Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 5: Marginally below acceptance threshold
review_content: **Summary:**
The paper proposes a new adversarial training procedure that finds worst-case batch normalization (BN) parameters in some Linf-ball around the identity BN parameters. The authors show that this approach combined with AutoAugment significantly improves the accuracy on challenging datasets with domain shifts like ImageNet-C, Stylized Image-Net, and ImageNet-Instagram. Moreover, the authors show improved results on a semantic segmentation task. However, some experimental details presented in the paper require a further clarification.

**Pros:**
- The approach consistently improves on different datasets that measure robustness towards domain shifts (ImageNet-C, ImageNet Instagram, Stylized ImageNet).
- The approach doesn’t require any extra data (labeled or unlabeled).
- The approach also leads to better results for semantic segmentation.

**Cons:**
- Misleading presentation of the AdvBN results. In particular, in Table 1, “AdvBN” rather refers to “AdvBN + AutoAugment”. But it’s clear that adding AutoAugment to any other competing method would also improve them. Thus, one has to separately report results for “AdvBN (without AutoAugment)” and “AdvBN + AutoAugment” to allow a clearer comparison. Table 2 shows the results of *AutoAugment alone* (and apparently, there is a benefit of combining AutoAugment with AdvBN), but what one really needs to know is the performance of *AdvBN alone*.
- Comparison to Lp PGD training is incomplete. First of all, it’s not specified which model was used (L2- or Linf-trained and under which epsilon). Second, one should always do a grid search over the Lp-epsilon similarly as you did for the proposed AdvBN method in Table 2, and to report the best model. Otherwise it’s not even clear whether the proposed AdvBN method is better than standard Lp PGD training. Any Lp-robust models from Engstrom et al. (2019) is clearly suboptimal for the tasks considered in this paper since these models have much lower clean accuracy. 
- I couldn’t find a discussion on this, so I assume you used AutoAugment with **all** its data augmentations including those that are present in ImageNet-C. If it’s true, then the comparison to AugMix is unfair as in their method they have removed all overlapping corruptions.
- This is a very important detail that should’ve been clearly discussed in the main part and not just in the appendix: *“The results we report in previous sections with regard to ImageNet, ImageNet-C and ImageNet-Instagram are obtained by using BN statistics corresponding to original features. We only use auxiliary BNs, which keep the batch statistics of adversarial features, to test performance on Stylized-ImageNet in Table 1.”*
And then I’m not sure what the results in Table 1 for AdvBN+AutoAugment tell us: that there exist 2 models obtained via AdvBN, and one of them is good on one domain shift, and another is good on another one? But how do you know at test time which of the 2 models to apply? 
- The paper has multiple mistakes in the presentation of the proposed method: 
    - Equation (4): maximization over the BN parameters is missing. It’s written that: *“This optimization problem contains a maximization problem inside the BNadv layer.”* But I don’t see how it can be true since the maximization should be done in front of the loss. Moreover, the expectation in Eq. (4) should be taken not with respect to pairs $(x, y) \sim D$, but rather with respect to batches $(x_i, y_i)_{i=1}^B$ to reflect the fact that adversarial BN introduces the dependency of the perturbation set on the sampled batch of points.
    - Algorithm 1 has multiple mistakes: (1) an additional loop over batches is missing, (2) not clear how $\delta_\mu$ and $\delta_\sigma$ are initialized, (3) *“Minimize the total loss w.r.t. network parameter”* -- argmin there seems to be inappropriate, I think what was rather meant is doing *one* step of gradient descent wrt $\theta$, (4) in the same place: there should be a clear distinction regarding when the loss is taken wrt a single data point, and when wrt a batch of points (this is particularly important since AdvBN introduces the dependency of the perturbation set on the batch).

**Suggestions:**
- First paragraph of Intro: what you refer to as “adversarial training” would be better to call specifically “Lp adversarial training”: *“While adversarial training makes networks robust to adversarial perturbations, it does not address other forms of brittleness that plague vision systems.”* 
Because what you propose is also adversarial training but just with respect to a different perturbation set, and I assume you suggest that it does “address some other forms of brittleness”.
- *“Additionally, note that this module acts on a per-batch basis so that features corresponding to an individual image may be perturbed differently depending on the batch the image is in.”*
For me it sounds a bit strange that the perturbation set that you aim to be robust against depends on the current batch of images. I wonder if some batch-independent normalization schemes can be applied here with equal success?
- Equation (4): equal weights for both terms may be suboptimal. Thus, it would be good to include the weighting coefficient between the two terms of the objective in the ablation study.
- Table 2: the ablation regarding where to put the AdvBN layer is inconclusive since it had to be done with respect to different epsilons. It seems that the selected epsilon was just too high for conv3_4 and conv4_6 since the clean accuracy becomes worse than that of the standard model. The same also applies to “additive $\delta$”, it’s not clear what a single number tells us, there should be a grid search over the epsilon.

**Score:**
5/10. The paper proposes an interesting approach that can help to improve robustness towards domain shifts without requiring any extra data. I would be willing to increase the score if the paper improves its experimental part, in particular by properly reporting the results of AdvBN (see **Cons**) and its baselines.
review_title: Interesting idea of using BN for robust optimization, but the experimental part has many flaws

final_score: rating: 3: Clear rejection
review_content: This paper introduces a method for improving robustness of neural networks to domain shifts by adversarially perturbing the feature statistics. This is a very interesting idea, by playing a middle ground between the worst case of PGD and not doing anything. My main problem about the paper is the evaluation and particularly the lack of evaluation of certain models and certain datasets.  
Lets talk models first. It is unclear to me why the quite related AdvProp model is not evaluated here. Even if they are difficult to train the pre-trained models are available here: https://github.com/rwightman/pytorch-image-models. Same with the Noisy Student L2 model which doesn't have any sort of adversarially perturbation and performs much better on ImageNet-C than the best number reported here. For reference pretrained weights for both model types are available in the above link. With the availability of pretrained models it seems inexcusable to only have 5 arbitrary comparison points, especially when there are models with significantly better accuracy.  

Furthermore, for stylized ImageNet and Instagram I would like to see what a resnet50 simply fine-tuned on those distributions look like. 

Next on the distribution shift side, I'd also like to see more than just 3 distribution shifts. There have been two recent papers that do a metastudy of many distribution shifts: https://arxiv.org/abs/2007.08558 and https://arxiv.org/abs/2007.00644. A thorough evaluation on other distribution shifts can give a more complete picture of the advantage of the proposed approach to distribution shift rather than just 3 numbers out of context.

For these reasons I recommend rejection.


review_title: Choice of distribution shifts seems odd and sparse and performance improvements seem relatively small.

final_score: rating: 6: Marginally above acceptance threshold
review_content: The authors present an approach for tackling the generalization problem in neural network classifiers based on a new method of batch normalization.  The authors go on to apply this normalization in an autoencoder arrangement in order to show the relationship between the effect of the normalizer on the features and the image that they represent.  Finally, the method is evaluated by pre-training on imagenet, finetuning with the proposed batch normalization, and testing on three versions of imagenet with global transformations applied.  

Pros: 
Novel application of normalization idea
Clear presentation 
Useful and relevant to the conference
Very good quantity and relevance of experimentation 

Cons: 
Would like to see more introspection on the results 

All in all, I think this is a strong paper with only minor issues and would be a great addition to ICLR.  The idea presented is simple but also seemingly very strong in principle and I appreciate that it does not require much in the way of algorithmically complex calculations.  I am most happy about the presented level of experimentation which the authors have done a good job of a) contrasting to the state of the art, b) exploring their own model, and c) exploring other applications.  On that note, however, to explain more the “con” which I have listed, the main contribution here being the experimentation which proves the authors’ idea it would be very nice to have a discussion about what the results mean deeper than answering, “Does this prove the method?” either in the main paper or an appendix.  I have some examples listed below.  That to me would be something that could elevate the paper to the top 50% or more of papers.

Questions for the authors: 
Why is AdvBN not improving on AugMix for imagenet-c but does for the other datasets does this indicate some drawbacks for the method?  
Why does performance appear to get better in the ablation study on $\epsilon$ but then get worse after a certain threshold? 

Post-rebuttal updates:
I thank the Authors for their response. After reading all the reviews and comments I feel that there are aspects of the proposed approach that are not fully understood, despite the improvements. For example, those related to AugMix, and providing fully symmetric comparisons between Cityscapes and GTA5, as several reviewers have pointed out. For these reasons, I have decided to revise my ratings as I also recognize the importance of these observations. 
review_title: A good new approach to generalization through normalization

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper proposes adversarial batch normalization (ABN) to perturb feature statistics. It is to makes CNNs more robust to image style or appearance changes. An ABN layer can plug into the middle of a CNN to finetune a pre-trained model. The CNN layers after the ABN layer can learn more robust representations from the perturbed features. It uses two groups of batch normalizations in the later layers: one for the adversarial features and the other for clean features. Experiments show it can improve robustness on image classification and segmentation.

Pros
1. Applying adversarial training to batch normalization statistics is well-motivated for image style robustness.
2. The method looks simple to implement.
3. Experiments show its effectiveness on two tasks: classification and segmentation.

Cons
1. Some typos exist in the paper, e.g., "additional compute" and "training times" in the last paragraph of Section 4.
2. The meaning of the last line in Table 2 is not clear. I have read the paragraph describing this ablation study (AutoAugment*) but still do not understand it. Does it mean ABN in Table 1 is with AutoAugment during the finetuning?
3. It is not clear whether ABN applies in conjunction with AugMix to further lower the corruption error. The current corruption error is close to AugMix.
4. Experiments only use one model, ResNet-50, which is insufficient. The layer ablation study does not explore the first network block and input. It is not clear whether the optimal layer changes if the network architecture changes.
5. The domain generalization setting from Cityscapes to GTA5 is unconvincing because Cityscapes are realistic data, while GTA5 consists of synthetic data. The opposite generalization makes more sense in practice.
6. The paper emphasizes the finetuning efficiency when compared with other methods trained from scratch. I think the pre-trained time also needs to be considered. For a new task, there is usually no well-known pre-trained models. This raises another question: how does the method perform to train a model from scratch?

In summary, the proposed ABN is simple and effective in improving model robustness to style changes. My main concern is that the experiments are insufficient and have some space for improvements. See points 2-6 in the above for details. Thus, I tend to rate it below the acceptance threshold.

Post-rebuttal updates

Thank the authors for the great efforts in addressing the concerns. The new experiments on two new backbones DenseNet-121 and EfficientNet-B0 show the method can work well with multiple backbones, which is good. However, my other concerns remain unsolved. 

1. Combination with AugMix seems necessary to demonstrate state-of-the-art performance and its orthogonality. 

2. I still think the generalization from GTA5 -> CityScape should be listed together with CityScape -> GTA5. 

3. The running time comparison should take the model's pre-trained time into account in Table 8.

4. Regarding the blocks in the ablation study, I remember a ResNet50 for ImageNet has 4 blocks. Table 3 only lists 3 blocks (2,3,4). So the first block is not the first convolution layer. 

Therefore, I still keep my original rating.
review_title: Official Blind Review #3

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper proposes an algorithm for generalization to unseen domains. The algorithm performs adversarial training on the batch normalization coefficients. The authors provides experimental results showing the benefits of the proposed algorithm and also provides ablation study.

Strength:
I think the algorithm in this paper is simple and straightforward and the paper is easy to follow. The authors provided experiments on large scale dataset, some ImageNet-based datasets.

Weakness:
My major concern is that the experimental results does not fully validate the effectiveness of the proposed algorithm. For example, in Table 1, the results are very close to Augmix on Imagenet-C and Imagenet-Instagram. Only on Stylized-Imagenet, the proposed method shows benefits.
I have a hypothesis that the proposed AdvBN method may bias the model to be more robust to image style change (the images in Figure 2 and 3 kind of show this), but may not improve the robustness to other types of corruptions. Overall, it is not convincing that the proposed method can provide universal robustness gain to all kinds of corruption/domain changes.

Recommendations:
I would like to see more discussion on how the proposed algorithm affects different types of corruptions.  For example, there are 15 different types of image corruptions in Imagenet-C, and I suggest the authors to provide the test results on each type of corruption, so that the readers can better understand what types of corruption this method is more effective on.
If the authors cannot show that AdvBN provides universal robustness, I would like to suggest that the authors change the claims in the paper that the AdvBN improves the robustness to all the corruptions (or preparing for the worst), to a more gentle claim that the method is effective for some particular types of corruptions.
If possible, I would also like to see some experimental comparison between this method and distributional robust optimization, which I think is a more principled approach to getting general robustness. For example, can the authors compare with:
Volpi, et al, Generalizing to Unseen Domains via Adversarial Data Augmentation?


=======

After author response: I would like to thank the authors for providing the details of each corruption in ImageNet-C dataset. I understand that it might be hard to compare with Volpi et al due to lack of implementation details. However, I still feel that this submission is a bit lack of depth and thus it may not be a good contribution to the ICLR community. I would like to see more theoretical or experimental evidence that can help us get a deeper understanding of this approach. Overall I decided to keep my score.

review_title: A straightforward approach

Meta-review: This work proposes a novel, interesting and simple technique to improve the model robustness to distribution shift. The proposed method is called Adversarial Batch Normalization (AdvBN) which is based on adversarial perturbation of BN statistics. Authors provide extensive experiments to show the effectiveness of AdvBN. All reviewers agree that the proposed method is interesting and novel. The main concern of reviewers is about the some of the details of the empirical evaluation of the proposed methods which makes its effectiveness less clear. In particular, the following concerns are shared among the reviewers:

1- Authors give different treatments to Stylized-ImageNet compare to other tasks by using auxiliary BN at inference time instead of standard BN and further results provided by authors show that the improvement over previous methods disappear if they use standard BN for inference on Stylized-ImageNet. I think authors could mitigate this issue by further investigation or providing a better explanation on why they have a different treatment for Stylized-ImageNet (other than the fact that auxiliary BN has a better performance on that task). The other potential remedy is to come up with an automatic way to decide which one to use at the inference time using a batch of "unlabeled" validation data.

2- The improvement of AdvBN over AugMix and AdvProp (which was added during the rebuttal) is not clear. In particular, both methods improve over AdvBN on ImageNet-C. If standard BN is used for AdvBN on Stylized-ImageNet, then both AugMix and AdvProp improve over AdvBN. That only leaves ImageNet-Instagram as an ImageNet variant where AdvBN shows a clear improvement over AdvBN and AugMix. A potential solution is to try combining AugMix and AdvBN (not sure if AdvProp could be combined effectively) to see if there is a way to get maximum benefit out of these methods.

3- The empirical section could be improved by doing experiments in a systematic way. That is for any choices made in the experiment design, there should be a reason that is explained clearly. For example: 1) applying the same type of data-augmentation on all methods (or reporting all methods with and without data-augmentation). 2) compare to all baselines on ResNet-50 and then pick the top 2 baselines (say AugMix and AdvProp) and then compare them on DenseNet and EfficientNet. 3) comparing with the same baselines as (2) on the segmentation task.

Finally, I want to thank authors for engaging with reviewers, running many experiments during the rebuttal period and updating the paper accordingly. I also want to reassure authors that my final evaluation of the paper is based on: 1) reading all reviews and responses 2) weighing the reviews based on their substance, quality and engagement of reviewers 3) looking at the initial and final revision of the paper. In particular, even though the average score of this paper is low, in my opinion it is a borderline paper. After taking all of the above into account, my decision is to recommend rejection. Even though the proposed method is very interesting, there are three clear valid concerns all of which can be addressed as I suggested above. Without addressing those concerns, the empirical advantage of the proposed method is not demonstrated properly. I think after addressing those concerns this paper will be in a much better shape, more useful for ML community and hence receives the attention it deserves. I sympathize with authors that their efforts during the rebuttal period did not result in improving reviewers' scores but I want to emphasize that I did take all those updates into account when making my recommendation for this paper.

Decision: Reject