Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: The authors propose a framework where one component is an attacker network that keeps learning about how to perturb the loss more, and one component is a defense network that robustify learning with respect to the attacker network. The framework is flexible on how the attacker network can be trained, and advances over previous works where the attacker is a human-designed algorithm rather than a learning model. Experiment results show that the framework reaches superior defense performance. The authors also extend the framework to help imitation learning.

Overall the paper is a pleasure to read. My questions/suggestions are

(1) Given that the framework seems natural in design, a deeper contribution would be talking about how to successfully train the framework in practice. The authors talk about the connection of the framework to GAN, and the latter is not that easy to train. However, we see very little information on how to train the framework in the paper. Was it super easy to train the framework (why?), or did the author encounter any difficulties? Are there important heuristics that help train the framework successfully?

(2) While the framework leads to a better defense mechanism (the authors' goal), one could wonder whether it leads to a better attacker as well. Instead of just checking the differences of the attacking examples generated, can we take the inner attacker and see if it is more effective in attacking than PGM and CW? How does the goodness of the attacker improve with time? Do different L2L variants generate attackers with different quality? Do the quality connect with the defense performance?

(3) Section 4 looks distracting to me. It is good to know that the framework can be extended to imitation learning, but the section is best put at a longer version or another paper, rather than occupying a significant amount of space in the current paper.

I have read the rebuttal and thank the authors for the response.
review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: The paper proposes a new way of adversarial training by placing another neural network called "attacker" network, and let the attacker to learn how to generate adversarial examples during training. This training scheme is formulated to solving a joint training according to min-max problem. Experimental results show that the method outperforms existing adversarial training in CIFAR-10/100 once the gradient information can be provided into the attacker network. 

In overall, the paper is well-written with an interesting message: There are certain features useful across all data samples in the inner maximization problem, which can be induced from gradient information. The experimental results are presented clearly, demonstrating its effectiveness and efficiency in running time. Section 4 seems to support the main claim in a novel way as well. The general motivation or justification on the proposed methods, e.g. the "limiting cycle" argument or the visualization part were not that convincing or seems slightly over-claimed to me, nevertheless. 

- I think adding a discussion on how to generalize the framework into other threat models, e.g. L2 or (even) unrestricted attacks would further strengthen the paper. I feel the current framework may suffers some training difficulties on these other threat models, even such kinds of discussion would also valuable to understand the method.
- As the current formulation can generalize the general inner maximization optimization process, comparing or applying the method with a more recent form of adversarial training, e.g. TRADES, would be nice to demonstrate the general applicability of the method.
review_title: Official Blind Review #3

final_score: rating: 3: Weak Reject
review_content: In general, this paper follows the min-max training framework for adversarial robustness. Instead of using a gradient-based attack to solve the inner maximization, the authors use a neural network to learn the attack results. From the experimental results, this method can effectively defend against CW and PGD on CIFAR-10 and CIFAR-100. But the clean accuracy is lower than Madry et al. 

Also, there are too many works on robustness defense that have been proven ineffective (consider the works by Carlini). Since this is a new way of robust training and there is no certified guarantee, I suggest the authors refer [1] to evaluate the effectiveness of the defense more thoroughly to convince the readers that it really works. Especially, a robustness evaluation under adaptive attacks is necessary. In other words, if the attacker knows the strategy used by the defender (such as the attacker network structure), it may be possible to break the model. 

I am not convinced by the limiting cycle claim in Figure 1. I do not think this scenario (gradient descent goes along a cycle) is possible. If we take the integral of the gradient along this cycle from x to itself, we will get 0=f(x)-f(x)=-\int_{t on cycle}f'(t)dt<0, which means that the function is not continuous at x. I suggest the authors have a surface plot of the function if they think this is possible. 

[1] Carlini, Nicholas, et al. "On evaluating adversarial robustness." arXiv preprint arXiv:1902.06705 (2019).
review_title: Official Blind Review #2

Meta-review: This paper considers solving the minimax formulation of adversarial training, where it proposes a new method based on a generic learning-to-learn (L2L) framework. Particularly, instead of applying the existing hand-designed algorithms for the inner problem, it learns an optimizer parametrized as a convolutional neural network. A robust classifier is learned to defense the adversarial attack generated by the learned optimizer. The idea is using L2L is sensible. However, main concerns on empirical studies remain after rebuttal. 
Decision: Reject