations.
strength_and_weaknesses: Strength:

1. The paper is well-motivated, organized, easy to follow and well-written.
2. The study aims to answer fundamental research questions, which can provide new insights to the community.
3. The authors provide theoretical justification for their findings

Weakness:
1. The technical contribution is somewhat limited in the sense that prior works have already shown that neural networks are more biased towards "easy-to-learn" spurious attributes. 
2. A major chunk of the experimental analysis is based on cases where the spurious correlation is injected synthetically. It would be more interesting if the authors also showed results on commonly studied spuriously correlated datasets such as Waterbirds, and CelebA.
clarity,_quality,_novelty_and_reproducibility: Clarity is good. The content is well-organized and easy to follow. This work provides extensive experimental evaluations and sufficient details. Novelty is fair. 
summary_of_the_review: The paper studies some important research questions in the domain of spurious correlations. The findings also provide non-trivial contributions to the community. However, because of the synthetic setup, the overall impression of this work is borderline.  I suggest the authors comment on the weaknesses mentioned above and I am open to changing my rating.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper investigates how sensitive neural networks are with respect to rare spurious correlations from three perspectives. First, studying how many training points with the spurious pattern would cause noticeable spurious correlations in the synthetic and real datasets. Second, studying how rare spurious correlations affect neural networks’ privacy and test accuracy. Third, studying how to mitigate the effects of rare spurious correlation.

strength_and_weaknesses: Strength:
1. The paper studies an interesting topic of learning with rare spurious correlations via both experimental and theoretical approaches.
2. The paper studies whether rare spurious correlations are learned on both synthetic and real data.
3. The paper studies the consequences of rare spurious correlations from a privacy and test accuracy perspective.
4. The paper introduces simple and effective methods suggested by theoretical evidence to reduce the undesirable consequence of spurious correlation.
5. The paper is well written.

Weaknesses and questions:

1. In Figure 1, it seems like the seven different spurious patterns (adding different kinds of noise) are not strong enough to generate a spurious correlation. How about using more challenging datasets, such as Colored MNIST?

2. The main observations that neural networks can learn rare spurious correlations with few spurious examples are a little weak for me. It is not a big surprise to find out that adding perturbated patterns into training samples can impact the confidence of prediction on target classes during inference. 

clarity,_quality,_novelty_and_reproducibility: The paper contains a lot of content and is easy to follow which is good, but the main observation and conclusion are a bit weak for me.
summary_of_the_review: With the findings above, I currently give the paper a borderline score.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: Most existing papers working on spurious correlation focus on the correlation that existed in the majority of the examples. This paper discovered that even a few spurious examples can still lead to the model learning the spurious correlation. Moreover, these "rare" spurious correlations bring negative effects regardless of the strength of spurious patterns, network architectures, and optimization methods.  Finally, the paper provides a theoretic analysis of a simple binary classification model. Based on the analysis, a few techniques are proposed to improve learning with rare spurious correlations. 
strength_and_weaknesses: Strength:
- Extensive experiments are performed across datasets, the strength of spurious patterns, network architectures, and optimization methods, showing that even a small amount of spurious correlation will also influence the model performance. 
- Theoretical analysis of a simple but meaningful model is conducted, moreover, inspired by the analysis, several techniques are proposed and validated with experiments. 

Weaknesses:
- Does the technique proposed also work when the majority of the data present spurious correlation, e.g. Adding l2 regularization? Because as mentioned in the paper: l2 regularization only "suppresses the use of features that only appears on a small number of training examples". 
clarity,_quality,_novelty_and_reproducibility: The paper is very clear and of good quality. 
summary_of_the_review: The paper discovers that even a few spurious examples can still lead to the model learning the spurious correlation. Many interesting results are shown with experiments: It shows that spurious patterns with larger empirical norms can cause spurious correlation more easily, and network architectures with higher sensitivity to its input are more susceptible to learning spurious correlations.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper studies how different numbers of spurious training examples (from one to thousands) affect neural nets. They measure how the predictions of test examples change when the spurious features are added. They show even a few spurious training examples can make the model outputs be affected by the spurious feature.

The authors consider two different types of spurious features. The first one is some artificial patterns, e.g., a square of yellow pixels. The second one is some natural spurious features in real data. They use the NICO++ dataset that has different backgrounds (grass, rock, water..) for each class. The authors then study the consequences of learning rare spurious features on privacy and accuracy. They also analyze the findings with a toy theoretical model and study several simple mitigations.

strength_and_weaknesses: **Strength**

1.Studying the relation between the number of spurious examples and the strength of spurious correlations is an important problem. The experiments show that neural nets could learn natural rare spurious correlations are new and interesting. 

2.This paper is well-written. Extensive results are well organized. 

3.The analysis on the privacy risk of spurious examples is new.

**Weaknesses**

1.The spurious features in Section 3.1 and 3.2 are very similar to backdoor triggers. They both are some artificial patterns that only appear a few times in the training set. For example, Chen et al. (2017) use random noise patterns. Gu et al. (2019) [1] use single-pixel and simple patterns as triggers. It is well-known that a few training examples with such triggers (rare spurious examples in this paper) would have a large impact on the trained model. 

2.How neural nets learn natural rare spurious correlations is unknown to the community (to the best of my knowledge). However, most of analysis and ablation studies use the artificial patterns instead of natural spurious correlations. Duplicating the same artificial pattern for multiple times is different from natural spurious features, which are complex and different in every example.

3.What’s the experiment setup in Section 3.3? (data augmentation methods, learning rate, etc.).

[1]: BadNets: Evaluating Backdooring Attacks on Deep Neural Networks. https://messlab.moyix.net/papers/badnets_ieeeaccess19.pdf
clarity,_quality,_novelty_and_reproducibility: Please see **Strength And Weaknesses**.
summary_of_the_review: Given that 1) the findings about artificial spurious features seem incremental because of the backdoor attack literature; 2) how neural nets learn natural rare spurious features is not well studied. I'm leaning to reject this paper.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper studies  the problem of spurious correlations specially when they are rare. In a setting, they found that even a single spuriously correlated sample can bias the learning of a neural network. The paper is well-motivated, organized, easy to follow and well-written. Reviewers generally liked the fundamental research questions asked in the paper. However, there are some critical weaknesses in the paper : Although the paper provides some interesting analysis, most results are based on a synthetic setup. I believe that the paper could have been improved with more results and empirical analysis on natural benchmarks. Connections between the work and backdoor triggers should be explained more clearly. Given all, I think the paper needs a bit more work before being accepted.
justification_for_why_not_higher_score: See the above explanations of weaknesses of the submission
justification_for_why_not_lower_score: I recommend rejection.
Decision: Reject