Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper pointed out a fallacy that cascading robust classifier is provably robust to epsilon perturbation. The authors first pointed out a counter example of such method and then provided a systematical algorithm to generate the adversarial examples from a sequence of provably sound classifiers. This paper essentially showed that chaining the epsilon-robust classifiers are by itself not epsilon-robust.
strength_and_weaknesses: Strengthes:
- The layout of this paper is good and easy to follow, pleasant to read and the idea is interesting. In fact, I am surprised such mistake in cascading classifiers are pointed out until now. 
- The completeness of this paper is good: the authors first provided a theoretically sound proof; followed by a practical algorithm to find the adversarial examples; and finally intensive experiments are made to show that such algorithm is indeed able to 


Weaknesses:
- Does (Blum et al. 2022) also employ the erroneous cascading ensemble? I roughly checked their paper and it seems not the case.
- It looks like even in (Wong 2018), the cascading ensemble was still claimed as one of the smaller contributions (only mentioned in one paragraph). So I think the negative impact of the unsoundness is limited ==> not sure whether publishing in a workshop is a better option (but I left this for authors and ACs to decide).
- Another question is -- instead of defining $\tilde{F}_{\text{cert}}=1$ 

as  $\tilde{F}_{label}$ to be epsilon-locally robust, can we define 

$\tilde{F}_{cert}=1$ 

to be 
$\tilde{F}_{label}\text{ is } \epsilon$-locally robust AND

$\tilde{F}_{label}$ equals to the ground truth $y$? 

Because if the classifier makes a mistake, then we don’t need to care about its local stability at all. By strengthening the definition, the cascading classifier seems to be correct again.
clarity,_quality,_novelty_and_reproducibility: The clarity, quality, novelty and reproducibility are all good. Overall, this is an interesting paper.
summary_of_the_review: There aren't a lot to comment for this submission, after all this is a correction of previous misbelief.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Cascading ensembling of certifiably adversarially robust classifiers, which has been used by previous works, is shown to be unsound, which is demonstrated by theoretical proof as as well as experimental results on real test set data.
strength_and_weaknesses: Strengths:

- The theoretical introduction and methodology are clearly presented and appear to be sound.

- The experimental evaluations are very strong, as (contrary to other counterexamples against similar certifications) they work with fixed input points and fixed radii. I.e. not finding specific, potentially non-sensical input images but evaluatin the actual test set.

Weaknesses/Issues/Suggestions/Questions:

- The paper is mostly about showing that a previously presented improvement of adversarial robustness certification is invalid.
I think it is very important to point out crucial issues with previously published and well cited papers, so I think that the submission is a good contribution for ICLR.
However, I am not sure how popular/relevant the cascading methods in [1] and [2] are currently and if they are nominally relevant when applied to ensembles of and compared with state of the art certifyable robusntess techniques. A bit more evidence for them being used would underline the importance of the submission.

- A more concrete overview of the attacked ensemble from [1] would be helpful. Particularly on how the sequence of models has been trained.
	- I would assume that if the models were trained independently (e.g. just from different seeds), the attack success rate on the cascading ensemble would be much smaller. Is that correct?

- It would be helpful to emphasize that cascade ensembling over different certification methods for one classifier, as e.g. done in [3], is sound.

- "We solve the optimization problems on lines 6 and 8 using projected gradient descent (PGD)" -- Why do you not use a stronger adversarial attack scheme, like AutoAttack [0]? Intuitively, the same considerations as for adversarials should apply for optimizing the objective for $\tilde{F}(x+\delta)$, right? Since and attack and not a defense is presented, this is not a major issue since the claims made by the paper could only be improved, but it could lead to improvements and might be the correct thing to do.

- The paragraph on "Surrogate Objectives" is very confusing to me and should potentially be rewritten.
	 - Optimizing the indicator functions does not seem to make sense: Would $argmax_\delta \mathbb{1}[\tilde{F}_{cert}^{(i)}(x+\delta)]$ not be realized for too many points, often including $\delta = \vec{0}$ since the function value is either $0$ or $1$?
	 - Before, completely black box models were considered, but now access to the logits is assumed; this new assumption should be stated.
	 - For the sake of demonstrating wrong certifications, it might make sense to use a specific objective for each model that appears in the counterexample. 

- There are very small differences between the evaluations in Table 1 and the original numbers from [1]. How can they be explained? Potentially, the explanation should be included in the paper.

- The proposed weighted does not seem to be a convincing contribution.
	 - Its results are not better than using the single first model (correct?).
	 - Its construction and its theoretical soundness are not particularly surprising or insightful. 
	 - The case presented in Example 5.4. shows that there are situations where a voting ensemble does better than a single constituent model. However it doesn't seem to be possible to decide if this is the case in a given situation (without knowing the test labels). There are certainly also many situations where it is the other way around, and the voting ensemble is worse than a single model.
	 - Still, it is a baseline alternative to cascading ensembling, and thus it is interesting to have it discussed and evaluated in this paper, I would just not see it as a recommendable alternative to using a single model, as I understand the results.

[0] Croce and Hein, ICML 2020: "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks"

[1] Wong et al., NeurIPS 2018: "Scaling provable adversarial defenses"

[2] Blum et al. 2022: "Boosting barely robust learners: A new perspective on adversarial robustness."

[3] Gowal et al. 2018: "On the effectiveness of interval bound propagation for training verifiably robust models."
clarity,_quality,_novelty_and_reproducibility: - The presentation is clear (maybe except for the "Surrogate Objectives" paragraph) and easy to follow.
- The issue with cascading ensembles has not been known previously as far as I am aware, thus the main result is novel.
- The used models are clearly referenced, and the methods are described well enough that manual re-implementation should not be an issue.
- The submitted code appears to be well documented and to contain all relevant experiments (though I didn't run it myself yet).
summary_of_the_review: - The paper points out an important mathematical issue with the method of cascading ensembling of certifiably adversarially robust classifiers and shows with convincing experiments that this issue is relevant in practice.
- This makes it an interesting contribution in my opinion.
- The proposed weighted voting ensembling method is to my understanding not convincing by the discussed theoretical properties or experimental results, but it does not really hurt the paper and its efficacy is not overclaimed.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper presents a counterexample to prove that certified cascading robust classifiers does not hold up to its certified robustness claim. Then, they proposed an attack method to show that on real data, models certified for cascading robust classifiers failed to held up to their certification. In other words, there are adversarial examples that makes the certified robust accuracy significantly lower than the certification. Finally, they proposed an alternative ensemble method, weighted voting ensemble, that is provably sound (can correctly provide a certified robust radius).
strength_and_weaknesses: Strength
- The paper is straight forward, rigorous, and easy to follow.

Weaknesses
- I am not confident how important/widespread cascade robust classifiers are. If it is barely used, it may limit the scope of this paper.
- In Table 4 and 5, is the CRA for cascading ensemble the correct CRA or the overestimated CRA? It seems it is the latter one. If that's the case, I think it is necessary to compare the ERA with the CRA of weighted voting ensemble so that we can understand how effective is the weighted voting ensemble.
- It also seems that weighted voting have CRA and Acc less than or equal to a single model. So what could be the use case of this ensemble over a single model.
clarity,_quality,_novelty_and_reproducibility: The paper seems reproducible, clear, and easy to read. It does point out some issue with the robust certification of cascade classifiers that is not previously known. 

The result seems reproducible.


summary_of_the_review: I think this is a well-written paper. However, the paper seems to have a limited scope and the proposed method seems not so useful.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The reviewers and meta reviewer all appreciated the quality of the work with a clear, well-written manuscript, focusing on an original and surprising observation, namely that cascading ensembles of certifiably adversarially robust classifiers is not sound
Moreover, the method is supported by both solid theoretical justifications and experimental validations. 

They thank the authors for their response and their efforts during the rebuttal phase, which was helpful to improve the submission and clarify concerns (e.g., more background about previous work & cascading ensembles, discussion about significance and new results for independently trained models). The reviewers and meta reviewer unanimously recommend the paper for acceptance.

As suggested by some of the reviewers, it would be important to improve the paper by underlining the cascading method's significance which seems not to have been broadly used in the past few years.
justification_for_why_not_higher_score: * The topic of the paper is arguably "niche", so an oral may not be of interest for the wider ICLR community.
*  The cascading method's significance that the paper focuses on is arguably limited.
justification_for_why_not_lower_score: * Original and surprising observation.
* Solid theoretical justifications.
* Solid empirical validation.
* Good support from all reviewers.
* Manuscript of good quality.
Decision: Accept: poster