Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper proposes a defense that uses MCMC sampling with an Energy-Based Model as a preprocessing before classification.
The stochastic transformations used in preprocessing are sampled from the Langevin updates, which has been shown to be useful for adversarial defense in prior work.
Since there is no theoretical guarantees, I consider this method a heuristic approach with some empirical success.
However, there are already many empirical pre-processing defenses, and most of them have been broken by newer attacks.
It is not convincing enough that the proposed defense will be different. For example, one can design better approximations for the transformation operations in BPDA, instead of using the identity function. Actually, when the transformation is larger, the identify function can be a very poor approximation.
Also, the proposed method is not as robust as a variant of adversarial training (Zhang et al. 2019) as shown in Table 2. The authors claim that the main benefit of their method is that it can protect a pre-existing natural model. However, from the run time analysis, it seems that it is even slower than adversarial training, so I am skeptical about the practical value of this method.
review_title: A new heuristic adversarial defense without convincing empirical results.

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper discusses using a classifier + EBM  to construct an expectation of transformation (EOT) defense. The simple overview is that given an input image (potentially corrupted by an adversary), they use long-run Langevin dynamics seeded at the image to generate samples from the data distributions for the corresponding input image and then use samples to estimate EOT. 
1) A similar approach was used by Grathwohl et a. (2020) to improve the robustness of their model, so I was wondering if the authors can discuss their novelty here?

2) The paper is not very clear in terms of the methods, descriptions, and explanation of the tables. For example, Section 4.1 refers to "EBM defense" but has not been defined separately, so I assumed it is the defined EOT defense in 3.1 that uses EBMs as T(x).  

3) The classification accuracy of Grathwohl et al. (2020) against PGD in Table-1 is not consistent with what is reported in the paper. Grathwohl et al. (2020) reported that JEM-10 is a robust model against PGD attack (Figure-5 in their paper). Would you please discuss these inconsistencies?
 
4) The authors claim that EOT defense is their contribution, is there any discussion on why you only tried EBMs as T? Why not VAEs? VAEs are also capable of generating samples given the corrupted images, and the sampling process is much faster than long-run Langevin dynamics!  Their output may not be as sharp as EBMs, but does it matter here?

5) It would be nice to use your EBM (without the classifier) as a standalone model in Table-1 to see the comparison with IGEBM.

6) What if you use WideResNet with IGEBM? This actually shows the importance of your long-run sampling.

7) Could you present the effect of H for defense against PGD? I am interested to know how diverse \hat{x}_h are when you run convergent Langevin dynamics seeded at x.  


review_title: Interesting paper but needs more study 

final_score: rating: 9: Top 15% of accepted papers, strong accept
review_content: This paper proposes an interesting application of Langevin sampling with the energy-based model (EBM) to defend against adversarial attacks. Compared to adversarial training (AT), the proposed adversarial preprocessing (AP) based method can be used to secure existing models without the need for retraining.

As an EOT based defense, naturally, a larger number of replicates would lead to better adversarial robustness. The idea behind the proposed defense is to leverage the long-run sampling using EBM for the EOT based defense. However, training long-run EBM is challenging. To overcome this, the authors apply an interesting two-phase training method with Adam for the first phase to quickly train the short-run one and SGD for the second phase to gradually align the long-run one with the short-run one.

The authors compared their approach to a large number of defenses as well as the state-of-the-art AT based defense. The reported results are very impressive, with an 84.12% benign accuracy and 78.9% adversarial robustness on CIFAR-10. In addition, the proposed method can still achieve 54.9% adversarial robustness even under an adaptive attack, which is close to the state-of-the-art AT based defense. However, compared to AT, the benefit of the proposed method is that it does not require retraining the model. 


Strength:
- Achieve robustness performance similar to adversarial training without tampering with the classifier.
- An interesting two-phase training method to address the non-convergent problem for long-run sampling.
- Consider an EOT attack as the adaptive attacking method.

Weakness:
- Overall, it is hard to find flaws in this paper. The only concern I have is that the timing overhead is still large (~10 sec per image when K=1500, Fig. 10) and seems can hardly be parallelized since the long-run sampling is serial. This might greatly limit the applicability of the proposed defense when timing constraint is critical.
review_title: A nice paper with impressive performance and comprehensive evaluation

final_score: rating: 7: Good paper, accept
review_content: This paper proposes a Langevin dynamics based approach to defend naturally trained classifiers. To perform Langevin dynamics, an energy based model (EBM) is utilized, which is trained with realistic long run MCMC samples for effective purification and hence defense. 

The proposal in this paper are two fold:
1. Training of the EBM with long run dynamics along with using Adam optimizer in the initial stage and SGD for further training.   
2. An Expectation over Transformation (EOT) defense based on Langevin dynamics.

+ves: 
- The convergent learning of EBM was observed by Nijkamp et al. (2020) showing that the under this scenario short run and long-run MCMC samples have a similar appearance. 
Similarly, Keskar and Soccer (2017) show that switching to SGD from Adam can provide improved convergence. 
This paper utilizes the above mentioned ideas for training convergent EBM by using long run dynamics and by switching from Adam to SGD. 

Although, the proposal in this paper is interesting, I have some concerns whether the proposals are as innovative as claimed in the paper. 

Concerns: 
- The main innovative part of the paper is that it used long run Langevin dynamics using EBM for defending naturally trained classifiers. 
However Srinivasan et al. (2019) also utilized Langevin dynamics using EBM for the same task of defending against adversarial attacks, although the dynamics was performed with a modified distribution. A BPDA+EOT attack was also formulated to attack their own method in the above mentioned paper. 
The authors do not make a clear distinction of how their method is different from the above mentioned paper. 

- Although Adam was found not useful and switching from Adam to SGD was found to be helpful, the images from SGD alone is not shown. 

- There is no clear definition of what is considered as a short-run and what is considered as a long-run dynamics. 
 
- The Figure 3 lacks a detailed explanation. Are original images used in both the left and right figures or are they adversarial samples. Why is H=5,100 considered and not 150 as used in the experiments?

- Experimental settings in Table 1: JEM and IGEBM are also checked with long run dynamics. However, are the reported performance obtained by training them with long run dynamics? I suppose JEM and IGEBM can also suffer from unrealistic samples at long run due to non convergent learning as they are also EBM. In this case, the fair comparison should have been made by training both models with long run dynamics and switching from Adam to SGD. 

- The most interesting part of the paper, in my humble opinion, is the effect of long run dynamics vs short run dynamics for defense which is not well analyzed in the paper. 
Figure 8 in Appendix D shows a plot for increased accuracy as the number of steps increases. 
Can short run dynamics also be effective in defending by varying the hyper parameters (step size) of the Langevin dynamics after training EBM?
An in-depth understanding of this effect is missing. 

I will be open to changing my score based on the response from the authors.  
review_title: The proposal in this paper is interesting. However, I have some concerns whether the proposals are as innovative as claimed in the paper. 

Meta-review: Although the technical novelty is not very high, the finding that long-run Langevin dynamics with convergently learned model provides comparable defense performance to adversarial training will give some impact to the community. 

Decision: Accept (Poster)