Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes an architecture and a training methodology (termed RoCourseNet) to generate a robust counterfactual (cf) along with the prediction for a given factual point. RoCourseNet builds on earlier work CounterNet [1] by modifying its objective to generate robust cfs i.e cfs which stay valid even when the underlying model shifts. As part of the RoCourseNet objective, the inner ‘adversary’ itself is proposed as a bilevel problem (called VDS in the paper). The paper proposes to learn a ‘worst-case’ classifier by looking at how the training dataset can change such that a classifier learnt on this new dataset maximally invalidates the old cfs.  Experiments are performed on 3 real-world datasets and they compare against 4 baselines.

strength_and_weaknesses: + The paper deals with a practical problem; generating robust recourses is necessary for models which are to be deployed in the real world
+ RoCourseNet outperforms the baselines convincingly in generating robust recourses for the 3 datasets considered
+ RoCourseNet works with the full model and not its locally linear approximation (via LIME etc.) which allows it to model larger number of model shifts via the VDS algorithm

- RoCourseNet involves a tri-level optimization problem. How much additional computational effort does ReCourseNet require? A comparison of the training time taken vs CounterNet seems necessary. 
- The method lacks some flexibility of post-hoc counterfactual generation methods. Ex, different people have different notions of cost (proximity) or actionability. Can RoCourseNet solve this without retraining?

Other points:
* In Algorithm1 VDS line (8) how is this gradient w.r.t \delta computed? Is the only dependence of \delta through \theta(\delta)? 
* Although not completely fair, a comparison of the training time w.r.t ROAR [2] may also be instructive.
* Cite the published version of ROAR

[1] Hangzhi Guo, Thanh Nguyen, and Amulya Yadav. Counternet: End-to-end training of counterfactual aware predictions. In ICML 2021 Workshop on Algorithmic Recourse, 2021.
[2] Upadhyay, Sohini, Shalmali Joshi and Himabindu Lakkaraju. “Towards Robust and Reliable Algorithmic Recourse.” NeurIPS (2021).
clarity,_quality,_novelty_and_reproducibility: The paper is written clearly and is easy to follow. Code and implementation details are provided for reproducibility. The paper builds on existing work (CounterNet [1]), and novelty is in learning the ‘adversarial model’ for which they propose the VDS algorithm.
summary_of_the_review: The paper solves an important problem. The experimental protocol and results are convincing. The main issue I have is I feel the method is computationally expensive, and it lacks some flexibility that post-hoc cf-generation methods have. I propose acceptance, conditional on some time-complexity analysis.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper tackles the problem of generating counterfactual examples that are robust to distribution shifts.
To this regard, the authors first formulate a framework for this problem that considers a tri-level optimization problem.
Second, they propose a methodology, RoCourseNet, that solves a tri-level optimization problem.
They perform experiments on three standard benchmarks and find their results to be highly robust counterfactual explanations against data shifts that consistently outperform previous state of the art.

strength_and_weaknesses: ## Strenghts:

The authors are effective in inserting their work in the current state of the art, with a satisfactory related work and introduction section.
The methodology introduced is clear with helpful pseudo algorithms as accompaniment.
The authors include anonymized code with their submission, which helps in the reproducibility compartment.


## Weaknesses:

My main concern with this paper is the intuitive explanation of the underlying problem and, as a result, its lack of a formal definition.

The authors provide the classic example of an applicant to a loan bank.
Their goal is to provide a counterfactual explanation to a rejected applicant that is “robust” in the sense that the following time, if the conditions are met, the applicant will see its loan accepted.
What is then the definition of “robust” in this case? What if interest rates drastically change in the meanwhile? Should the application still be accepted? Or is it more a sort of “ceteris paribus” change considered here? 

This leads to the next point. The authors consider a worst case scenario, and use an adversarial technique to represent this.
It is the opinion of this reviewer that the authors did not really justify this choice.
As seen in the literature (Goodfellow 2014 and many others), adversarial attacks are often random to the human eye. Why then assume a worst case scenario, maybe even an unfeasible one? What is the probability of observing such a change?

Finally, it could be argued that this method  ends up just trading off validity and robust validity with an increased proximity, as it seems to be the case in at least two of the three datasets considered in figure 2.

The fact that all comparisons are performed against methods that make stronger assumptions does not help in evaluating the method, the addition of a heuristic based similar technique would have helped in this regard (even a simple random baseline).

clarity,_quality,_novelty_and_reproducibility: The paper explanation of the method is clear with the nice addition of suitable pseudo algorithms.
Code is provided as well, which helps reproducibility.

However caption 1 is insufficient and should be more detailed.
The same can be said basically for all captions in this paper.

In table 1, first row, first column, is Counternet the right value to be put in bold?

Regarding novelty, while the authors are the first to consider this problem, it is not clear if the problem itself is rightly formulated or interesting enough in this form, limiting the overall impact.

summary_of_the_review: While the paper has some strengths, as highlighted in the relevant strength section, the lack of a clear and formal definition of the problem they are facing severely limits their chance of acceptance for this paper as it is. 
Addressing the points listed in the weaknesses section could improve the rating of this paper according to this reviewer.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors propose combining adversarial training with recourse generation methods to produce a robust recourse generation method, by solving a min-max-min tri-level optimization problem. They show that their method works better than competing state-of-art methods on several real world data shift datasets. 

strength_and_weaknesses: Strengths: 
- The method is fairly straightforward and easy to understand, combining adversarial training with recourse generation. 

- The method works better than other state-of-art method in robust recourse generation, and the experimental evaluation is quite thorough. 

Weaknesses: 
- The method is a fairly direct combination of robustness through adversarial training and existing recourse generation methods. The novelty is not very high, although the authors did solve the technical difficulty of solving the tri-level optimization problem. 

- The current work considers robustness to adversarial perturbations to inputs in generating counterfactual explanations. But adversarial perturbations is a fairly specific and strong type of data shift, which does not cover all the cases suggested in the introduction. Have the authors considered robustness to other types of common data shifts such as covariate shifts or label shifts?  

- It is odd that while the algorithm is trained on adversarial perturbations, the evaluation is focused on temporal data shifts, which is a mismatch. Are there any explanations on why models trained on adversarial data shifts work well on temporal data shifts? 

clarity,_quality,_novelty_and_reproducibility: - This paper is quite clearly written, and the technical quality is high. However the novelty aspect of the paper is relatively low.  

summary_of_the_review: This work is of high technical quality and the method produced by the authors can beat other state-of-art methods in generating robust recourse. The main limitation is the relative lack of novelty of the method or any new understanding or insights.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This submission proposed an approach to solving the data distributional shift problem in recourse models. A min-max-min learning objective is proposed to learn the predictions and enhance the robustness of future data shifts. Then an optimization framework, RoCourseNet, is designed to optimize the learning objective. Experiments on three datasets and comparisons with several existing baselines demonstrate the effectiveness of the proposed method. 
strength_and_weaknesses: Strength:

1. The paper is easy to follow.

Weakness:

1. The motivation is not clear. When I look at the title of this submission, I feel this paper is related to the distributionally robust optimization (DRO) topic. However, I find the main part of this paper is related to adversarial perturbations. Therefore, the title is easy to mislead the understanding of this paper. I do not mean this title is a mismatch with this paper. But 'DISTRIBUTIONALLY ROBUST' is not fit well in this paper. Most importantly, it seems like the robust recourse is dynamically generated during training. According to (4), $x^{cf}$ is generated by another model (i.e., neural network) $g$. The final model should be $f$. I guess the distribution shift only works on $x$ instead of $x^{cf}$. However, in Figure 1, it is not clear what the data shift is. One observation is the model shifted but the data is not shifted. Moreover, the experiments are based on three datasets. However, distributional shifts in the training data (as mentioned in the Abstract) are not demonstrated on these datasets.

2. Notations are not clear. For example, in Section 3.1, what is the domain of $f$? Is it a real number or belongs to {0,1}? In addition, below (1), $\mathcal{F}={\theta'|\theta+\delta}$. This $\delta$ works on the model parameters. However, according to (3), $\delta$ seems working on features. I am very confused with this parameter. 

3. In experiments, Table 1 is hard to read. For the three metrics, it is not clear whether the values large better or small are better. Most importantly, what is the meaning of bold values? If the bold value means the best result, why 6.746 $\pm$ 0.723(from Loan, Proximity) is the best? It seems like this value is not the best.

4. In Section 4 (Cost-Validity Trade-Off), I am very confused with the discussion from the **Cost-Validity Trade-Off** paragraph. First, I am not sure how to define 'the three best performing models from Table 1'. Section, What is the meaning of ambiguity sizes $\epsilon_1$ $\epsilon_2$? Third, the authors mentioned 'These figures show that ...'. I do not know which figure is for this discussion.

5. Since the proposed optimization framework has no convergency guarantee, the authors should show the tendency curve of training loss. Moreover, since this task is a classification task, the authors should show the accuracy performance besides the metrics only for CF. Even Upadhyay et al., 2021 show accuracy and AUC (See Table 2 in [Upadhyay et al., 2021] for evaluating the performance of generating robust recourse). Without accuracy, it is hard to say the applicability of the proposed model. 
clarity,_quality,_novelty_and_reproducibility: The quality of this submission is not high. The motivation is not very clear. The evaluation metrics are not comprehensive. 

Some notations are not clear.   

The proposed methods seem original.  
summary_of_the_review: I suggest rejecting this paper. For details, please see my weakness.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper provides a method for explaining machine learning classifiers using counterfactuals. In particular, they are especially interested in being robust to distribution shifts.

The reviewers had mixed feelings on many aspects of the paper: the importance of the problem, the motivation for using an adversarial approach, and the practicality of the given approach.  
justification_for_why_not_higher_score: Basically nobody was very excited about this paper. One reviewer found the problem very interesting, but nobody loved the solution or found the results overwhelming.
Decision: Reject