Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper aims to improve the robustness of adversarial self-supervised learning (SSL) by leveraging the proposed targeted adversarial data for adversarial SSL. The targeted adversarial data is generated by updating the natural data towards a targeted sample selected by K-mean or similarity. The paper empirically validates that target attacks can improve the adversarial robustness of several previous adversarial SSL methods including BYORL and SimSiam. 
strength_and_weaknesses: Strength:
[Motivation for target attacks is clear.] Figure 1 clearly illustrates that targeted adversarial data can help find effective adversarial data in the setting of adversarial SSL with only positive pairs.

Weakness:
[Writing is poor.]
The definitions of some terms in the abstract and introduction like “positive-only adversarial SSL” are unclear to readers. In addition, Authors cannot assume the reader fully read “BYORL”. The paper does not introduce BYROL in detail. The paper should be self-contained. Besides, please write a full name before using the abbreviations. 

[Motivation is unclear.]
This paper tries to propose a method to improve adversarial self-supervised learning. There already exists effective adversarial contrastive learning based on SimCLR. However, this paper tries to improve a suboptimal method BYORL. 

[Effectiveness of the proposed method is not well validated.]
-In the introduction, it seems that Authors tried to improve non-contrastive methods since non-contrastive methods are more efficient. However, Authors do not show the efficiency of the proposed targeted SSL compared to BYORL. Observed that TAROSS spends almost twice of the training time of ACL from the results in Author’s response (https://openreview.net/forum?id=wwRjJScpsOO&noteId=BU4byVrzGsk), it seems that the proposed targeted SSL is more inefficiency.
-The scalability and efficiency of the targeted SSL on the large-scale datasets (e.g., ImageNet) are unknown. It would be more difficult to select an appropriate target sample in a large-scale dataset, which could degrade the efficiency and scalability of the proposed method.
-The clean accuracy of the proposed targeted SSL is significantly degraded on some datasets (such as STL10 and CIFAR100 in Table 4). The degradation of clean accuracy is even higher than the improvement in robust accuracy. Therefore, targeted SSL could be problematic.

clarity,_quality,_novelty_and_reproducibility: [Clarity is poor] As stated in Weakness, Authors do not provide the definitions of some terms and some important preliminaries.

[Quality is poor] As stated in Weakness, the effectiveness of the proposed method is not well validated. In addition, the target selection method is a bit tricky and lacks theoretical justification, which makes its quality further degrade.

[Novelty is marginal]: The paper replaces the label with a carefully-selected target data for generating targeted adversarial data in the setting of adversarial SSL, which is a marginal improvement in novelty.  

[Reproducibility seems to be good.] The paper provides experimental details in the section of Reproducibility Statement.

summary_of_the_review: This paper proposes a target attack for improving the robustness of adversarial SSL. However, the paper’s weighting is poor, its motivation is unclear, and it lacks theoretical justification and enough empirical results to validate its effectiveness.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper discusses the problem of adversarial training for non-contrastive self-supervised learning (NC-SSL) approaches like BYOL.
They propose a modification of the loss function that involves an adversarial attack for a pair of objects that, with high probability, lie in different classes.
Such a method allows to beat straightforward adversarial training for NC-SSL, but is not Pareto-optimal given a clean and robust accuracy compared to C-SSL methods like SimCLR.
strength_and_weaknesses: Strengths:
- The problem the authors propose is interesting and lacks a straightforward solution
- The authors propose an interesting idea on how to incorporate probably-negative objects in the framework

Weaknesses:
- The authors only partially solve the adversarial training for NC-CCL. C-SSL methods work better according to my interpretation of the presented results
- There is no principal explanation of the usage of the approach at hand. There is some experimental analysis, but, e.g. it is missing if we can achieve similar results with different types of losses inspired by similar ideas.

Additional comments: 
The idea of selecting a far-away image as a starting point resemble many black-box adversarial attacks.
clarity,_quality,_novelty_and_reproducibility: Writing and clarity are not the strong points of the paper. The notation is confusing and often wrong. The text misses many important details that hinder the main authors' findings. 

Technical comments:
- to obtain significantly high robustness -> to obtain significantly *higher* robustness
- "SimSiam detaches the gradient on the z" - it is better to say that it stops gradients for z-part
- p_2 and z_1 are not defined
- in formula (6) indexes should be inside the brackets $x)_i$ -> $x_i)$
- I also suppose that indexes for T_i are not correct in the same formula and around it
- Table 3 - what is the used metric?
- I think it is unacceptable to use bold font in Table to articulate the results of your approach, as the bold font is often used to show the best results, which is not the case in most experiments
- Visualization of embeddings space: I suppose that the authors use tSNE but never mention it
summary_of_the_review: The idea is good. The method is not good enough from theoretical and practical points of view, with little novelty in the current approach. 
I also note that may be other approaches applied to robustness improvement can work in this case, like SAM or Differential Privacy algorithms with a proper algorithm.
I suggest authors provide a deeper analysis of why they obtained these results and why NC-SSL fails to provide robust solutions.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors proposed a new unsupervised adversarial training method. Unlike previous work, this method leveraged label information and thus be categorized as the targeted attack. The core idea is the target selection algorithm, which is a combination of similarity and entropy. By running adversarial training on such perturbations, the authors show that this method enhances robustness of models trained with semi-supervised learning.
strength_and_weaknesses: Overall the idea has decent novelty and the overall idea of this paper is easy to grasp. What I like about this paper are:
1. The motivation is clearly stated: the untargeted attack fails to generate useful adversarial training data for improving robustness.
2. The experimental results are clearly in line of the arguments.

The limitations are also quite clear though, including:
1. The design of the score function (combing similarity and cross entropy) lacks justification. Although authors mentioned that we want to maximize the similarity but still unnatural to me why.
2. Some details are lacking. For instance the authors mentioned K-means multiple times, but based on what distance metric? How does this affect the training efficiency?
3. The title seems too broad - this paper concerns about SSL using positive pairs (specifically BYOL and Simsiam), but SSL itself is a very broad term containing many other methodologies as well. So the title might confuse others.
4. The comparison in the experiments are also concerning: the baseline is based on SimCLR (Jiang, Kim) but this paper is based on BYOL and Simsiam. Could this be the reason causing the performance improve? Authors might want to find more support.
5. The datasets are a bit small and limited, authors might want to find more realistic datasets to verify.

clarity,_quality,_novelty_and_reproducibility: Overall the clarity is good and the quality is fair. The idea of the paper is easy to follow, the quality is affected by the factors I mentioned above.

summary_of_the_review: Please address some of my points above.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, the problem of adversarial self-supervised learning is studied, where the goal is to improve the robustness of the self-supervised model. While adversarial example can be created under the supervised scenario, creating adversarial example is not trivial for self-supervised training because no label is available. This paper addresses this problem by proposing a score function that measure the similarities between unlabeled samples. Given an unlabeled sample, the negative sample can then be selected and then used to guide the direction of the adversarial perturbation. Experiment demonstrates the effectiveness of the proposed method.
strength_and_weaknesses: Strength
(1).	 The motivation of this work is strong.
(2).	 Figure 1 clearly illustrates the difference between creating adversarial examples under the supervised setting and unsupervised setting. More specifically, the difference between creating adversarial examples in contrastive based self-supervised learning and positive only self-supervised learning is highlighted.
(3).	 The overall paper is clear and simple to follow.


Weaknesses
(1).	While the proposed method is useful under the scenario where only positive data is used for self-supervised learning, it is unclear why it cannot be applied to contrastive based self-supervised learning (e.g. SimCLR). If applicable to contrastive based self-supervised learning, how does the proposed method compared to prior works (e.g. RoCL)?
(2).	The author is suggested to explain why CIFAR5 is used in Table 1, instead of Cifar10. Moreover, how does table 1 in this paper compares to the Table 1 in RoCL? If the author is using Cifar 10, are Table 1 in this work comparable to Table 1 in RoCL?
(3).	Typically, self-supervised learning assumes that the pretraining feature can be applied to various downstream task. However, for the experiment in Figure3, the author assumes that the downstream task is known and use it to ``probe” and select the optimal range of the similarity score. The author is suggested to explain why such operation make sense in general self-supervised learning scenario. Will the selected similarity score range transfer across dataset? How does the similarity score selection affect the final performance?
(4).	It is unclear why the score function looks like Eq 6. Can we use the cosine similarity or the entropy term only? Which term is more important for the training? Any ablation on the weighted version between two terms?
(5).	Table 2 of RoCL also conducts experiment on black box attacks on Cifar10. What is the proposed method on black box attacks?


Typo:
(1).	“becase” : typo near table 2

clarity,_quality,_novelty_and_reproducibility: Clarity: The manuscript is simple to read and follow.
Quality: The paper is interesting with strong motivation. However, some clarification and experiments are needed.
Novelty: The paper is novel from my best understanding.
Reproducibility: The presentation contains many details for reproducing the work.

summary_of_the_review: The author is suggested to address the limitation in the weakness section. It seems that some of the settings in this work are different than the prior works and several ablations are missing. The score might be adjusted if these concerns are not well addressed.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a targeted adversarial training method for non-contrastive self-supervised learning (SSL) to improve the performance. Using the proposed algorithm, non-contrastive SSL gets an improvement in the robustness of the downstream tasks.
strength_and_weaknesses: Strength:

The paper explains the intuition and numerical experiments clearly.

Weakness:

[1] From the intuition, it seems that the idea behind the proposed method is similar to contrastive learning. Both of them consider separate samples of different properties (e.g, class, or similarity). Could the authors provide some more insights on the difference between the proposed algorithm and the idea behind contrastive learning? Is there any interesting novel thoughts in the new method?

[2] Is there any specific reason on why this paper considers improving non-contrastive SSL? The numerical performance of the proposed algorithm does not outperform compared to contrastive learning. In all Table 3, 4, 5, the new method may either have a similar (or slightly worse) performance compared to contrastive based approach, or has a better robustness while sacrificing the clean testing performance (i.e., clean and adversarial trade-off). 

The authors need to provide some explanation why they want to compare the proposed method only with non-contrastive SSL, but nor contrastive-SSL. For example, the authors may want to explain whether there is any concern to utilize contrastive learning. Or is there any particular area of study which cannot use contrastive learning? Or is there any potential advantage of using non-contrastive SSL? Or can the proposed method be applied in contrastive learning?

It is acceptable to not consider non-contrastive SSL for a theory paper. But since this paper aims to propose a new method, it is essential to demonstrate that the proposed method is good enough. There may be some scenarios that non-contrastive SSL is used instead of contrastive SSL, but it is not clarified in this paper. In all the experiments in this paper, it seems that we can always use contrastive SSL and get a better result.

Please also emphasize that the paper works on non-contrastive SSL in the abstract. My first impression was that this paper studies contrastive learning with targeted SSL. It is slightly confusing.

[3] Similarly, the observation in Figure 5 is not apperant.

[4] In the tables, the bold numbers distract readers from catching the groups with the best performance. Please adjust the tables to make them clear.

clarity,_quality,_novelty_and_reproducibility: Clarity: the abstract is confusing. Other parts are clear.

Quality: good.

Novelty: the intuition is interesting.

Reproducibility: the intuition looks reasonable to me. It says " The code will be available in Anonymous" but seems there is no link. The other experiment results from other Github repositories (e.g., RoCL) looks good to me.
summary_of_the_review: The main concern is to provide some illustration on why we want to consider the proposed algorithm. From all the numerical experiments in the current presentation of the paper, it seems that contrastive-SSL is a good method. The authors may consider adapting the proposed method into contrastive learning to further improve the performance, or provide some motivation why we some times can only use non-contrastive learning.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: **Summary**

This paper focuses on adversarial self-supervised learning. The aim is to improve the robustness of the self-supervised model. By proposing a score function that measures the similarities between unlabeled data, the targeted adversarial data can be generated. Experiments demonstrate that targeted attacks can improve the adversarial robustness of several self-supervised learning methods. 

**Strengths**
- The motivation is strong. This paper clearly describes how the untargeted attack fails to generate useful adversarial training data for improving robustness.
- The proposed idea is interesting and can inspire follow-up research. 
- The overall paper is clear. It is easy to follow technical details. 

**Weaknesses**
- The method design lacks sufficient support and justifications, which makes it not very convincing to readers. Besides, the novelty compared with previous work is not well explained. 
- Experimental verifications are insufficient in the present version. The claims of this paper should be further supported on large-scale datasets (e.g., ImageNet). 

This paper achieves mixed recommendations from reviewers. The reviewers who are positive consider that this paper provides an interesting point to the research community. However, after rebuttal, all the reviewers still think this paper (a) lacks enough justifications for method designs, e.g., the selection of score functions; (b) the effectiveness of the proposed method is not well validated. (c) writing should be improved and becomes more logical. Overall, the current paper is not ready for publication. Authors could refer to the reviews and take suggestions to make a stronger submission. We believe the paper would be a strong one after addressing the above concerns.

justification_for_why_not_higher_score: This paper provides some beneficial points to the community, e.g., the interesting problem setting and core idea. However, as mentioned in the mete review, this paper needs careful polishing to make a stronger submission. In the internal discussion, AC and reviewers reached a consensus that the current version of this paper cannot be accepted.
Decision: Reject