Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: ################################ Summary ###################################

The authors investigate the impact of various training hyperparameters such as weight-decay, batch size, use of batch normalization in eval/ train mode during adversary generation, smooth activations, optimizer and learning rate schedule. The authors demonstrate that use of the right hyperparameters can bring TRADES back to the top of the AutoAttack leaderboard. (~1.6% boost)

################################# Pros ######################################

  -  The paper presents a good review of the tricks used in different adversarial defense papers, and presents the impact of varying each of them on adversarial robustness and clean accuracy 
  -  The authors highlight the importance of using the right training hyperparameters across different baselines for a fair comparison.
  -  Based on experiments with the PGD-AT model, the authors recommend a set of hyperparameter settings which can potentially generalize to other defenses. 
  -  The authors show that although the proposed settings were found on the PGD-AT model, they generalize well to the TRADES defense as well.

################################# Cons ######################################

  -  The paper lacks novelty, since it merely presents results of existing defenses with different hyperparameters. An analysis/ explanation of why these settings matter more for adversarial training could add value to the submission. 
  -  It is a well known fact that these hyperparameter settings are important for the standard training of Deep Networks. The work by Rice et al. [1] showed that early stopping is important for better adversarial robustness. They also showed the impact of varying settings such as learning rate schedule, weight decay and other regularizers in the supplementary section. This already highlights the importance of selecting the right hyperparameters for adversarial training. Hence, the finding in this paper is not too surprising. 
  -  All the results reported in the paper are for single runs, however they may be a result of variance due to random initialization. Reporting statistics (such as mean and variance) across multiple reruns would be more helpful. 
  -  The final hyperparameter settings suggested in the paper are very similar to those used by Rice et al., with the exception of using Batch normalization in eval mode during adversary generation. Also, the impact of train / eval mode during Batch norm is not consistent across Tables - 7, 8 and 9. Train mode seems to be better for large models on PGD-AT, whereas the eval mode is better for TRADES. 
  -  While the authors show that the hyperparameter settings found on PGD defense generalize well to TRADES, it would have been very useful to show its impact on some of the other defenses listed in Table-1 as well. This would highlight whether the use of a common set of hyperparameters across baselines must be encouraged, or whether it is better to stick to the implementation of the respective authors.
  -  The paper mentions the use of AutoAttack to evaluate the impact of label smoothing in order to rule out gradient obfuscation. However, AutoAttack does not completely rule out the possibility of gradient masking in a defense [2]. The impact of label smoothing on adversarial robustness is still debatable [3, 4]. The defense by Pang et al. [5] is also broken by Tramer et al. [6]. 

[1] Rice et al., Overfitting in adversarially robust deep learning, ICML 2020, https://arxiv.org/abs/2002.11569 

[2] Croce et al., RobustBench: a standardized adversarial robustness benchmark, https://arxiv.org/pdf/2010.09670.pdf

[3] https://openreview.net/forum?id=Bylj6oC5K7

[4] https://openreview.net/forum?id=BJlr0j0ctX

[5] Pang et al., Improving adversarial robustness via promoting ensemble diversity, ICML 2019.

[6] Tramer et al., On Adaptive Attacks to Adversarial Example Defenses, NeurIPS 2020, https://arxiv.org/pdf/2002.08347.pdf 
 
############################### Reasons for score ##############################
 
Although the paper is an interesting read and guide for training adversarial defenses, the key finding of the paper (i.e., hyperparameter tuning can be important for adversarial robustness) is not new to the community, and has been highlighted in recent work [1]. Hence I vote to reject the paper. 

##############  Additional Feedback (not part of decision assessment) #####################

  -  Could the authors clarify whether a validation split has been used for early stopping of TRADES in Table-13, and in general for other defenses reported throughout the paper? If yes, what is the size of the validation split? Also, what is the criteria used for early stopping?
  -  As discussed in the paper, all other defenses in Table-13 also need to be rerun using the optimal settings for a fair comparison. 
  -  It would be useful to include WideResNet architecture with different capacities in Fig.2 of the paper, since this is a common architecture choice across multiple defenses. 

##############  Update after rebuttal ############## 

I would like to update the score to 6 based on the author's response. I have not increased further due to the limited novelty of the paper. However, the observations in the paper certainly add value to the research community.

I request the authors to consider reporting performance of other defenses in Table-16 using the recommended settings in their final version. 

review_title: The paper lacks novelty, although the observations are insightful

final_score: rating: 7: Good paper, accept
review_content: The paper systematically reviews different hyperparameter settings and training strategies used for PGD adversarial training on CIFAR-10. Based on that, it derives practical takeaways (“bag of tricks”) and puts forward a standard baseline setting for future work.

I think this work is a valuable contribution to the research on adversarial training. Some of the influencing factors that it examines, like early stopping or learning rates, have been occasionally discussed in prior works, others - like weight decay - seem to have been mostly overlooked. The systematic investigation of the effect of all these different factors leads to practical insights and will hopefully allow researchers to measure advances in adversarial training without confounding effects of different hyperparameter settings. In addition, the rich bibliography gives a great survey of the current state-of-the-art.

Having said all that, the paper has several limitations which should be either addressed or clearly pointed out:
- The paper effectively only considers PGD adversarial training on CIFAR-10. In principle this is fine as this is a scenario that has been widely studied and still poses many open research questions. However, I think the limitation to CIFAR-10 should be clearly pointed out in the abstract (currently it’s only mentioned in passing at the end of the introduction), otherwise the percentage values referenced in the abstract are taken out of context, and readers who are interested in adversarial training on larger-scale dataset could be misled (ImageNet is completely outside the scope of this paper). Similarly, the paper does not include some of the recent “free” or “fast” adversarial training protocols in its investigation; again this is fine in principle, and I understand that investigating all the hyperparameters along this additional dimension would dramatically increase the complexity of this study, nevertheless I think it’s a limitation that should be pointed out upfront.
- More details on the attack default settings should be provided. In particular, for PGD: what is the step size, how many (if any) random (re-)starts were performed? I suppose an untargeted PGD attack was used? Did you use the true or predicted labels in the untargeted attacks? Same for AutoAttack: what were the hyperparameters, in particular for AutoPGD? On a related note, was it necessary to run the whole suite of AutoAttack (including FAB and Square)? PGD adversarial training usually isn’t prone to gradient masking, so I would expect that a plain white-box attack like (Auto)PGD should be sufficient for evaluations and lead to more interpretable results. If gradient masking was an issue for some of the hyperparameter settings, this would be an important insight which should be explicitly pointed out. With AutoAttack, unfortunately, such aspects are hidden in a black-box.
- In the takeaways on page 7, I wasn’t sure where (iv) had been discussed previously - could you please point me to it?
- Finally, I’m trying to reconcile the reported results with those from Madry et al. (2017, https://arxiv.org/pdf/1706.06083.pdf) who report 45.8% adversarial accuracy under a PGD attack - which is lower than all except one result reported in this paper (if I’m parsing it correctly). Could you please help me understand the discrepancy or where the datapoint from Madry’s paper should fit in?

A few minor observations:
p.1: “much higher than if in” -> remove “if”
p.1: “These motivate us” -> missing word
p.2: regarding certification methods: calling them “exciting” is a bit casual; also I wouldn’t say that they “cannot match” empirical performance of adversarial training (or do you have a proof?) but rather they “currently do not match” it.
p.3: “with the learning rate decays” -> “decaying”
p.3: “at 75 epoch” and “at 76 epoch” -> “at the 75th epoch” or “at epoch 75” etc.
p.6: “the weight decay in previous work almost falls in three values” -> I think this could be rephrased / explained more precisely




review_title: Great systematic survey - but with limitations that should be addressed or pointed out

final_score: rating: 7: Good paper, accept
review_content: This paper provides a comprehensive evaluations on the different hyper parameter settings of training adversarially robust models. Consequently, this paper also gives a few takeaways based on the results that they find. 

The task of finding good hyper parameters for adversarial training is a challenge. So I like the idea of performing a study on the effects of the different settings. 
Since this paper is evaluating the various settings, I have a few concerns regarding consistency of the experiments performed here. 

- This is my major concern of this paper. 
Most of the results shown in the paper are quantitative. Some qualitative understanding of at least one of the settings---like weight decay, would have been very helpful. For example: Visualization of the loss landscape when changing a hyper parameter as shown in Figure 3 in [1] or visualization of the cross section of the decision boundary as shown in Figure 1 in [2]. 
Such qualitative evaluations would have helped to also translate these findings across datasets. 

- Consistency of experimental settings: Table 2 (change in early stopping/warmup on lr/perturb), Table 5 (change in optimizers) and Table 6  (change in activations) report performance on ResNet-18. On the other hand, Table 8 and Table 9 report findings on WRN-34-10/20. 
It would have been more consistent to check Table 2 and Table 5 with WRN-34-10/20 so that the reader finds exactly what happens when the respective changes are made. 

- Reportings: In the abstract as well as the introduction, claims are made without giving the context of the settings. 
“For example, a slightly different value of weight decay can reduce the model robust accuracy by more than 7%, which is probable to override the potential promotion induced by the proposed methods” and 
“In our experiments (e.g., Table 8), we show that the two slightly different settings can differ the robust accuracy by ∼ 4%, which is significant according to the reported benchmarks.”
It would be beneficial to the reader to mention the dataset used here. 

- A few minor corrections but not limited to: 
“where the learning rate decays at 75 epoch and the training is stopped at 76 epoch.”
to “where the learning rate decays after 75 epochs and the training is stopped after 76 epochs.” 

[1] https://arxiv.org/pdf/1807.10272.pdf
[2] https://openaccess.thecvf.com/content_CVPR_2019/papers/Moosavi-Dezfooli_Robustness_via_Curvature_Regularization_and_Vice_Versa_CVPR_2019_paper.pdf
  
review_title: This paper provides a comprehensive evaluations on the different hyper parameter settings of training adversarially robust models. I have a few concerns regarding consistency of the experiments performed here. 

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper provides an evaluation of different hyperparameter settings for adversarial training. Specifically, it evaluates combinations of warmup, early stopping, weight decay, batch size and other parameters on adversarially trained models. The paper states that its overarching goal is to ``investigate how the implementation details affect the performance of the adversarial trained models''. 

Strength
- The papers extensive empirical results are useful to identify good hyperparameters, and it obtains some interesting findings, such that small differences in weight decay can make a big difference in performance, in contrast to standard performance. 
- It is interesting to point out, as the paper does, that the robust overfitting phenomena and in particular how to obtain good performance with early stopping depends on a number of hyperparameter setups and is quite sensitive to the particular choice of hyperparameters.

Weaknesses
- The papers novelty is low; essentially it is a rigorous study on how to choose hyperparameters for a specific adversarial training setup (i.e., adversarial training of CIFAR-10).
- One of the papers main contribution is that ``our empirical results suggest that improper  training settings can largely degenerate the model performance while this degeneration may be mistakenly ascribed to the methods themself''. It is well known a given model only performs well if properly trained and if the hyperparameters are chosen appropriately. 

The paper's value is in identifying good hyperparameters for adversarial training for CIFAR-10. The paper does a very good job in identifying good hyperparameters and setups, but its main finding that ``we should more carefully fine-tune the training settings in adversarial training'' is common sense and in my opinion not a sufficient contribution for a ICLR publication.

---- 
UPDATE: Thanks for the response, I have responded below and kept the score constant. Since I'm currently not actively working on the practice of adversarial robustness, the other reviewers are likely a better judge on the usefulness of the results of the paper for the community.

review_title: An interesting  contribution for identifying good hyperparameters for adversarial training

Meta-review: The authors have conducted a thorough empirical study on the hyperparameters of representative adversarial training methods. The technical novelty of this paper might be insufficient.  But the empirical findings in this paper explain the strange and inconsistent reported algorithm results in the literature to some extent and remind the necessity and importance of a careful study on hyperparameters. The authors have actively interacted with the reviewers and through the discussions, many unclear issues have been fixed. 

Decision: Accept (Poster)