Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This work proposes training robust models without explicitly training on adversarial examples and by "smoothing" the labels in an adversarial fashion and by using Dirichlet label smoothing. Training robust models without adversarial training is indeed an important problem as mentioned by the authors since it can potentially (as the authors demonstrate) result in faster model training and less drop in clean accuracy. Overall the idea is interesting but I have some concerns mainly about evaluations and baselines which I am including below. If the authors can address my concerns, I am willing to increase my score:

1. Based on equations (9) and (10), if we set \alpha to be large, then the network is not trainable (since the worst-case adversary will increase the loss on the image by flipping the label during training). As a consequence, we can see that the value of hyper-parameters that the authors use is indeed very small (0.01 and 0.1). Even between these small values, the smaller value results in a better model. In the extreme case, where \alpha is zero there is no regularization and \beta becomes irrelevant. This illustrates that the performance of the model is very sensitive to \alpha. On the other hand, we can prevent the model from not learning anything by constraining \beta in equation (10) — similar to adversarial training where we constrain \delta. It seems that without constraining \beta, if the step-size for \beta is large, \beta can grow and completely mess up the labels even when \alpha is tiny. If we constrain \beta on the other hand, we can make sure that in no case, the top label for any augmented image is an incorrect label. Can the authors elaborate on why they did not set any limit on the value of \beta?
2. What is the batch-size used for ImageNet? The reason that I am asking is that you compute the gradient of \beta for the previous mini-batch but use it for the next mini-batch. Is it possible that the previous mini-batch's \beta is not accurate for the current mini-batch? For CIFAR, since the number of classes is 10, I would assume that you can update the statistics for the class (\betas) using the previous mini-batch since you always see examples from all the classes using any reasonable batch-size. What happens if you do the same but for a dataset with more classes but have the mini-batch be smaller than the number of classes. In this case, your \beta is getting updated only using information from a few classes and not all classes at once. In that case, what happens if you just use a random \beta every step? 
3. For the white-box attacks, I also have a few questions. Do you use multiple random restarts? It is known that random restarts can be more effective than increasing the number of PGD attacks. See for example the leaderboards for MNIST and CIFAR-10 challenges by Madry. I would like to see a table where you plot how the accuracy changes by doing 100 step PGD attacks and by increasing the number of random restarts from 1 to 10 for example.
4. Do you do L-infinity CW attacks? I see that you have done L-2 CW attacks but I can't find any L-infinity CW attacks. It would be great to show numbers for that and also compare it with TRADES and PGD adversarial training. In previous smoothing methods, the L-infinity CW attack seems to be a stronger attack compared to PGD.
5. For the ImageNet task, the authors state that the evaluation of non-targeted attacks can result in label leaking. Label-leaking happens when one trains on adversarial examples built using a single-step attack and it means that the accuracy of adversarial examples is higher than natural examples at test-time. For this, I do not understand why the authors mention that they only evaluate targeted attacks while they are not doing any adversarial training.
6. Also, for ImageNet, there are recent methods such as Adversarial training for Free! where the authors do adversarial training on ImageNet with no overhead cost compared to natural training. Maybe this could be added as a better base-line than a naturally trained model.
7. In Figure 4. (a), why is the loss for the validation image illustrated so high? What image is this from the validation set?
8. In terms of Scalability, its good to mention new scalable methods such as YOPO and Adversarial Training for Free.
9. In the ablation study, including Dirichlet Smoothing indeed results in a huge boost compared to having no smoothing. However, it would be better to show that Dirichlet smoothing is indeed better than label-smoothing or adversarial smoothing by including results for other smoothing methods in Fig. 5.
review_title: Official Blind Review #5

final_score: rating: 6: Weak Accept
review_content: This paper proposes a novel training method to build robust models. A new framework SPROUT is introduced to adjust label distribution during training. It also integrates mixup and Gaussian augmentation to further improve the robustness. The proposed method is built upon the Vicinity Risk Minimization (VRM) framework. Experiments show that the proposed method significantly outperforms the existing best methods in terms of robustness against attacks.

Overall, this paper proposes a novel method with good robustness performance. The proposed approach is built upon the VRM framework, and summarizes a lot of existing methods under this framework (Table 1). Experimental results are also very strong to prove the effectiveness of the proposed method. 

On the other hand, I have some concerns about this paper. Since the performance improvement is significantly large over the current best methods, I need to see those concerns addressed to give a final rating.

1. How do you perform inference given testing data? Do you use Gaussian augmentation or mixup during inference?

2. Do you check that whether the robustness comes from obfuscated gradients? It's very important to examine the true robustness of the propose method.

3. What's the final distribution of \beta? Does it have a semantic meaning?
review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: The authors proposed a hybrid method for defending against adversarial attacks called SPROUT. The proposed defense method consists of three main ingredients:

1. label smoothing with a learnable Dirichlet distribution
2. adding Gaussian noise to input examples
3. mixup: augment training examples with their linear combinations 

The authors' main argument for their method is the speed over adversarial training and its effectiveness. 

Individually, none of these ingredients are known to be strong defense against adversarial examples in the literature. Indeed this is corroborated by Figure 5, when the individual defenses do not have more than 10% accuracy under PGD100 attacks for epsilon=0.4. However, when all three are used together the accuracy jumps to close to 60%. This is very surprising. Another surprising fact is that in Figure 2, the method beats the benchmark adversarial PGD by more than 20% on white-box attacks, given the difficulty of beating adversarial PGD.  

Given the surprise in these experimental results, I believe the authors should perform a more detailed analysis on how these ingredients for their SPROUT defense interact to produce such a strong predictor, in addition to doing ablation studies. An attempt should be made to explain why they work so well together when they are quite weak individually as defenses. It is difficult for me to recommend acceptance of this paper without an attempt to explain why it works. 



review_title: Official Blind Review #1

Meta-review: This paper proposes a new training technique to produce a learned model robust against adversarial attacks -- without explicitly training on example attacked images. The core idea being that such a training scheme has the potential to reduce the cost in terms of training time for obtaining robustness, while also potentially increasing the clean performance. The method does so by proposing a version of label smoothing and doing two forms of data augmentations (gaussian noise and mixup). 

The reviewers were mixed on this work. Two recommended weak reject while one recommended weak accept. All agreed that this work addressed an important problem and that the proposed solution was interesting. The authors and reviewers actively engaged in a discussion, in some cases with multiple back and forths. The main concern of the reviewers is the inconclusive experimental evidence. Though the authors did demonstrate strong performance on PGD attacks, the reviewers had concerns about some attack settings like epsilon and how that may unfairly disadvantage the baselines. In addition, the results on CW presented a different story than the results with PGD. 

Therefore, we do not recommend this work for acceptance in its current form. The work offers strong preliminary evidence of a potential solution to provide robustness without direct adversarial training, but more analysis and explanation of when each component of their proposed solution should increase robustness is needed. 

Decision: Reject