Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 8: Accept
review_content: This paper was very clearly written and easy to follow. Kudos to the authors. In particular, the experimental evaluation section was exceptionally clear. Thanks to the authors for making the paper so easy to review. The “Main Contributions” section was excellent as well as it allows the reader to quickly understand what the paper is claiming.

The introduction & related work section was very clear, and seemed to quickly get the reader up to speed.

Minor critiques:

- It’s not clear to me that the network size is actually as impressive an improvement as is implied. Barring an extensive hyper-parameter search that demonstrated that this network architecture is the smallest possible that could achieve the presented results, I strongly suspect that applying techniques from papers like EfficientNet [1] or MobileNet would allow the authors of Mirman et. al (2018) to reduce the number of parameters required to achieve their results. I don’t think this takes away from the paper, though- the results are strong despite that. I would encourage the authors to weaken the claims that the only better network is 5 times larger. 

- In general, I would have liked to see more evaluation- e.g. I would have liked to see more results with a variety of perturbations (2 through 8, not just 2 & 8), and on a variety of datasets. 

Questions to the authors:

- How robust is the algorithm to architecture choice? 
- What happens if you change the test set? E.g. instead of evaluating on the first 1000 images, what if you evaluate on another random subset? Does that make a difference? I’m concerned that the subset of the test set the authors are using for evaluation isn’t representative of the entire test set. 
- Is the current architecture the largest network that can be run? I would be interested in seeing how network size affects the performance of your technique. 
- What hyper-parameter tuning did you do? What other network architectures did you try? 
- How do the comparison methods compare in terms of training time/machines used? E.g. do all the methods reported in Table 1 use similar amounts of computing power? 


Overall, this is a great paper, with some interesting results presented in a tight, clear manner. While I would like to see more experiments on larger datasets- e.g. ImageNet- the results seem solid and absolutely worthy of publication.

[1]: https://arxiv.org/abs/1905.11946v2
[2]: https://arxiv.org/abs/1704.04861
review_title: Official Blind Review #4

final_score: rating: 6: Weak Accept
review_content: 
Summary: 
This paper provides a promising new general training methodology to obtain provably robust neural networks (towards adversarial input perturbations). The paper provides promising experimental results on CIFAR-10 by obtaining state-of-the-art certified accuracy while also simultaneously improving clean accuracy. The paper is overall well-written and the algorithm is clearly described. 

Important questions to be answered: 
I find the need to clarify my understanding and request for more information in order to make a decision. 

--Methodology/motivation for the method: I am trying to understand abstractly what the proposed layerwise training is trying to optimize. To be concrete, let's compare to the relaxation of Wong and Kolter (which this paper uses in the instantiation of layerwise adversarial training). What's the exact difference?

One way to view this is the following: The same training objective, but a different way to optimize. The new proposal to train involves freezing weights until one layer iteratively starting from the input layer. It is possible that this kind of training provides some inductive bias in finding better solutions. Is this an appropriate understanding? 
However, the paper’s experimental results unfortunately change the certification procedure. In other words, they haven’t evaluated the same training objective as that of Wong and Kolter. Hence, it’s not clear if the gains are from the better networks, or better certification method, or network being better suited for certification by the method used. The phrase “same relaxation” is not appropriately used. Their certification procedure uses a different (and tighter) relaxation. 


--Effect on latent adversarial examples: I am unable to understand why this training procedure would reduce the number of latent adversarial examples. The definition of latent adversarial examples seems to suggest that it’s the gap between the actual set of activations corresponding to the input perturbations and the convex hull. However, the proposed layerwise adversarial training procedure involves replacing the actual set S_i with the convex hull C_i when freezing things till below i-1. I do not follow how the proposed method tries to make C_i = S_i. Implicitly the optimization objective does try to make C_i small because the bounds being optimized are tighter when C_i is small. But this is true even for normal certified training, and not sure what changes in the new training procedure.


Specific experimental results that would help: 
--Certified accuracy on using the same LP based certification procedure used in Wong and Kolter with the new layerwise trained networks
--The paper’s own certification procedure (a combination of previous methods) on the network from Wong and Kolter or a note on why that doesn’t apply (if it doesn’t)
--The paper currently provides only one data point to suggest this training method is superior. Would be good to try SVHN or MNIST. MNIST is perhaps “essentially” solved for small \eps. But would be good to see if the training method offers gains at larger \eps. In general, would be good to see more consistent gains. 
--The paper reports results on first 1000 examples of CIFAR10 test set. From my personal experience, there is a lot of variability in the robustness of test examples when evaluated on 1000 random test instances. Especially since the paper doesn't take a random subset, it might be good to make sure the gains are consistent on some other subset. The Wong et al. baseline is evaluated on the entire test set for example, and hence might not be a fair comparison? What's the Wong et al. accuracy on just the first 1000 test exampes

Overall, I am leaning towards accept but need some conceptual and empirical clarification from the authors (detailed above). 

review_title: Official Blind Review #3

final_score: rating: 8: Accept
review_content: Summary: the paper introduces a novel protocol for training neural networks that aims at leveraging the empirical benefits of adversarial training while allowing to certify the robustness of the network using the convex relation approach introduced by Wong & Kolter. The key ingredient is a novel algorithm for layer-wise adversarial (re-)training via convex relaxations. On CIFAR-10, the proposed protocol yields new state-of-the-art performance for certifying robustness against L_inf perturbations less than 2/255, and comparable performance over existing methods for perturbations less than 8/255 (where the comparison excludes randomized-smoothing based approaches as proposed by Cohen et al.).

The proposed methodology seems original and novel. The concept of latent adversarial examples, the layer-wise provable optimization techniques and the sparse representation trick are interesting in their own regard and could be valuable ingredients for future work in this direction. The improvement over the state-of-the-art on CIFAR-10 for perturbations less than 2/255 is significant (although I wouldn't call it substantial). For perturbations less than 8/255 the picture is less clear. The authors' explanation that they couldn't achieve state-of-the-art certified robustness because of smaller network capacity makes sense, however, it also highlights that their protocol doesn't scale as well as previous approaches.

I am not concerned about the missing comparison with randomized smoothing-based approaches (I find the rationale provided in Section 2 convincing).

The discussion of the relatively weak performance of previous provable defenses on page 3 is a bit vague, e.g. the statement that "the way these methods construct the loss makes the relationship between the loss and the network parameters significantly more complex than in standard training", thus causing the "resulting optimization problem to be more difficult". To me, these are one and the same thing, and a bit more rigour in the argumentation would be advisable here, in my opinion.

-------------

I acknowledge I have read the authors' response and also the other reviews/comments which confirm my opinion that this paper is worthy to be published at ICLR.
review_title: Official Blind Review #1

Meta-review: The reviewers develop a novel technique for training neural networks that are provably robust to adversarial attacks, by combining provable defenses using convex relaxations with latent adversarial attacks that lie in the gap between the convex relaxation and the true realizable set of activations at a layer of the network. The authors show that the resulting procedure is computationally efficient and able to train neural networks to attain SOTA provable robustness to adversarial attacks.

The paper is well written and clearly explains an interesting idea, backed by thorough experiments. The reviewers were in consensus on acceptance and relatively minor concerns were clearly addressed in the rebuttal phase.

Hence, I strongly recommend acceptance.
Decision: Accept (Talk)