Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: The paper analyzes the property of local and global data manifold for adversarial training. In particular, they used a discriminator-classifier model, where the discriminator tries to differentiate between the natural and adversarial space, and the classifier aims to classify between them while maintaining the constraints between local and global distributions. The authors implemented the proposed method on several datasets and achieved good performance. They also compared with several whitebox and blackbox methods and proved superiority. 

This paper was, in general, well written. The authors provided a good visualization of their analysis. Using local and global information for adversarial training is intuitive. The authors provided a good theoretical background to establish their method. The empirical evaluations show promising results. 

Some major concerns are listed as follows:
1. It is not clear how equations 4 and 5 are realized using discriminator and classifier. 
2. What kind of perturbations are chosen? It looks like all the experiments are with L-infinity. Does this observation hold for other ones?
3.  If the attackers leverage the global and local data manifold, can they bypass this attack? 
review_title: The paper analyzes the property of local and global data manifold for adversarial training. 

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary: This paper considers the local and global information in adversarial attacks for adversarial training, where the authors design an adversarial framework containing a discriminator and a classifier. The idea is interesting and the paper is easy to follow. 

However, I have still some concerns below: 
- The novelty of this work combines the idea of PGD (local information) and Feature-Scatter (global information) .
- More importantly, the evaluation is no enough, even though Feature-Scatter considers the global information, but many attack methods have shown the robustness of Feature-Scatter was overestimated, such as [1][2][3] and so on. So I think evaluating on PGD and CW  is not enough.
- There are few analysis experiments for the proposed method, more analysis experiments are needed besides the comparision.

[1] Feature Attack: https://openreview.net/forum?id=Syejj0NYvr&noteId=rkeBhuBMjS

[2] RayS: A Ray Searching Method for Hard-label Adversarial Attack. KDD 2020.

[3] Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML 2020.
review_title: Official Blind Review # 4

final_score: rating: 7: Good paper, accept
review_content: The paper proposes a new method of improving model robustness by generating adversarial samples that are regularized by their latent distribution through f-divergence, whereas existing literature only uses local manifold property such as smoothness. 

The method is well-motivated and the clarity of the paper is good. The experimental results are compared with several competitive baselines and the improvement looks significant (Although I am not familiar with the state-of-the-art experimental results). 

Proofread is needed for the sentence "The adversarial examples are crafted by ... " on page 2 and several other small typos. 
review_title: Use global latent distribution to improve model robustness

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper presents a framework for adversarial robustness via incorporating local and global structure of the data manifold. Specifically, the key motivation is that standard adversarial methods typically use only sample specific perturbations for generating the adversarial examples, and thus using them for robustness of the learning model is limited. Instead the paper proposes to capture the global data manifold as well in the robustifying framework. To this end, an objective is presented (4,5) that uses latent data distributions, with the goal that the adversarial perturbations should maximize the f-divergence against the latent distribution of the clean samples. Experiments are provided on several datasets and demonstrate significant performance improvements.

Pros:
1. The key idea of using the global data manifold into the robustifying framework is quite interesting.
2. Experiments demonstrate good empirical benefits of the approach.

Cons: 
1. While, the paper seemed well organized in the beginning, I got totally lost with Eq. (4-5). As I see, this objective is inaccurate and needs significant refinement. Specifically, it is unclear how is x^{adv} is related to x, and how is x^{adv} related to P*_theta? The paper tries to explain this objective in the paragraph below, but the explanation is very confusing as well.  A few other things that could help here:
a) It is said that "Q_theta and P_\theta* are the latent distributions induced by the natural example x". How can a single data point induce a distribution? Do you assume the feature map from a hidden layer of a network represents a distribution? If so, in what sense? 
b) "The adversarial example is crafted to induce the worst case distribution P*". How is it crafted and what is the relation between P* and x? This is the key connection that is missing from (4-5).

2. Moving along, Section 4.1 is organized very poorly as well. I believe too many concepts are tied together into one formulation in (6), making it hard to decipher. For example, why to include the classifier D^{1:C} within this formulation? Why not talk about it elsewhere and focus on the meat of the objective, systematically? 

3. Further, as I understand, x^{adv} is the first step that happens in (6), however, there is no "adversary" in this case, instead is finding a perturbed sample x' that maximizes the f-divergence. In what sense is x^{adv} then an adversarial sample? Perhaps the paper should re-define what is the definition of an adversarial example that it is using, to clearly state what the idea is. Technically, there is no requirement that the point x^{adv} found by this step will promote any data misclassification; however can be any point that is within a B(x,\eps) ball from x, and that happens to maximize this divergence loss. Note that none of the other components D_W, f_theta, etc. are well trained in doing this optimization. So they could also be sub-optimal (in the sense of what the paper argues in the beginning of Page 4).

4. Why is the middle formula in (6) minimizing over W to have both x and x^adv matched with the same label? Again, where is the adversary here? Or for that matter, how will the proposed approach achieve adversarial robustness ? 

Minor comments:
a. What is \tau and T in (3)? 
b. How is f_\theta defined in (6)? 
c. The paper writes that back and forth that there is no use of label information in the setup, however has labels used in discriminator in (6). This is very confusing. 
d. There is also reference to data manifold and manifold label in Figure 2, but these are not clearly explained. What precisely is the data manifold? Is it the latent distribution for a specific label? 
e. Page 4, top para: "without considering the inter-relationship between data samples". Won't this relation be captured implicitly through the neural network parameters theta when perturbations on all the samples are used in the training process?

Overall, I think this paper needs a thorough revision to explain well its technical contributions. 

review_title: Needs better technical exposition

Meta-review: This paper presents a framework for adversarial robustness by incorporating local and global structures of the data manifold. In particular, the authors use a discriminator-classifier model, where the discriminator tries to differentiate between the original and adversarial spaces and the classifier aims to classify between them. The authors implement the proposed approach on several datasets and the experimental results demonstrate performance improvements. The idea of using the global data manifold into addressing robustness of the learning model is interesting. However, the technical contribution and novelty have not been explained very well.
Decision: Reject