Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes to divide computational graph of the neural network into the fixed path and float path and then shows the improvement of robust accuracy is mainly gained from correcting the vulnerability floating neurons. Specifically, the neural network graph is first divided into several activation regions and thus the output of layer i could be decomposed into the combination on those regions. Then based on whether the prediction would change or not, it defines the float and fixed neurons. The float path then could defined if there exists any neurons in the paths. According to the definition, the margin change in the output could be found not related with the fixed path. Therefore, the paper proposes SCRFP that empirically count those neurons that the change of prediction is in a certain region by adding Gaussian noise. The experiment shows the proposed method achieve a better clean accuracy with the same robust radius.
strength_and_weaknesses: Pros:
1. The proposed idea is quite novel and could be impactful to understand the model's robustness.
2. The proposed method is backed with comprehensive theoretical analysis.
3. The proposed method shows a clear improvement on the clean accuracy.


Cons:
1. It is not clear whether the proposed assumption that there only exists fixed and float path is true. Or in other words, it is not trivial to set a threshold to determine which neurons would be regarded as float neurons or fixed neurons. The BinomPValue is used however it is not sure it matches the definition in the theoretical analysis.
clarity,_quality,_novelty_and_reproducibility: Clarity: The illustration of the definition and lemma is not very clear. It lacks an overview of how the theorems and lemmas are connected. For example, I am not sure how lemma 1 contributes to deification 3 and 4, which makes the paper not easy to follow.

Quality: There are also some typos and wrong definition in the paper. Such as \mathbb{R} is also in the text however \mathcal{R} is used in the equation. 

Novelty: The proposed idea is novel and interesting and could be impactful to understand the model's robustness.

Reproducibility: Since the hyperparameters and code are provided, the paper results should be reproducible.
summary_of_the_review: The paper proposes an interesting perspective to understand different neurons' roles in the random smoothing procedure and then proposes a way to increase the performance of random smoothing. The proposed method is novel and could be impactful. However, the paper lacks clarity on how the lemma and definition and make the paper not easy to follow.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a framework to decompose a neural network based on its neurons' activation status. Then the authors tried to explain adversarial examples and randomized smoothing based on this framework, and proposed a method to repress the float path to achieve better certified robustness.
strength_and_weaknesses: Strength:
Recently researchers started to look at the activation space of neural nets for adversarial robustness. This paper is also from this perspective but combines it with randomized smoothing. 

Weakness:
1. I found some notation issues in the paper. For example:
1.1 in equation (4), the expectation $E[g_m(x')=y]$ is unclear to me. Should there be an indicator function, as $1_{g_m(x')=y}$ in the expectation? Also, I think it should be $\forall x'\in B $ instead of $\forall x\in B $.
1.2 In Definition 1, the meaning of $(i, j)\in \mathcal{I}$ also seems unclear to me (does that mean "index"?). I think it would be better to define it in the statement.
1.3 In Equation (8), the authors used $\cap$ (intersection) instead of $\cup$ (union), which contradicts the sentence above it. I assume the sentence above Eq (8) should be "intersection".
1.4 It seems to me that the authors used $\mathcal{R}$ and $\mathbb{R}$ interchangeably for the activation region.
2. In the proof of Lemma 1 the authors use batch normalization, but the conditions of Lemma 1 do not include it. I am wondering why batch normalization is needed in the proof.
3. Statement 4 of Lemma 2 is unclear to me. Proof of it in the appendix is also not so convincing. Do the authors assume the activation is always ReLU in this Lemma, or it can be any function such as sigmoid? If it is not linear, I don't think we can replace a finite difference with a simple Jacobian, which is claimed in the proof. Also, even if its a fixed path, the output can also change because the activation is not constant. So the statement that $Z^I(x',A,R)=Z^I(x',A',R)$ is not clear to me. Did I miss anything here?
4. I think there is an important reference missed: Zhang et al "A Branch and Bound Framework for Stronger Adversarial Attacks of ReLU Networks", ICML 2022. This work also studied the adversarial examples in the activation space of ReLU networks.
clarity,_quality,_novelty_and_reproducibility: I found this paper a bit hard to follow given the notation issues mentioned in the weakness section above. I humbly suggest the authors double-check the notations and simplify some notations for better readability. I also suggest the authors have a diagram of a toy example to better explain the concepts introduced. 
summary_of_the_review: In general, I think the author's high-level intuition is interesting and this is a good research perspective. But I found some flaws in the author's claims. So I encourage the authors to clarify them in a revised version.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper begins by defining the activation path/neuron and categorize them into fixed and float path/neuron. Then they show that smoothed classifiers cannot boost the performance of fixed paths. Based on this observation, they then proposed their algorithm -- SC-RFP. SC-RFP down weights the float paths, in other words, they want the smooth out the float paths. Experimentally, they report the proportion of fixed neurons and concluded that majority of the neurons are not affected by SC-RFP. They also show that their method (SC-RFP) can achieve a better certified robustness on ImageNet comparing with many recent works.
strength_and_weaknesses: Strength:
- Claims are well supported and the design of SC-RFP is reasonable.
- SC-RFP provides decent improvement over some prior work. 

Weakness:
- One major concern is the lack of comparison with related work [1]. I believe this work also decompose the ReLU network in to regions formed by linear hyperplanes (although they are not based on smoothing).
- What is the shift parameter of \phi_i? 

[1] Jordan, Matt, Justin Lewis, and Alexandros G. Dimakis. "Provable certificates for adversarial examples: Fitting a ball in the union of polytopes." Advances in neural information processing systems 32 (2019).

Minor:
- For the definition of U_i in page 3, should s_i be \gamma_i instead?
- There are many notations, having some figures to make the definition and lemmas more intuitive would be great.

clarity,_quality,_novelty_and_reproducibility: The paper seems reproducible. 

I have not checked through every detail of the proof in the appendix, but the lemma and theorem statements seems reasonable to me.
summary_of_the_review: This is a solid paper. The reasoning makes sense, and the proposed algorithm has decent improvement.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper presents SC-RFP, a novel algorithm to enhance the empirical performance (certified accuracy) of classifiers based on randomized smoothing. SC-RFP operates by reducing the contribution of neurons that change activation phase across perturbations, and is demonstrated to positively affect performance.
strength_and_weaknesses: The authors divide neurons of piecewise-linear networks into "fixed" and "float" neurons, depending on whether their activation phase changes within the perturbation radius, and point out that randomized smoothing can only affect the contribution of float neurons to adversarial vulnerability. Starting from this rather intuitive observation, the authors propose to keep track of float neurons, and to reduce their effect, hence further smoothing the resulting classifier.

The empirical performance of the method (at seemingly no additional cost) is definitely appealing. The method only relies on simple intuition (a strength), but does not (as far as I understand) provide any theoretical result backing the empirical performance.
The randomized smoothing literature (e.g., Cohen et al 2019) provides a tight upper bound on the robustness of the smoothed classifier. Does SC-RFP alter this upper bound? 
In Cohen et al 2019 the reported certified accuracy is the "approximate certified test set accuracy", which is a high-probability lower bound on the true certified accuracy. Is this the case for the provided results? Could the authors provide additional information on which statements from Cohen et al 2019 hold for SC-RFP, along with a short proof? (I believe porting some of the results will be quite immediate)
In general, the poor presentation of the paper makes it hard to adequately assess the authors' claims.


clarity,_quality,_novelty_and_reproducibility: The idea behind SC-RFP is simple and novel (to the best of my knowledge). However, the presentation is quite confusing, full of typos, and assumes deep familiarity with concepts in the randomized smoothing literature. The notation is particularly heavy and, in my opinion, convoluted, given that some of the employed concepts are well-known (like activation patterns). The paper introduces non-standard concepts without proper explanations: for instance, "bent-hyperplanes", which likely comes from Hanin et al 2019b.

The related work is relatively comprehensive. However, it would be nice if the authors could acknowledge work on bridging the gap between adversarial training and verified training ([ReLU stability](https://arxiv.org/abs/1809.03008), [COLT](https://openreview.net/forum?id=SJxSDxrKDr), [IBP-R](https://arxiv.org/abs/2206.14772), as these works try to address some of the scalability issues of worst-case verified training.

The authors provide code in the supplementary material, ensuring reproducibility (though I have not checked the code itself).
summary_of_the_review: While the algorithmic idea behind SC-RFP is novel and empirically effective, I do not believe the paper is publishable in the present form due to the quality of its presentation. However, I am willing to increase my score if the authors addressed the major weaknesses of the presentation.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper first demonstrates an interesting finding to explain why randomized smoothing works --- the paper partition neurons into "float neurons" and "fixed neurons" by whether the activation pattern of the neuron changes within an epsilon ball, and shows that randomized smoothing can lead to a robust classifier mainly based on correcting float neurons. Based on this observation, the authors proposed a simple algorithm to improve the certified robustness of the randomized smoothing algorithm by repressing the float neurons. 

All the reviewers and the AC think this is a strong paper and should be published. The finding of "randomized smoothing can't correct Lipschitz vulnerable data but can correct float neuron vulnerable data" is interesting. Further, the proposed algorithm seems to be a universal technique that can be easily applied to any existing randomized smoothing methods. Therefore, we recommend accepting this paper. 

During the discussions, some of the reviewers still think that the clarity of the paper can be improved. More specifically, the definition of float/fixed neurons/paths may be over-complicated and we'd like to encourage the authors to simplify the notation in the final version, if possible. Further, the AC has the following suggestions after reading the paper and discussing with reviewers: 

- Theorem 2: At the first glance, it is hard to understand why Theorem 2 implies "the smoothed classifier fails to correct Lipschitz vulnerable data". Although it becomes clearer after careful thinking, please add more explanations here since this is one of the main contribution of the work. Also, please use the same font for Z^T as defined in Theorem 1. 

- Connection between observation and theory: The connection between the observation (Theorem 2) and the proposed algorithm is not very clear. In fact, the AC still has some questions even after reading the response from the author. In particular, the authors mentioned that 

"As we discussed, the smoothed classifier aims to reduce the effect of that sudden change from the float path, this implies that repressing the float path can further improve the performance of the smoothed classifier."

I understand the first sentence is implied by Theorem 2, but it's still not clear why this implies repressing the float path can *further* improve the performance. It's possible that the randomized smoothing can already correct such sudden changes and thus repressing the float paths has little effect on the final performance. We encourage the authors to add more discussions about the connection between Theorem 2 and the proposed algorithm. 




justification_for_why_not_higher_score: There are several rooms for the improvements, as pointed out in the meta review. 
justification_for_why_not_lower_score: The paper makes a solid contribution to the randomized smoothing algorithm.
Decision: Accept: poster