Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: Summary:
This paper follows the direction of previous work AdvProp (Xie et al. (2020)) and aims to use adversarial training as a regularizer to improve the network generalization on clean data. The authors analyze that the different rescaling operation in the batch normalization layer along with ReLU acts as feature masking/selection layer, which can control the trade-off between adversarial robustness and clean data performance. Unlike AdvProp, which uses different batch normalization layer for clean images and adversarial images at a specific perturbation strength, here the authors propose a technique called RobMask that adapts the rescaling parameters of batch normalization based on the perturbation strength during training. The authors show that such adapting technique is more effective than using different batch normalization layers (as in AdvProp) for each perturbation strength and thus improves the clean data performance on CIFAR10/100.

Strengths: 
+ Motivation and analysis is clear.
+ Discussed its differences to previous works.
+ Proposed technique is simple, easy to adapt in the existing setup of adversarial training and addresses the limitations of the previous work AdvProp.
+ Evaluation is carried out on CIFAR10/100 across different network architectures: ResNet-18, DenseNet-121, Preact ResNet18, ResNeXt-29.
+ Results on CIFAR-10/100 using four different deep network architectures suggest that this work improves clean data performance than the baselines: standard network training and AdvProp.

Weaknesses:
-	The authors claim about well-balanced robustness trade-off using their method and also claim that their major objective is only to improve network generalization on clean data. There is a little ambiguity regarding the major contribution of this paper. The authors can make this point more clear. 
-	Isn’t the hypothesis that is stated as “new” in this work already discussed in AdvProp i.e. using different batch normalization for clean and adversarial images improves network generalization, which in turn draw the conclusion that rescaling operation of batch norm could control the robustness and generalization trade-off. Why this hypothesis considered as “new” then ?
-	The two learned adversarial maskings discussed in section 3.2, it is not clear how they are generated. 
-	Results demonstrate that the proposed approach improves generalization but the performance gain is minimal (only 1%-2%) and not so significant compared to the baselines.
Minor point:
-	I understand that the major objective of this work is to improve performance on clean images but not the adversarial robustness. The results demonstrate higher robustness against PGD based adversarial attacks with perturbation strength lower than 8/255 is interesting but not of practical importance since the method requires perturbation strength as an additional input and very specific to PGD based attack. I wouldn’t consider this as major weakness since it is not the primary objective of this work.

Final thoughts:
The proposed method is clearly motivated. Although the performance gains on network generalization are minimal compared to the baselines, this work cleverly addressed the limitations of previous work and extend it with simple modifications. I tend to accept this paper. However, I suggest the authors to also consider the evaluations carried out in AdvProp (Xie et al. (2020)) to improve the significance of their work.



review_title: Simple way to turn adversarial training as a regularizer

final_score: rating: 7: Good paper, accept
review_content: The paper observes that the rescaling operation in the batch normalization layer and the ReLU activation learn to select different features for standard and adversarial trainings. The authors call this effect "Adversarial Masking." Based on this observation, the authors then propose Rob-Mask that achieves good standard and adversarial accuracies at the same time.

The trade-off between standard and adversarial accuracies are an important problem in adversarial machine learning. The findings in this paper are really interesting and deserve further investigation from the research community.
My biggest concern is that, since it is an empirical paper without rigorous guarantees, I would like to see the experiments on more datasets. The experiments in this paper are only on CIFAR-10 and CIFAR-100, which are similar datasets. Does the finding still hold in other datasets like ImageNet?
Also, there are many models that do not use Batch Normalization, but the standard accuracies also drop when doing adversarial training. The proposed hypothesis cannot explain that. One ablation test that I would like to see is whether fine-tunning a single convolutional layer will have similar effect as fine-tunning the BN layer done in this paper.
review_title: Nice empirical observation on the trade-off between generalization and robustness

final_score: rating: 6: Marginally above acceptance threshold
review_content: ## Overview 

The paper focuses on the generalization issue with adversarial training that various work has recently demonstrated. The paper studies the role of batch normalization (BN) in adversarial robustness and generalizability. The authors single out the rescaling operator in BN to significantly impact the clean and robustness trade-off in CNNs.  They then introduce Robust Masking (Rob-Mask), which is shares similarities to the CVPR2020 paper by Xie et al. (2020). Xie et al. use an auxiliary BN in adversarial training, which uses different batch normalization parameters for adversarial samples, to improve the generalizability of CNNs. Still, the authors clearly state the differences between Rob-Mask and AdvProp. 

## Contributions

The contributions of the paper are as follows:

1. Showing the effect of BN (and, more specifically, the scale parameter of BN together with ReLU) as adversarial masking.

   a. Authors show that *adversarial fine-tuning* of only the BN parameters of a *vanilla-trained* network provides some adversarial robustness, although at the trade-off losing test accuracy. 

   b. Authors show that *standard fine-tuning* of only the BN parameters of an *adversarially-trained* network increases the network's generalizability, although at the trade-off losing robustness. 
2. Showing that interpolating between the BN parameters in Contribution 1 provides a smooth trade-off between generalizability and robustness.

3. Devising an approach for utilizing different perturbation strengths for model training. The authors build on their Contribution 2 and propose $k$ basic (or better to say principle) rescaling parameters, the linear combination of which leads to a rescaling parameter. 

4. Providing a short yet informative, ablation study to show the effectiveness of Contribution 
5. Showing experimental benefits over AdvProp on CIFAR10 and CIFAR100 datasets.

Contribution 3 turns AdvProp into a particular case of RobMask.  In fact, Xie et al. (2020) mention in their paper that "a more general usage of multiple BNs will be further explored in future works," which seems to be the inspiration behind this paper.  

## Weaknesses

1. The main limiting factor for the impact of this paper is the experiments. The paper only reports performance on CIFAR10 and CIFAR100. Given that the paper can be considered an extension/improvement over AdvProp, it is desirable to have similar largescale experiments in Xie et al. (2020) on ImageNet and its variations. A head-to-head comparison with the experiments in Xie et al. (2020) would provide a clearer picture to show the proposed method's power.
2. Regarding the practicality of the approach, I am missing a computational analysis of the approach to compare it against BN and AdvProp, e.g., it would be great if the authors provided a head-to-head comparison of training curves. Does your method take much longer to train?
3. How many times did you run each experiment? What are the standard deviations in Table 3 (and other tables)? Providing this information, at least in the supplementary materials, could clarify your results' statistical significance.

## Questions and comments for the authors

1. The notation $\gamma_i$ is used both for BN's scaling parameter and for the learning rate, which turns the equations hard to follow.
2. On the bottom of page 7, you wrote: "It is because both AdvProp and Adversarial training models are trained with adversarial examples generated with $\epsilon= 8/255$, while our methods use a random perturbation where $\epsilon_{max}=8/255$."  The term "random perturbation" is misleading here, as I believe you are also using PGD attack, but the adversarial perturbation's strength is randomized. Is that correct?
3. Please refer to Weaknesses 2.
4. I don't find Figure 2 informative at all. I suggest that the authors remove the figure and use the space to address the raised concerns.

## Evaluation logic

I find the paper an interesting extension of the CVPR2020 paper by Xie et al. However, the paper's experimental section does not provide enough information to the reader to see the concrete benefit of the proposed method in training a large scale CNNs. I think the paper could significantly benefit from a more extensive experimental setting. Given the limited novelty and lack of concrete evidence of practicality, I score the paper as a 5. 

## Post rebuttal evaluation

I thank the authors for providing answers to the raised questions and providing further experiments. Regarding Figure 3, I suggest that the authors provide accuracy as a function of wallclock instead of epochs currently reported in the paper. As a result of the authors' responses, I increase my score to 6. 
review_title: An interesting extension of AdvProp with limited evidence of practicality

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary:
The paper investigates the role of Batch Normalization (BN) in the generalization of deep networks, and its impact in the trade-off between clean and robust accuracy in adversarially trained networks. The authors demonstrate that the rescaling operations in BN when considered in conjunction with the ReLU activation, serve as a feature masking operation. Based on these observations, the authors propose RobMask, which uses a linear combination of such rescaling operations to achieve improved generalization in deep networks. 


Pros: 
1) Interesting observation, and highlights the needs to re-examine techniques from the standard training paradigm that are directly used in adversarial training of deep networks 
2) Easy to integrate with any network architecture that already uses Batch Normalization
3) Demonstrates enhanced standard performance over different network architectures and datasets
4) Achieves improved trade-off between clean and robust accuracy for adversarially trained networks on smaller constraint sets (L-infinity eps = 2/255 to 6/255)

Cons: 
1) The paper lacks novelty from the standpoint that very similar observations were made by Xie et al. [1]. 
2) Further, the primary results are demonstrated for the case of k=2, using a linear combination of Batch Normalization parameters obtained for normal and adversarial training, which represents only a minor change from the algorithm proposed in [1]. 
3) While the method itself is not difficult to understand, it is still unclear why it helps strike a better balance for the accuracy-robustness trade-off in adversarially trained networks. Could the authors provide an intuitive or theoretical explanation for the same?
4) The adversarial training of larger networks such as DenseNet-121 can be highly computationally intensive, requiring almost an additional order of magnitude in training time. Thus the performance comparison made in Table-3 at the 20th epoch for models trained using normal training and RobMask is unfair, since RobMask uses 7-step adversarial training. Perhaps a better metric to consider would be the standard performance obtained after a fixed training time.
5) The clean accuracy shown in Table-1 and Table-3 for the adversarially trained ResNet-18 model on CIFAR-10 is quite low (78%), compared to standard values reported in [2,3], which is often around 82%. 
6) To quote from the last para of Section4: “Also, the proposed RobMask method is more general than Advprop, and AdvProp can be considered as one special case of RobMask when we set the linear layer rank k to 2 and freeze p = 1 in the whole training process.” Thus, could the authors provide additional results for k=3 or k=4? This is quite important to set apart the proposed method from AdvProp, which is highly similar, as final results are only reported with k=2 in Table-3.
7) In test time, it is not immediately clear what choice of $u_i$ should be used, since it determines the effective batch normalisation parameters that are used. Could the authors clarify the exact BN parameters used in final evaluation on clean and adversarial samples?
8) When k is set to a value larger than 2, it is not immediately clear what the different $w_k$’s would represent, since the 2-dimensional $u_i$’s already encode information about different $\ell_\infty$ constraints. Could the authors clarify this? Further, it would be beneficial to the reader to include an example with k=3, along similar lines to what is presented in Section 4. 
9) Evaluation on PGD-100 step attack alone is not sufficient, as with stronger attacks such as MultiTargeted attack [4] and AutoAttack [5], the difference in adversarial accuracies might be much lower for eps=2/255 to 6/255, as reported in Table-3.
10) Since the authors say that the proposed methods does not achieve better adversarial accuracy for eps=8/255 in Table-4 due to the sampling of p, could the authors show results where the maximum constraint is set to 10/255 to show an improvement for the standard evaluation setting of 8/255? This would greatly help in the comparison of different methods, particularly the clean accuracy of different models.

[1] Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A. L., & Le, Q. V. (2020). Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 819-828).
[2] Wong et al. Fast is Better than Free: Revisiting Adversarial Training, ICLR 2020
[3] Rice et al., Overfitting in adversarially robust deep learning, ICML 2020, https://arxiv.org/abs/2002.11569 
[4] Gowal et al., An Alternative Surrogate Loss for PGD-based Adversarial Testing, https://arxiv.org/pdf/1910.09338.pdf
[5] Croce et al., Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks, ICML 2020

In summary, although the observations presented in this work are interesting, further analysis and thorough evaluations are required to justify the claims made in this paper.

Expecting the authors to address the following during rebuttal period: 
 
- Please address and clarify the cons as listed above.
- Could the authors please provide additional details on how the finetuning is performed in Section 3.1?
- In Figure1, could the authors clarify the quantity along the x-axis? If it represents iterations, or epochs?
- Could the authors clarify how the plot for Adv-Train is obtained (in relation to the Std-BN finetune plot)? How were the updates performed on the Adv-Train model to obtain this plot?
- Given that the parameters of the first BN layer are presented in Figure1, since the convolutional layer that occurs before this BN layer is frozen, it is expected that Plots 1(a) and 1(b) are identical for the two cases, and does not offer additional insight. 
- Could the authors comment on the behaviour of BN parameters in deeper layers of the network when the same fine-tuning experiment is performed?
- In Figure2, we observe that very few feature maps are indeed changed. Could the authors comment on this? Also, could the authors clarify which layer was used to obtain these figures?
- In Algorithm 1, could the authors clarify if the number p is sampled uniformly from the [0,1] range?
- Further, it is not clear which set of BN parameters is used in the crafting of the PGD attack in the proposed algorithm. This small detail is likely to cause dramatic changes in the final outcome of training. As currently presented, it appears as though the BN parameters corresponding to standard training are used in this step.
- Could the authors show an ablation experiment where the BN parameters corresponding to RobMask are used for attack generation to understand this better?
- Could the authors clarify if the network parameters $\theta$ are also adversarially updated (along with W and W’) using the loss on the perturbed sample $x+\delta$ as presently shown for all experiments? If so, could the authors clarify why the accuracy for eps=0 in Table4 differs from that shown in Table3 (5-6% difference)?
- Also, it is not completely clear from the algorithm if BN parameters of all layers in the network are updated, or if it is restricted to some specific layer.
- Could the authors share details used for adversarial training (optimizer, learning rate schedule, number of epochs, validation split, use of early stopping)? These factors play a crucial role in the final robust accuracy achieved and in the trade-off with clean accuracy as well, as often the model obtained at the last epoch of training achieves lower adversarial accuracy compared to intermediate epochs.

########################## Update after rebuttal ##########################

I thank the authors for their detailed response; several concerns have been addressed in the rebuttal. I would encourage the authors to use commonly used practices to improve the robust performance of models in Tables 5 and 6. The use of early-stopping [3] can significantly boost the robust performance, and produce models with better clean accuracy than is presently reported for Adv. Training. I would like to update the score to 5 based on the author's response. Aside from the robust evaluation, the improvement in clean accuracy is of a relatively smaller magnitude given the disproportionate increase in training requirements. Thus, I have not further increased the score.

[3] Rice et al., Overfitting in adversarially robust deep learning, ICML 2020, https://arxiv.org/abs/2002.11569 

review_title: Interesting approach, but needs further analysis 

Meta-review: The reviews were a bit mixed, with some concerns on the incremental nature of this work, which the AC concurs (after independently going through both the submission and Xie et al 2020). In a nutshell, the main contribution on the authors' side appears to be a simple linear interpolation of two masks so that it is possible to leverage attacks with varying strengths. Other claimed contributions are not substantiated. In particular: 

(a) Fig 1 and its conclusion are a bit disturbing. It is suggested that the authors back up their claim with more empirical and theoretical evidence. For example, why can one conclude from the same mean and variance that there is no distribution mismatch between clean and adversarial examples (as claimed in Xie et al)? If the two sources have similar distribution, why is there a sharp difference in gamma for the two? When one claims different results from previous work, due diligence is required. For instance, did the authors reproduce the mean and variance on the same architecture and dataset of Xie et al? How about other BN layers (in addition to the first one)? How to explain the difference in gamma? The fact that you are using different masks for different epsilon is an indication that their distributions are probably different. The authors mentioned the joint effect between gamma and relu activation, which could be potentially insightful. However, this is a bit speculative in its current presentation. How about an ablation study with leaky relu or tanh/sigmoid? Without these careful comparisons, these claimed contributions are not appropriate to publish in their current form.

(b) As the reviewers pointed out, why BN, after all for models that do not use BN they still suffer from adversarial examples? Even when we restrict to models that use BN, why replicating BN for different sources helps generalization? Here, an excellent experiment point is to compare to fine-tuning or replicating other layers in the network. During rebuttal, the authors only tried to fine-tune ONE convolution layer and quickly concluded its ineffectiveness. Note that in contrast the authors fine-tuned ALL BN layers. How about all convolution layers, some pooling layers, the last softmax layer? These experiments could help us understand if there is some magic in BN. Or maybe it is just more convenient to fine-tune BN because of its small number of parameters? In any case these experiments would largely strengthen the findings of this work.

(c) As pointed out by the reviewers, Xie et al hinted at the advantage of using multiple BN masks and the authors proposed to linearly interpolate the masks. In the ablation study, what if we increase the number of BN masks in Xie et al, say we discretize p into 11 values p = {0, 0.1, ..., 0.9, 1} and have 1 mask for each value? Here an interesting experiment is to compare K = 11 (basically AdaProp) with smaller K (such as 2 or 5). The authors seemed to suggest that a larger K does not seem to help, which would be clarified through the preceding experiment (and perhaps more). Note that using a uniformly random p is equivalent as adversarial training with a weaker (and varied) attack, and the better tradeoffs shown in the experimental section (e.g. Table 3) are perhaps expected.

(d) As pointed out by the reviewers, a head to head comparison against AdaProp (preferably with more masks) is desirable. The authors mentioned some difficulty in conducting this experiment fully. If it is only the software side, maybe check the sources here: 
https://paperswithcode.com/paper/adversarial-examples-improve-image

(e) Finally, a minor point: Algorithm 1 with k=2 and p=1 does not reduce to AdaProp as one will only train on adversarial examples and ignore all clean samples? 

In the end this submission appears to be a bit incremental. However, the authors are strongly suggested to follow the reviewers' comments to further polish their work and address the concerns above. With proper revision this work can eventually become a solid contribution on top of AdaProp.
Decision: Reject