Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes various methods to mitigate the drastic overfitting (and resulting worse robust test accuracy) that can occur when adversarial training using the fast gradient sign method (FGSM). The proposed methods include masking input pixels, increasing the stride size of the first convolutional layer, smoother activation functions, and regularization. The authors show that each of these approaches successfully mitigates catastrophic overfitting on its own, and that the combination of multiple of these techniques results in slightly better robust performance than any technique alone (including those in previous works).
strengths_and_weaknesses: Strengths
- This paper improves upon the performance of FGSM adversarial training by incorporating new techniques to mitigate catastrophic overfitting.
- The authors provide some light hypotheses behind why these techniques might work, and some empirical testing of these hypotheses. 
- The paper is clearly written for the most part.   
 
Weaknesses 
- It is not made entirely clear which technique in the “bag of tricks” performs best and whether your combination of techniques is state-of-the-art (i.e. it would be good to state this clearly in the introduction, add bold font to your tables, and include the best of the results in Table 3 as a line in Table 1 as well).
- The paper could use another round of edits to improve readability: you should use \citep for parenthetical citations, and there are a few typos i.e. in lines 214-215. 
- The experimental evaluation is not as thorough as in previous work - a stronger/more standard PGD evaluation uses 50 steps and 10 restarts rather than just 10 steps, and training time is excluded in the experimental results. 
- While there are some attempts to explain why these techniques are successful at mitigating catastrophic overfitting, the paper could be strengthened by including only the most effective of the techniques, and providing a more thorough investigation into each technique.
questions: Questions
- Do you use a validation set or do you measure the robust accuracy using the test set during training? 
- Did you re-train other methods in Table 1 or use downloaded weights?
- What is the main advantage of using the fixed mask, given it does not appear to outperform any instance of the random masking? 

Suggestions
- It would be good to discuss the trade-off in clean performance amongst the different techniques. Additionally, it would be interesting to include clean performance in Table 2. 
- You could better clarify what catastrophic overfitting is in the introduction for the reader that is unfamiliar with the term/phenomenon.
limitations: Yes
review_title: null

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: This work investigates several modifications that can avoid Catastrophic Overfitting in FGSM-AT which would make AT much more efficient compared to using multi-step methods such as PGD. In particular, they suggest 4 different "tricks": Masking some pixels of the image, using a larger stride (default 2), using smooth activation functions (already suggested in prior work) and using a weight normalization regularizer. They empirically observe that some of their tricks achieve better performance than FGSM+GradAlign for CIFAR10 and $\epsilon=8/255$.
strengths_and_weaknesses: Strengths:

1. The topic of Catastrophic Overfitting and in particular efficient AT is relevant. 
2. Results shown are encouraging.
3. Some results are surprising like the fact that a fixed mask works as well as randomly masking each image.

Weaknesses:

1. My main concern is that I do not think the experimental evidence is enough to support the claims. As reported in GradAlign work (https://arxiv.org/abs/2007.02617) some single-step AT methods (like F+FGSM) could prevent CO for moderate $\epsilon$ (such as 8/255) but would suffer from CO for larger radii. Therefore, the tested settings in this work (only CIFAR-10 and $\epsilon=8/255$) are too narrow to be reliable when stating that some particular method prevents CO. Additional perturbation radii should be compared and it would be sensible to include at least another dataset.

2. There is a lack of insight in the proposed tricks. While empirical results are definitely interesting, they should be discussed more in order to understand why do they work.

3. Some of the "tricks" are not very novel (e.g. smooth activation functions was already introduced in the context of adversarial training). Despite it is novel that they can mitigate CO in some settings, without more insight into why this would happen I consider the finding lacks impact.
questions: 1. Why do authors think that CVT does not suffer from CO? Have they tried larger perturbation radii? 

2. It would be helpful to add a column for the computational cost (either in seconds per epoch or as a relative cost) for the different tricks and compared methods since one of the strengths of the proposed methods is efficiency.
limitations: As previously discussed, authors should test other datasets and larger perturbation radii to claim that the presented methods prevent CO.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper investigates training tricks used for FGSM-AT, including data initialization, network structure and optimization. The combined tricks can effectively alleviate the catastrophic overfitting in FGSM-AT, making FGSM-AT a more practical way towards robustness.
strengths_and_weaknesses: Strengths:
- The catastrophic overfitting in FGSM-AT is an important research topic.
- The investigated tricks like random masking / increasing stride size are interesting and underexplored in the literature.
- WeightNorm seems an efficient substitute for GradNorm.

Weaknesses:
- My main concern is that the proposed tricks largely hurt the clean accuracy (e.g., Table 1 FGSM-Mask drops clean accuracy from 89.4% to 79.9% on WRN-34-10; FGSM-Smooth drops clean accuracy from 86.4% to 74.8% on PreActResNet-18).

questions: My main concern is that the proposed tricks largely hurt the clean accuracy.
limitations: No
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The paper focuses on the problem of catastrophic forgetting overfitting in Adversarial training using FGSM. It investigates the data initialization, network structure, and optimization of CIFAR-10. It shows that
* applying masking pattern to the training set,
* smooth activations and using ViTs, and
* constraining first layer convolution weights in the convolution layers
 
stabilizes FGSM adversarial training.

strengths_and_weaknesses: I am well-familiar with the literature and read the full paper in detail. Accordingly, now I’ll describe the strengths and weaknesses of the paper in the order of originality and significance, quality of the paper, and clarity. 

---

### Originality and Significance

#### Strengths

* The paper’s motivation is sound; it investigates the catastrophic forgetting overfitting from different perspectives, including data initialization, network structure, and optimization. While many previous works have understood this issue, the paper showcases that these simple tricks can help mitigate this problem to a certain extent.

* The tricks are novel for FGSM adversarial training, especially the results showing that a pre-defined masking pattern to the training, the effect of ViTs, and regularization terms are simple, easy to implement, and effective in isolation, as demonstrated by the results.

* The paper does a good job of positioning the proposed work. Furthermore, it does a good job in related work (section 5) explaining the existing works. I appreciate the paper using the optimal hyper-parameters from Pang et al. 2021. for their experiments.

#### Weaknesses

I do not have any significant concerns regarding the originality and contributions of the paper to the community. One minor suggestion is to include a discussion with Pang et al. 2021 when discussing smooth activation functions in Section 3.2, as the advantage of smooth activations was shown in their paper. 

---
### Quality

The conducted experiments are interesting and valuable to show the performance gains by the proposed tricks for FGSM-AT. However, they were not exhaustive for me to evaluate the proposed tricks conclusively. Therefore, I have the following suggestions and questions that would be helpful to gain more insights and should improve the paper:

* The paper does not provide confidence intervals, making it hard to judge the improvement gains. For example, in Table 1, the weight norm seems to provide no benefit over the grad norm; it is also hard to see the differences between FGSM-Smooth and FGSM-Str without the confidence intervals. Similarly, in Table 3, given the minute differences between various combinations, it is challenging to judge the contributions of each of them individually.
* The evaluation protocol was also unclear, is the masking done only during training or even during the evaluation? In my opinion, it should be done only during training to avoid obfuscated gradients.
* Lastly, the effect of \lambda from eq. 9 was not highlighted in the paper. Other than mentioning the time taken per epoch in line 221, it would be beneficial to mention the total training time for both the methods up to convergence. 

---
### Clarity

The paper was easy to read; however, I have various suggestions regarding the paper’s writing, as elaborated below.

* In Figure 5, I would suggest including Relu for a comparison. Further, I don’t think the left figures in Figure 5 are essential in the main paper. They can be moved to the appendix and the space can be utilized for important text like WideResNet results mentioned in Section 4.
* I would suggest repositioning section 4 and explaining the architectures in the experimental settings, followed by comparing the architectures' observations in the following sections.
* The images in Figure 1 can be positioned side-by-side horizontal instead of vertical.
* According to the NeurIPS template, the caption should have been on top of the table.
* The paper had an incorrect usage of \citep and \citet. For instance, lines 22, 26, 95, 98, etc., should have used \citep, but the paper uses \citet for all citations.

#### Other writing suggestions:
* Line 35: Extra space before the period
* Line 87: Extra space after f 
* Line 248 - Refer to the experiments being talked about here.
* A period in equation 2.
* While the operators may seem obvious, for uninformed readers, it would be helpful to define $\Pi$ , $x_t$, $t$ in section 2.
* Missing comma after equation 5
* The paper should also mention the number of GPUs used for ease of reproducibility in Line 108
* The notation of FGSM-Str2 is not self-explanatory.
* Therefore, therefore -> Therefore in line 238
* Extra space after the period in line 277
* I suggest using the conference proceedings references for the papers; in many cases, it refers to the ArXiv version.

---

### Reproducibility
The authors provide the code to replicate the results in the supplementary material.

questions: Other than the questions in the previous section, I had the following clarifications and suggestions:

- Did the authors also check the effect of batch-norm and its variants on FGSM-AT? It would also be interesting to see if the regularizers like mixup, cutmix, augmix etc. can further be used as tricks for FGSM-AT.

- The intuition behind the attenuation is unclear to me. Can the authors comment on the reason for attenuation at some point for the masks? Further, did the authors experiment with less than 10% masking? 

- Which architecture was used for conducting architectures in Table 2 and Figure 2 a). Was the same architecture used for all experiments other Table 1? Did the authors check the observations for the other architecture and observe similar behavior?
limitations: While the paper mentions that limitations are highlighted in Section 6, the limitations were missing from this section. Therefore, I would suggest including a separate section highlighting the limitations and societal impact of the paper; this can also be included in the supplementary material, but I believe the authors can easily accommodate half a page in the current manuscript.
review_title: null

Meta-review: metareview: This paper proposes to solve FGSM catastrophic overfitting by combining different algorithmic methods (i.e., masking pattern to the train data, smooth activations, ViTs, constraints on the first layer convolutional weights).  The reviewers have considered the problem studied very relevant but were not convinced by the empirical evaluation, finding that the paper is missing an exhaustive evaluation (and for epsilon larger than 8). In addition, they would have appreciated some understandings on the different tricks considered. We encourage the authors to revise their paper, taking into consideration the reviewers’ feedback and to submit the revised work to a forthcoming conference. 
confidence: Certain
Decision: Reject