Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper tackles the problem of adversarial overfitting, that is a critical breakdown of robust accuracy that commonly happens in adversarial training and makes early stopping a necessity for AT. They give an interpretation of robust overfitting from the standpoint of label noise, ie they argue that the adversarial attacks change the true target for the image but AT does not adapt to the change in label. 

The paper first gives a theoretical analysis, in which they first show that for locally Lipschitz and optimal (P(Y|x) = f(x)) classifiers, the adversarially perturbed data distribution has non-negative label noise (if the labels remain unchanged) that depends, among others, on the size of the perturbation radius. A similar theorem is then given for the case of non-optimal classifiers. 

In the practical section, they show various phenomena, for example, that robust overfitting follows a double descent curve and that robust overfitting correlates with radius and data quality. 

Finally, they introduce a new adversarial training formulation, that uses temperature rescaling, interpolation, and the output of an external adversarially trained classifier to relabel the perturbed samples during adversarial training. In the evaluation, they show that this scheme is less likely to overfit and can yield better robust accuracies. 
strengths_and_weaknesses: Strengths:

- The problem of robust overfitting is relevant and while the intuitive idea that AT can create a sample-label mismatch is quite obvious, the theoretical and practical connection to robust overfitting is interesting. 

- The paper is well written and clear in its explanations.

- The robustness evaluation uses a strong and reliable attack. 

- The proposed training method improves over AT, Trades and KD-AT in terms of robust accuracy on all 3 datasets. 

Weakenesses: 

- Like every theoretical paper, the authors make certain assumptions. This is fine and I think that the local Lipschitz assumption is quite common and established in the AT literature. However for the others, such as external covering in 4.4, the authors do not comment on whether or not this is a realistic assumption or if it is highly likely to be violated in practice. 

- The proposed training scheme is not very novel and resembles for example the cited [Robust overfitting may be mitigated by properly
learned smoothening] with a heuristic for hyperparameter optimization. 
questions: - Section 3 assumes that Y and Y-hat are integers, ie this means that a true label exists. Now for certain images, an adversarial attack might introduce a new class without completely deleting the original one, eg we could have an image with both a dog and a cat. Is it possible to extend your framework such that Y is a distribution to handle those circumstances? 

- Figure 7 shows that the proposed method does not overfit in 150 epochs. Is this also true if we continue training for 1k epochs? 

- In the past, papers like "Unlabeled Data Improves Adversarial Robustness" have shown that quantity matters. In light of your theorem, it seems like data quality is more important. Do you think this behavior is simply not explained by your theory or is there another explanation? 

- In a way, this scheme resembles self-training. Is it possible to iterate the method, ie use the first classifier trained with your new loss to train a second classifier with the first one as "teacher" (to label the adv samples during training)? 
limitations: The limitations in the appendix address the largest issues. The training of the additional classifier can be expensive and the entire scheme can only work if one can actually find a model that can properly classify the adv samples for the new classifier during training.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper demonstrates that adversarial training will introduce label noise through both theoretical and empirical investigations. This noise helps to interpret the robust overfitting phenomenon. The paper further proposes to use a rectified model probability in adversarial training to mitigate the robust overfitting. Experiments on CIFAR10/100 and Tiny-ImageNet are conducted to illustrate the effectiveness of the proposed method.
strengths_and_weaknesses: Strengths:
1. The observation that adversarial training introduces label noise is insightful and novel, and sheds light on the understanding of robust overfitting.
2. The paper provides a clear and in-depth theoretical investigation of the label noise caused by adversarial perturbations. The example and relevant experiments are helpful for readers to grasp the key idea of this novel label noise.
3. Based on the label noise understanding, the paper further proposes to use a rectified model probability to mitigate the robust overfitting. Comparisons with regular AT and KD-AT illustrate the effectiveness of the proposed method.

Weaknesses:
1. Though the experiments successfully demonstrate the connection between the label noise and robust overfitting, it would be overstated to say "robust overfitting can be adequately explained by such label noise" (line 76). A rigorous theoretical analysis is needed to establish that strong conclusion.
2. while the example shows that the label noise introduced by adversarial perturbation can be significant in synthetic datasets, it is not clear how severe would the label noise be in realistic cases.
questions: 

1. Can the authors estimate the significance of such AT-caused label noise in realistic cases, e.g., considering the classification task on CIFAR100?
2. The arguments in section 4.2 seem artificial.
if an AT-trained model can approximate the true label distribution, then the robust overfitting won't be a problem. That is it doesn't matter whether the AT will distort the true label distribution. 
3. A possible typo in table 1, in the last column for CIFAR100, -0.25 is in bold instead of -0.09.
limitations: The paper addresses the limitations in the supplementary material. As far as I am concerned, there is an additional limitation: 
- the paper does not discuss how severe would the label noise be in realistic applications.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors show that label noise exists implicitly in adversarial training due to the mismatch between the true label distribution and the assigned label distribution of adversarial examples.  Based on a label noise perspective, the authors formalize robust overfitting and show that it is the early part of an epoch-wise double descent in adversarial training.  Also, the authors propose an alternative labeling of adversarial examples by rectifying model probability, which uses temperature scaling and interpolation together.
strengths_and_weaknesses: The authors nicely presents that adversarial perturbation implicitly generates label noise.  This phenomenon is explained intuitively and proven formally.  The observation is correct in that there is a mismatch between the true label distribution and the assigned label distribution of adversarial examples.  To solve this issue, the authors propose an alternate labeling scheme based on temperature scaling and interpolation.  As a result, the proposed training method achieves higher accuracy than conventional adversarial training methods.  Overall, the observation is interesting, and the theoretical analysis is well presented.

At the same time, I have the following concerns.

The authors prove that temperature scaling and interpolation can be effective for reducing the distribution mismatch.  However, it is not clear why these two methods are specifically selected.  Are there any other techniques applicable for the same purpose?  To me, introducing these two techniques is somewhat abrupt.

There is a gap between the theory and the actual method.  In Theorem 5.1 and Theorem 5.2, there exists satisfying $T$ or $\lambda$ for each example.  However, a single value is used for the hyper-parameters in the actual method (Equation (9)).  Thus, the connection between the theory and the method is not very rigorous.  In Section E. the optimal hyper-parameter values for each example are not highly concentrated, as opposed to the authors' claim.

Different perturbations and dataset qualities need to be considered for validating the effectiveness of the alternate labeling.  Currently, one a single perturbation radius is used.

It would be better to show how many adversarial examples are assigned labels different from those of the original examples.  The authors can discuss whether the alternating labeling schemes chooses a reasonable label when a different label is generated.  Such case study will be very interesting to the reader.

It is not clear how the validation set is extracted for determining the optimal parameter values in Table 1.  What if a sufficiently large validation set does not exist?

p. 2 is not shown using Acrobat on Windows.  (Okay on iPad.)

=== Post-rebuttal update ===

I have increased my rating from 5 to 6, mainly due to the authors' additional experiments.
questions: Why do you assume that $f$ is a L-Lipschitz function?  Is this assumption reasonable?  What if this assumption does not hold?
limitations: It would be better to discuss the possibility that the alternative labeling even increases the risk of robust overfitting.
review_title: null

Meta-review: metareview: This paper introduces a new insight on the relationships between noisy labels and adversarial training. 

All reviewers agree the contriubtions of this paper in terms of interesting observation, novel perspective,s theoretical-practical anlaysis, and promising experimental results and gave all acceptance scores.

AC also agrees with reviewers' opinions, and thus recommends accepting this paper. 
Please more clarify the limitations that the reviewers referred to in the final version.



confidence: Certain
Decision: Accept