Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: This paper studies the use of channel suppression in improving robustness to adversarial examples. The authors make a convincing illustration in section 3 on how adversarial examples tend to activate more channels compared to natural examples, and adversarial training is not effective in reducing them. This provides a convincing motivation to their design of the Channel-wise Activation Suppression (CAS) module. Their CAS module is also effective in improving adversarial robustness when used in conjunction with different adversarial defense methods, including adversarial training, TRADES, and MART. 

I think this paper is of high quality, but I do have several questions on the details: 
1. In section 4.1 there is a difference in how the mask M is produced in training and test phase. How important is it to have the correct y available for the mask, as oppose to \hat{y} from the channel predictions? For example it might be difficult to predict the target class from the low-level features (e.g. block 2 channel features), leading to inaccurate \hat{y} for channel suppression. Could this be a reason for lower performance of inserting CAS into block 2 in Table 3?  
2. Just to confirm, are both losses (CE and CAS) in Eq 5 taken into account in the generation of adversarial perturbations with FGSM and PGD? 
3. In Table 2, what does it mean to have CAS without channel suppression? Is it effectively just a CNN with predictions made from features in different layers? 
4. Do the authors have any intuitions on why having CAS module alone on Block 4 is better than having it on both Block 3 and 4 in general? 

I am leaning towards acceptance of this paper if the authors can address the above questions sufficiently. 

After author response: the authors have sufficiently addressed my questions and also the other reviewers' questions. I am keeping my score of acceptance. 
review_title: Good paper with some technical details to confirm

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: The authors studied the behavior of adversarial examples from the channel view of activations, which is very novel. They focused on the magnitude and frequency of activations and found that state-of-the-art adversarial defense (adversarial training) only addressed the magnitude issue but the frequency distribution issue remains. This provided a novel perspective for us to understand why state-of-the-art adversarial training method works to a certain extent but not so good. Then, the authors proposed a Channel-wise Activation Suppressing (CAS) to address the frequency distribution to further improve the adversarial robustness. CAS is generic, effective, and can be easily incorporated into many existing defense methods. 

Pros:
1. The authors studied adversarial examples from a new perspective of channels in activations. Previous works focusing on activations usually assumed that each channel is of equal importance, while the authors focused on the relationship between channels. From two aspects of activation magnitude and frequency, the authors found two novel characteristics of adversarial examples: adversarial examples have higher activation magnitude and more uniformly activated channels compared to natural examples. The findings were convincingly evaluated on different neural network architectures and different training methods. This hints at a very interesting phenomenon.

2. The proposed method is generic. The authors found that the activated channels are still uniform under adversarial training, that is, some redundant and low contributing channels are still activated. To suppress the redundantly activated channels, the authors proposed Channel-wise Activation Suppressing (CAS) training strategy. It dynamically learns and incorporates the channel importance (to the class prediction) into the training process. The motivation is very clear and the method is easy to follow. More importantly, CAS can be widely applied to strengthen existing adversarial training approaches since it suppresses those less important channels.

3. Lots of experiments are provided to understand and evaluate the proposed methods. The experiments covered lots of aspects, including channel suppressing effect of CAS, representation learning, ablation studies, and extensive robustness evaluation on white-box and black-box attacks. The authors also tested the adaptive attacks, strongest auto-attack, and the optimization-based black-box attack, which definitely convinced me of the effectiveness of the proposed method. 

Overall, the paper hints at an interesting phenomenon and inspires an in-depth understanding of adversarial training. The proposed method is elegant and generic. The empirical evidence is solid and extensive. 

Cons:
1. How does the activation threshold effect Figure 2?
2. In the testing phase, the predicted class of the auxiliary classifier is used for the channel importance. Is it vulnerable to attacks? if the predicted label is incorrect, how it will affect the final performance?
3. How well the auxiliary classifier works. With the limited information from the output of GAP, it is likely that the classifier performs poorly, and thus results in bad channel importance weighting.
4. CAS could both improve natural acc and adversarial robustness, why CAS could achieve this both? and how is the overhead of CAS?
review_title: This is a novel research paper

final_score: rating: 7: Good paper, accept
review_content: This paper investigates the adversarial robustness from the activation perspective. Specifically, the authors analyzed the difference in the magnitude and distribution of activation between adversarial examples and clean examples: the activation magnitudes of adversarial examples are higher and the activation channels are more uniform by adversarial examples. Based on the above interesting findings, the authors claim that different channels of intermediate layers contribute differently to the class prediction and propose a Channel-wise Activation Suppressing (CAS) method to suppress redundant activations, which can improve the DNN robustness. 

Some highlights in this paper:
+ The CAS strategy is simple and can be easily applied to existing models. Combining CAS with the existing adversarial training methods leads to better DNN robustness.
+ The experiments are well-conducted and convincing. The authors not only provided ablation experiments to verify the effectiveness of CAS, but also provided both the performance of the last epoch and the performance of early stop, which confirmed that CAS can improve the DNN robustness.
+ The paper is well-written and the idea is easy to follow.

However, there are some downsides. I’d like more details about:
- Adversarial training inhibits the magnitude of activation, what is the connection between this and network robustness?
- The closer the activation distribution of the adversarial example is to that of the clean example, the better the robustness of the network. It would be good to provide more discussions and explanations here.

Overall the paper is easy to understand and interesting.

review_title: Easy to understand and interesting while requires more explanations

final_score: rating: 7: Good paper, accept
review_content: ##########################################################################
Summary:  

This paper uncovers interesting phenomenons of adversarial training, i.e., more uniformly distributed adversarial data activations than those of natural data. To force the behaviors (in this paper, channels activations) of adversarial data to be similar to those of natural data, the authors explicitly suppress the redundant channels by reweighing the channel activations. 

##########################################################################
Reason for score. 

Overall, I vote for accepting. I like the uncovered phenomenons of larger and more uniformly distributed activations of adversarial data than those of natural data. 
Technically, this paper proposed effective training strategies (i.e., channel-wise activation suppressing (CSA)) to enhance adversarial training. 

##########################################################################
Pros: 

1 This paper provides the understanding of adversarial training from the channel activation perspective, showing that adversarial training can reduce the magnitude of the activation of the adversarial data, but fail to break the uniform activations by the adversarial data. 

2 Figure 2 shows the efficacy of the proposed CSA methods for breaking the adversarial data's uniform activations. Compared with standard adversarial training, CSA can further suppress the redundant channel activations. 

3 The experiment evaluations are comprehensive, showing CSA strategies' efficacy across various adversarial training methods, network structures, and attack methods. 

##########################################################################
Cons: 

1 What is the side effect of redundant channel activations? Specifically, what is the side effect of uniform activations of the adversarial data? Would you mind explaining more?

2 Although CSA successfully suppresses the redundant channels of the adversarial data, CSA also seems to suppress the activations of natural data? Is this the reason for the improvement on natural accuracy?

review_title: This paper proposes to use channel suppressing to enhance adversarial training. 

Meta-review: This paper focuses on two new characteristics of adversarial examples from the channel-wise activation perspective, namely the activation magnitudes and the activated channels. The philosophy behind sounds quite interesting to me, namely, suppressing redundant activations from being activated by adversarial perturbations. This philosophy leads to a novel algorithm design I have never seen, i.e., Channel-wise Activation Suppressing (CAS) training strategy.

The clarity and novelty are clearly above the bar of ICLR. While the reviewers had some concerns on the significance, the authors did a particularly good job in their rebuttal. Thus, all of us have agreed to accept this paper for publication! Please carefully address all comments in the final version.
Decision: Accept (Spotlight)