Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper applied domain adaption ideas into the adversarial settings. Based on it, they proposed Adversarial Feature Desensitization (AFD) by leveraging a discriminator network to minimize the  distance between adversarial feature and natural feature. They show that their method could improve the robustness  compared to TRADE and AT and could also generalize well to other attacks (with different epsilon).  
main_review: The main drawbacks stopping me to accept this paper at this moment are as follows.  
1. The computation cost of this method. Although the show their method on Tiny-ImageNet, but it is also important to show the results on large-scale ImageNet  dataset. Additionally, in Tiny-Imagenet, their performance is not as good as TRADE.  
2. The effectiveness of their methods. In CIFAR-10, I do not know why AFD-DCGAN show poor performance. It is important to explain the reason. 
3. The evaluation  is not sufficient. To evaluate the robustness of their methods, it is also important to evaluate the performance with Autoattack. Additionally, I also suggest the author to evaluate their method by using stronger blackbox attack method (e.g.  SPSA) . 
limitations_and_societal_impact: N/A
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposes a feature desensitization method for adversarial defense. The authors formulate robust representation learning problems from the domain adaptation perspective, the algorithm to solve which is based on two-player minmax methods (i.e., GAN). The evaluation results on multiple datasets demonstrate the advantage over baseline methods. The learned feature also shows to be spare.

main_review: The paper is well organized and written. I like the idea of investigating robust feature learning from the domain adaptation perspective. The intuition and insights are also nicely discussed with nice figures to give intuition on the difference of AFD from adversarial training and TRADES.

The proposed method is also feasible and seems to be sound. The evaluation also gives interesting results. 

Even though, the paper still posts several questions that should be carefully addressed:

- All the evaluation is only performed on one network architecture, without proper justification why on single architecture, this is quite limited. I strongly recommend authors add more diverse architectures in the study, at least on CIFAR and Tiny Imagenet datasets.

- It lacks a study of the efficiency of the proposed methods, please add the discussion and results regarding this. This could be very important to know what the cost needs for the gain.

- Another concern is the selection of the feature extraction part and classification part. The setting in the paper is a reasonable choice, but it would be important to justify whether this is the only choice and the best one, which may not necessarily be the best from my perspective.

- Besides the performance advantage, it is more important to show what new stuff AFD brings, making it different from adversarial training and TRADES. One way might be to show the inference results difference by AFD and the other two methods, and analyze why it is the case. Since there are already quite a few methods there, when proposing a new one, it is very important to justify 

what makes the newly proposed method unique from existing ones, besides the performance enhancement. 

- An important claim of this paper is that the learned feature is robust. It would be necessary to perform an evaluation to support this claim, e.g., the authors could calculate the pairwise feature-based distance before and after the attack?

I think this paper is working in a promising direction and hope more supporting results could be provided to make it more comprehensive.

limitations_and_societal_impact: Please refer to the main review.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a new defense mechanism against adversarial examples (AE). It first formulates an upper bound of the adversarial effect using a distribution distance from domain adaptation, and then designs a defense playing a game with 1) an domain discriminator the adversarial/natural domain and 2) a feature extractor that tries to make the adversarial/natural inputs indistinguishable. 
main_review: **Clarity**
The paper is well-written and motivated. The theoretical parts are easy to follow and are supported by running examples. Experiment description has included enough details for people to understand the setup with little doubts.

**Originality**
The techniques are not ground-breaking new: GAN has been used in AE generation/detection; there's also work investigating AE from the adv. distribution perspective too. However, the paper has done a great job applying these concepts in a coherent way and ends up with a well-explained and easy-to-follow defense mechanism. It adds a new defense with SOTA performance, and I learned something new from the paper.

**Quality and Significance** 
The experiments illustrate 1) the performance advantage of the new mechanism, 2) the promised dimension reduction effect, and 3) the quality of the upper bound estimation. The experiments are well designed for a conference paper. 
The theoretical part, as the authors have self-identified in the limitation, may not directly guarantees the performance due to the heuristic nature of the algorithm. Nevertheless, it provides some good insights.
Overall, this paper is of good quality.

**Questions and More Detailed Comments**

1) The caption of Table 1 mentioned reporting both the mean and the std. However, only the mean is reported. Is it the std reported elsewhere?

2) I feel the discussion of relation to AT is slightly over-stated. In particular, the actual AFD also requires an AE generation process, which may not be perfectly finding the "strongest" AE either. So instead of finding the upper bound, the AFD heuristic is getting a "lower bound of the upper bound", which in turn may not be necessarily better than the lower bound of AT. Maybe this part can be tuned down a bit.

3) How well is the domain discriminator doing at the end of training, against seen/unseen attacks? How does the result compare with the existing SOTA AE detectors?

3) If the submission is accepted, I highly encourage the authors to release the code and present them in a modular way so that other researchers can readily test this framework with more AE generation processes or GAN structure in the future. 
limitations_and_societal_impact: The limitation and societal impact are sufficiently discussed.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposes a new framework for adversarial defense. The core idea is to develop a GAN-style training strategy that encouraging the model to distinguish the features of natural and adversarial examples.
main_review: The proposed framework is novel and the intuition behind is very interesting. I particularly like the comparison to adversarial training, which explains why the proposed approach works better.

The improvement over adversarial robustness is very good, and we should be cautious about the results. I encourage the authors to use AutoAttack (https://github.com/fra31/auto-attack) to test their models. The implementation should be very easy as long as you provide the proper API. Although the authors include results for many types of attacks, some of them are outdated and easy to be fooled, while attacks in AutoAttack are often considered comprehensive. It is also easy for readers to compare to other works as they maintain a leaderboard.

I am also interested in the computational complexity of this framework. Essentially it also requires adversarial example augmentations, therefore the computational overhead should be similar. It raises question that recent works in adversarial training are able to use single-step attack for the training. Could similar thing be done for this framework as well? It will be interesting to see as it could help scale this framework to ImageNet.
limitations_and_societal_impact: The authors adequately addressed the limitations and potential negative societal impact of their work.
review_title: null

Meta-review: This paper is very much on the border. One reviewer votes for acceptance, two are marginally above the threshold and one is marginally below with several concerns. After inspecting the paper by myself, I lean toward acceptance mainly because the paper manages to propose a technically sound and well explained defense mechanism from a novel point of view. This could potentially facilitate the development of the challenging problem of improving adversarial robustness.

Nevertheless, the concerns raised by reviewers, especially in higher computational cost and marginal improvements over AT and TRADES when evaluated by strong attacks, are still valid. I strongly encourage the authors to add the new results and properly discuss the possible limitations of the proposed method when preparing for the final version.
Decision: Accept (Poster)