Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 8: Accept
review_content: The paper improves adversarial training by introducing two modifications to the loss function: (i) a "boosted" version of the cross-entropy loss that involves a term similar to a large-margin loss, and (ii) weighting the adversarial loss differently depending on how correctly classified an example is. When put together, these modifications achieve state-of-the-art robustness on CIFAR-10, improving over the previously best robust accuracy by about 3.5%. The authors perform multiple ablation studies and demonstrate that their modified loss function also improves when additional unlabeled data is added (again achieving state-of-the-art robustness).

I recommend accepting the paper. The modifications for the loss function are well motivated and improve over the state of the art by a non-trivial amount. Moreover, the authors nicely put their loss function in the context of prior work.

Additional comments:

- In Table 4, are the "best" columns the best checkpoint for the respective column (potentially different checkpoints for different columns) or does "best" refer to a single model (for each row)?

- Is 65.04% (Table 5 b) now the best published robust accuracy on CIFAR-10 (at least to best of the authors' knowledge)? If so, it may be helpful to indicate this to the reader.

- In Figure 2d, it could be insightful to expand the plot further to see the regime where the performance of MART drops substantially.

- In Figure 1, the three plots would be easier to compare if the y-axes were the same.

- From Figure 2, it looks like the gain from the BCE loss is as large as the gain from treating misclassified examples differently. Is this correct?

- I strongly encourage the authors to release their models in a format that is easy for other researchers to use (e.g., PyTorch model checkpoints). This will make it substantially easier for future work to build on the results in this paper.
review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: The paper essentially presented a viewpoint, i.e. misclassified examples may have a significant impact on the final robustness.
The authors conducted a series of qualitative experiments to verify 
1) Misclassified examples have more impact on the final robustness than correctly classified examples.
2) For misclassified examples, different maximization techniques may have a negligible influence, but minimization techniques play a critical role on the final robustness.
3) The authors proposed a new defense algorithm which focus on generating adversarial examples from misclassified examples during the training. The algorithm was shown to improve the final robustness by revisiting these adversarial misclassified examples.

Generally speaking, the idea, though somewhat straightforward and less elegant, is reasonably presented and also well-motivated. Empirical validations seemed to support the idea and indicated that the proposed approach could improve the adversarial robustness.


There are several major concerns with the paper as follows:

1.	It is good and reasonable to put more emphasis on the misclassification examples, since it is likely that the region of the “perturbation” largely overlaps with the region of the misclassified examples.

2.	However, this may be dealt with in a more elegant or systematic way. In the viewpoint of the reviewer, actually a different emphasis can be imposed on each different data point including both the correctly-classified and mis-classified samples. In another word, a more systematical extension or a metric may actually be developed emphasizing more on mis-classified samples. It is suspected that different samples within the set of mis-classified samples (or even in the set correctly-classified samples) could also have a different influence. It is highly likely that a more elegant and mathematic way can be designed for this purpose. 

3.	Further to point 2, in particular, the regulation w.r.t the correctly classified examples may not be ignored. It is interesting to consider differently the correctly-classified examples due to the trade-off between robustness and standard accuracy. This can also be seen in another submission of ICLR2020 (titled Sensible adversarial learning”) which actually discards the mis-classified samples. I would like to see some additional comments, clarification, or discussions on this point.

4.	I am curious to know if outliers would be over-emphasized by the proposed idea. Some discussion or even some illustrations on a synthetic case would be interesting. Will the existence of outliers affect the robustness?

5.	In Table 2, the best and the last results on FGSM are totally identically, I wonder if this is a wrong copy, which should be further clarified and discussed.

6.	 In the Unlabeled Data experiment part, it is better to compare the results with both UAT++ and RST at the same time rather than separately.

7.	Equation (4) shows that the two parts on the right side are added together, is that right? This is inconsistent with Equation (7) and the following description.

8.	In 3.2, the first paragraph, “max-margin adversarial training (MMA) (Ding et al., 2019)” appears to be wrong. The correct reference is “GavinWeiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Max-margin adversarial (mma) training: Direct input space margin maximization through adversarial training. arXiv preprint arXiv:1812.02637, 2018.”.


==================
I have read carefully the response from the authors. The newly added results appear satisfactory to me and I  am generally happy with the clarifications. I have then  adjusted my rating accordingly.
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: Summary:
=======
Neural Networks (NN) have been shown to be susceptible to various adversarial attacks i.e. if we perturb the "x" just a little, the output prediction changes. So, there has been much research devoted to how we can make NNs robust to such attacks. Typically, the adversarial examples that are used to train adversarially robust methods are generated from the correctly classified examples. 

This paper first shows empirically that the adversarial examples generated from misclassified examples by the model h_{\theta} are as important as the ones generated from correctly classified examples on the CIFAR dataset. The authors then propose a novel objective for the adversarial risk that incorporates the misclassified examples as a regularizer. Next, a surrogate convex objective is derived which is optimized to come up with a new kind of adversarial training called misclassification aware adversarial training (MART). 


Originality:
==========
The proposed objective seems novel to me compared to the existing methods, perhaps less so to someone who is an expert in adversarial methods. That said, I definitely found the addition of a misclassification-based regularization term as intriguing. 

However, I was wondering that maybe the previous approaches did not distinguish between correctly vs incorrectly classified examples while generating adversarial examples was because that is a more general setting. This is so because the idea of classification is tied to a certain model h_{\theta} and hence is not model-agnostic by definition. Perhaps the strength of the approach by Madry et. al. 18, which is the closest work to this paper, is in being model-agnostic. I hope I am not missing something!  


Quality:
=======
The paper is technically sound and is a solid contribution to the literature on adversarial robustness. The motivation,  experimental results, and ablation studies are all very well executed. The results are shown on MNIST and CIFAR-10 image datasets and it outperforms a host of competitive baseline algorithms.


Clarity:
=======
The paper is well organized and is very well written. The experimental results are very thorough and well explained.


Significance:
============
The paper solves an important problem of dealing with adversarial attacks on deep neural networks. Further, the solution they propose is novel and a seems like a significant improvement over the extend state-of-the-art.

review_title: Official Blind Review #1

Meta-review: This paper presents modifications to the adversarial training loss that yield improvements in adversarial robustness.  While some reviewers were concerned by the lack of mathematical elegance in the proposed method, there is consensus that the proposed method clears a tough bar by increasing SOTA robustness on CIFAR-10. 
Decision: Accept (Poster)