Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The authors attempt to provide a theoretical explanation on why adversarial training helps with transfer of learned representations sometimes. The main deficiency is the lack of explanation and verification of the underlying assumptions of their analysis, making it hard to connect what they proposed to what we observe in practice. 

main_review: - The authors propose a theoretical explanation on why adversarial training help with transfer learning. It is an interesting attempt to explain why models trained on ImageNet transfer better to CIFAR with adversarial training. 

- The main problem I find with the theoretical explanation offered in this paper is the validity of the assumptions. Assumption 2 is very strong: the paper is assuming unbounded signal-to-noise ratio difference among the tasks in terms of their regression vector a_t. This is very unusual. Or if we take the view from regression or optimization, these are a set of very badly scaled features or badly conditioned optimization problems.  

- The second problem with this set of assumptions is that we cannot (or the authors have not) empirically verify them on actual data. So we cannot really make the connection that this signal-to-noise ratio difference problem is what makes adversarial training works in practice. 

- There could be simpler explanations on why adversarial training helps transfer from Imagenet to CIFAR. CIFAR images are of much lower resolution compared to Imagenet, and adversarial training could help with making the model less reliant on low level filter features, which are dependent on resolutions. Of course this hypothesis also needs to be verified in some way (e.g., by checking the low level filters), but I am putting this up as an example that any explanation on why adversarial training helps transfer need to make a connection to the real data.   

- The part on pseudo-labeling does not quite fit well with the rest of the paper. It is only introduced in the experiment section and was not considered as part of the analysis. It is nice to see the empirical results, but does not add to the coherence of the paper. 

- Overall I think the issues with establishing the assumptions used in the theoretical analysis in this paper prevents me from recommending this paper for publication. 

limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This work proposes a theoretical perspective on why adversarial training in the source domain improves the fixed-feature transfer learning ability. The authors further show both pseudo-labeling and adversarial training can lead to better representation.

main_review: - Originality: The proposed theoretical analysis is the first analysis on the effect of adversarial training on transfer learning. This is quite novel and non-trivial to establish theoretical analysis covering few common setups in $l_2$, $l_
{\infty}$, and pseudo-labeling scenarios. 

- Quality: The proposed technical framework seems general sounds (Note I didn’t examine the proof in details).

- Clarity: 
  * Starting from page 4, I found it a bit hard to follow. Perhaps, it is due to the use of many symbols or without reading the proofs. From readers, it requires going back-and-forth to check the original definition and assumptions. It might be helpful to add some intuition behind the algorithm, theory, etc. I also found several descriptions are not easy to follow. 
  For example, 
    * (a) L167, “we consider the low-rank case” --> it is not immediately clear it is referring to M. 
    * (b) L172, "the task-specific error is easy to deal with." --> it will be helpful to expand this in more detail. 
    * (c) In L202-203, it is not obvious to me for the conclusion drawing from uniform signal-to-noise ratios. 
    * (d) In L319-320, it is not clear to me how to lead to the conclusion in varying signal to noise ratio ($l_2$ adversarial training) or with many redundant features ($l_\infty$ adversarial training). 

  * Few citation format could be improved. For example, in [43, 44, 56, 57], the transaction name should be Capitalized; [45] does not cover the full author; In [58] of supplementary material, davis–kahan -> Davis–Kahan. (only list a few of them here)
  * L112, add a space between "learning" and "[20, 47]".
 


- Significance: the proposed results seem sound and justify few previously empirical observations. I wonder whether it is possible to extend the framework to justify the improved adversarial robustness during transfer learning (even without adversarial training on the target domain), empirically shown in [1]. 

  [1] https://openreview.net/forum?id=bgQek2O63w




limitations_and_societal_impact: NA
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper reveals, both theoretically and empirically, that adversarial training is beneficial to transfer learning, which helps learning a more robust representation and therefore boosts the predictive performance on the target task. Additionally, pseudo-labeling is claimed to have complementary benefits and can further improve the transfer.
main_review: While attempting to tackle an important problem, this paper, at least in its current form, has several flaws. 
1. The experiments are not very solid. It would have been nice to see some experiments on another domain than image classification, to see how this method generalizes. 
2. And, I would like to know, when adversarial training is directly plugged to the existing transfer learning method, in theory, under what conditions will it be effective?
limitations_and_societal_impact: Please refer to the section "Main Review".
review_title: null

Meta-review: This is a solid paper that studies an important phenomenon that is not well understood: why adversarial training on the source data can improve the ability of models to transfer to new domains or targets? This is somewhat surprising as it might be easier to think of adversarial training as a task specific modification that can reduce performance on the source data, and the connection to transfer learning is not very intuitive on a first sight.

The paper replicates an adversarially trained ($\ell_2$ robustness) Imegenet model providing better accuracy on CIFAR10. Starting from fixed-feature transfer learning (Salman et.al.), an adversarial training step is plugged into the fixed-feature learning step.The authors also show that pseudo-labeling can lead to better representations. The authors analyse a hierarchical linear model for multitask learning and provide Alg-1 as the linear representation learning algorithm. This setup gives an upper bound to excess risk that can be decomposed in two terms: representation error (related to the sum of angles between the estimated and true factor matrices) and a task dependent term. The representation error can be further bounded using a Davis-Kahan style perturbation bound (Wedin's theorem). The strategy of the paper is to extend Alg-1 to the adversarial training setting (Alg-2) and finally also to include pseudo labelling (Alg-3). 

The structure and the arguments of the paper are easy to follow. During rebuttal, several concerns were raised, I summarize main ones succinctly and less nuanced below:

1. The validity of the assumptions. Assumption 2 is very strong. No verification of assumptions. (This assumption is related to the magnitude of task specific weights $\alpha_k$ where a large signal-to-noise (SNR) corresponds to a large $||\alpha||$, a proxy of task uncertainty)

2. Pseudolabel scenario is not much related

3. Observed robustness could be explained by different resolution on the source and target datasets, Analysis does not explain/has a big gap to experiment as it requires too many tasks

In my opinion, the authors very clearly addressed the concerns raised by the reviewers. In particular, the connection of variation in the
SNR's to explain why adversarial training might help seems to come out naturally from the analysis and seems to be quite interesting.

In particular, I feel the paper makes some relevant contributions.

It carefully builds and contrasts the various algorithms and provides a compelling explanation for the observed phenomenon. Adversarial training will bias the model to focus on learning the representation out of those with large signal-to-noise ratios and enhances  transferability.

In my opinion, one possible useful addition to address point 3 above would have been to verify the theory with a set of synthetic simulations. This would be fairly straightforward starting from the model and could potentially illustrate the assumptions much more clearly by explicitly controlling the task distribution. Especially, I can envision an experiment that directly controls the task diversity and SNR's to empirically show the regime where robust training is helping. Many related concerns (regarding non-asymptotic validity) could have been partially addressed through such a synthetic experiment. 

Overall, I am persuaded that the work would be a solid contribution and in the lack of strong counter arguments from the reviewers, I am using my own judgement and independent evaluation to suggest acceptance.

Decision: Accept (Poster)