Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary: 
In this paper, the authors reformulated the generation of adversarial examples as an MCMC process and present a new adversarial learning method called ATCD, which approaches the equilibrium distribution of adversarial examples with only a few iterations by building from small modifications of the standard Contrastive Divergence. Extensive results with comparisons on various datasets show that ATCD achieves a trade-off between efficiency and accuracy in adversarial training.

Comments:

1 . The proposed algorithm ATCD views the generation of adversarial examples as a sampling procedure. Specifically, it can be seen as performing HMC sampling. Also, it modifies the adversarial example generation objectives using a modified contrastive divergence objective. Compared with free-adversarial-training, which also utilize mini-batch replay and use the last iterate’s result as initialization, the difference only lies in the adversarial example generation objective and the extra noise brought by the HMC sampling procedure. However, it is still not clear to me what actually causes the performance improvement. The different objectives or the sampling noise? I would suggest the authors conduct ablation studies to find out this answer and it would be clearer for the readers to understand the true driving force for the proposed method.

2 . In Eq (13) what is Q0 and Q1? It is better to formally define them. The intuition for this objective is a bit confusing to me. For standard contrastive divergence, it is the same as measuring the difference between the output probability between init point and K-step updated point. Here since the equilibrium distribution is unknown (fixed but unknown right?), how to compute the objective here with rho and lambda parameters? And why using different rho and lambda helps?

3 . Notice that even adversarial training based algorithms could cause obfuscated gradient problem, therefore, it might be a good idea to further evaluate model robustness via totally gradient-free methods, such as hard-label attacks. I would suggest the authors to also evaluate using the following method: 

“RayS: A Ray Searching Method for Hard-label Adversarial Attack” KDD (2020)

In order to make the experimental results more convincing.

4 . There are some other recent adversarial training methods that the authors might want to comment on

"Improving adversarial robustness requires revisiting misclassified examples." ICLR (2019).
"On the Convergence and Robustness of Adversarial Training." ICML (2019).





review_title: Official Blind Review #1

final_score: rating: 6: Marginally above acceptance threshold
review_content: Summary:
This paper proposed a new adversarial attack method by using Markov chain Monte Carlo.  Based on this attack method, a new adversarial learning method called adversarial training by using Contrastive Divergence (ATCD) which approaches equilibrium distribution of adversarial examples with only a few iterations is performed. The experimental results demonstrated the effectiveness of ATCD.

Pros:
1. The method of generating adversarial examples is new and efficient.
2. Experimental results with comparisons on ImageNet, CIFAR and MNIST datasets show that ATCD achieves a good trade-off between efficiency and accuracy in adversarial training.

Cons:
1. There is a notable natural accuracy gap between ATCD and Madry's PGD method and Free-m.
Many papers were aware of overfitting in adversarial training such as 'Overfitting in adversarially robust deep learning'. Nature accuracy and robust accuracy are sometimes conflicted in the latter epochs. It seems like some plots like Figure 3 may answer the question, but Figure 3 only plots the first 40 iterations (I guess it means 'epochs' here), while the total epoch is 105.
So only observe the results of the last epoch may not fair since maybe different methods have different convergence rates.
2. Some hyperparameter settings and sensitive analyses like $\rho$ and $\lambda$ are missing.
3. Although, the experimental results show the efficiency of ATCD, the formal time complexity analysis of ATCD should be performed.

review_title: Interesting topic with weak experimental results

final_score: rating: 5: Marginally below acceptance threshold
review_content: Adversarial examples are time-consuming to generate. In this paper, the adversarial training is reformulated as a combination of stationary distribution exploring, sampling, and training. A Hamiltonian system is proposed to model data samples from their initial states, and is shown as the general form of FGSM. The sample generation method is proposed via contrastive divergence with few training iterations. Experiments have been validated on datasets. 

The formulation of HMC sounds interesting and its relationship towards FGSM/PGD is discussed. There are few issues towards the theoretical discovery and experimental validations:

1. The FGSM/PGD based attacks are formulated as the degeneration of HMC, as explained in Sec. 4.2. However, the experiments on the benchmarks consistently indicate PGD performs better than the proposed method ATCD. As ATCD utilizes a more advanced HMC, there lacks explanations of why the results do not correspond to the theory.  

2. The proposed ATCD is claimed to efficiently generate adversarial examples while the performance seems to suffer from limited iterations. Is it possible to increase the iterations of ATCD for performance improvement?

3. As the efficiency is claimed as a major contribution of ATCD, the computational complexity and time cost compared to other methods (e.g., FGSM, PGD) shall be reported as well.
review_title: Contrastive divergence for adversarial sample generation. Theory formulation and results reporting

Meta-review: The authors propose adversarial training using contrastive divergence based on ideas from Hybrid Monte Carlo methods.
On the positive side the shown experimental results are promising both in terms of robustness and efficiency. On the negative side the paper seems to be written in a hurry. At several places terms are not defined, not explained or important details (e.g. parameters of the attack algorithms) are missing. 

Thus the paper is not ready for publication yet and below the bar for ICLR but I encourage the authors to submit a significantly revised version to another conference.

Details:
- in (7) N(x) is nowhere explained or defined, here also several threat models are introduced but later on only l_infty seems
to be used e.g in Algorithm 1 (should be clarified)
- as noted in the reviews the definition in (13) is based on quantities nowhere introduced
- the potential U is only defined in the Algorithm (but then the arguments do not match with the RHS)
- the kinetic energy in the algorithm is different from what has been used before
- the parameters for the attacks used are not reported
- why is AutoAttack not used for all datasets? They report 28% robust accuracy for the model trained by the Madry group
 (https://github.com/MadryLab/robustness) whereas in the present paper it is 35%.
- the scales of the plots should be chosen such that the curves can be distinguished
Decision: Reject