Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper introduces an algorithm for defending against multiple adversarial attacks (L1, L2, L-inf) by learning separate batch-norm statistics for each attack type. At inference time, the batch-normalized outputs corresponding to the different attack types are averaged according to the probability of attack types as given by a separate prediction network (one per batch-norm layer). The algorithm is evaluated on a range of datasets (MNIST, CIFAR-10, Tiny-ImageNet) and is shown to outperform recent competing approaches on a range of adversarial attacks.

Strengths:
- Empirical evaluation covers a range of datasets and attacks, including the most recent strong attacks
- Performance improvement is significant over competing methods

Weaknesses:
- Experiment results seem to be from only a single run
- Proposed method only applies to architectures that use batch-norm, unlike competing methods
- Inconsistencies in the motivation vs empirical analyses, and experimental setups:
  * Plots in Fig 1 to support the multi-domain hypothesis are on VGG16, but this is not the architecture used in experiments (ResNets were used instead)
  * Main experimental results are on ResNets, but ablation studies are on VGG16
  * Ablation study shows that adding GBN to the first layer results in the best performance (Fig 3a) but batch-norm statistics in this layer are almost indistinguishable between the different attack types (Fig 6a,b). 

Overall this paper introduces a new approach to defending against multiple adversarial attacks based on batch-norm statistics, with strong improvements over competing methods. Where it falls slightly short is in the inconsistencies mentioned above between motivation, empirical analyses to support the motivation and experimental setups; I will gladly raise my score accordingly if these are fixed.

Other questions and comments:

- What do the batch-norm stats look like on the ResNet architectures used? What is the effect of network architecture on the method?
- How many runs were the reported results dervied from?
- What is the performance of the best performing model (e.g. using adversarial training) under an individual attack? The proposed method almost seems like training separate models for each attack type - how does it perform against such a baseline where you have a classifier to pick the relevant model?
- Why is the algorithm not trained using soft-gating, which will better reflect the actual prediction made at inference time?
- It would be useful to show evidence of "domain invariant representations" learnt, for instance, using tSNE plots of the representations.
- Clarify the meaning of "All attacks" in the results tables
- I'm not sure if the theorem provided in the paper is helpful - the loss function -yf(x) is not commonly used.

*** Post response comments ***
I thank the authors for the clarifications and additional data provided in the revision; most of my concerns have been addressed. I have to say it is a bit worrying that the indistinguishable statistics in the first layer also occurs for the WideResNet models, which needs more explanation and exploration since it is a key motivation of the method. Also, the point raised by R1 on the evaluation is somewhat concerning. As such, I think this paper is borderline even though I am raising my rating to 6.

review_title: Good empirical results, some inconsistencies need to be fixed

final_score: rating: 5: Marginally below acceptance threshold
review_content: Existing defenses are usually robust against certain types of attacks. This paper proposes to build a defense against different types of norm-bounded attacks via gated batch normalization. This work treats different types of adversarial attacks as data from different domains and proposes to use gated batch normalization to improve the robustness across different domains. The idea is interesting. The result shows the effectiveness of the defense. 

Weakness and Concerns:

1. Adaptive attack for the GBN layer is missing. For example, one possible attack is to attack the GBN layer directly. Say the L_inf attack's aim is to fool the GBN layer, such that the gate output is misled from dealing with the L_inf but the L_0, the defense should fail. The reviewer worries that the robustness is not measured correctly, maybe rely on the obfuscated gradient [5].

2. No comparison to the STOA method. For example, the L_inf on LeNet MNIST does not compare to the TRADES [2] paper. On CIFAR-10, the author should also provide results on the WRN model [3] given the rich literature using it. Also, the standard CW and PGD attack for L_inf attack is not provided here. The paper should also compare to [4], as it also builds robustness against different kinds of norm bounded attacks. 

3. Can the author list exactly how many steps they used for each attack evaluation? Does the paper use the best attack algorithm for each norm bounded attack? For example, it is known that CW/PGD is effective for L_inf attack. 

4. Theory only considers the linear case.

5. Can the author compare to baseline model TRADES [2]? Since it can also be used to align the features from different types of attacks. Without such comparison, it is not clear how much gain the proposed method achieves compared with the established benchmark.

6. What is the difference between this method and [1]?



[1] Xie et. al. Adversarial Examples Improve Image Recognition.
[2] Zhang et. al. Theoretically Principled Trade-off between Robustness and Accuracy.
[3] Madry et. al. Towards Deep Learning Models Resistant to Adversarial Attacks.
[4] Schott et. al. Towards the first adversarially robust neural network model on MNIST.
[5] Athalye et. al. Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples.

The rating will be updated based on the rebuttal.
review_title: Method is interesting. The results show the effectiveness. But the reviewer worries whether the evaluation is valid.

final_score: rating: 6: Marginally above acceptance threshold
review_content: ### Summary

The authors propose to improve the robustness against adversarial attacks in deep networks via the use of a customized normalization strategy. Their central methodological suggestion is called gated batch normalization (GBN), and involves a (soft, but some other variants are briefly explored as well) gating mechanism that maps to distinct normalization branches. Their idea is evaluated on a set of benchmarks and robustness is measured threefold: in terms of $L_1$, $L_2$ and $L_\infty$ perturbations.

### Strengths

The authors formulate an intellectually compelling underlying hypothesis, namely that adversarial perturbations can be viewed as coming from distinct domains, special in character since they may be positioned very closely to the original domain of natural images of the unperturbed distribution. This is an interesting viewpoint (although I am not sure why we would want to call these entities domains, a "mode" or "manifold" would seem more appropriate), and this aspect is in my opinion the strong point of the paper!

The experimental section evaluates GBN against competitor approaches, either directly purposed for adversarial robustness (e.g. MSD) and conceptually similar normalization techniques (MN, MBN). CGN achieves convincing performance, and the underlying idea of separating BN statistics seems to improve adversarial robustness in a substantial way.

### Weaknesses

While the methodology of several gated BN units is well motivated, the technical novelty is somewhat limited. In particular, the method proposed here is very similar to the work of Deecke et al. (ICLR, 2019), with its main differentiation being that the gating mechanism is computed in a round-robin fashion (i.e. parameters are fixed when updating the gates, and vice versa) and with ground-truth information passed to the normalization units.

That being said, introducing supervision (with respect to the initially applied perturbation) seems to be crucial to be effective when defending against adversarial examples, and increases performance against a range of competing approaches. Because of this, I would argue that the limited novelty in terms of the normalization is offset somewhat by the idea to try this out in an adversarial setting – and getting it to work there.

### Suggestions

There are a few suggestions that I would have liked to see included in the manuscript to increase its strength:
* further study around what constitutes a good gating mechanism, in particular (i) what is the performance for a Gumbel-based approach; (ii) since the gates are computed offline, is there some sort of non-local parameter-sharing that (e.g. via a regularizer) benefits performance? This would also help in increasing the novelty of this work respective to the various competitive normalization approaches introduced in earlier publications.
* Additional analysis around Figure 1 (c) and (d). Why was this particular layer chosen? Does this trend hold in other layers as well? What about deep lower versus higher layers. There are a number of interesting questions to be explored around this theme, for example is this trend a function of the semanticity? For some background reading on the depth of networks and their semantic function, I recommend looking into Asano et al. (ICLR, 2020).

### Minor suggestions

Good job on Figure 1 (a) and (b), this helped tremendously with quickly understanding the proposed mechanism! However, Figure 2 could use some improvement (in fact, maybe this can be removed in favor of additional discussions as outlined above).

There seems to be some issue with the citations, e.g. Kurakin et al. (ICLR, 2017) and Deecke et al. (ICLR, 2019) are cited with first & last names in the wrong order.
review_title: Interesting results, novelty slightly limited – would benefit from further exploration

Meta-review: This paper first examines a multi-domain separation phenomenon, where different types of adversarial noise lead to different running statistics, and then introduces Gated Batch Normalization (GBN), a building block for deep neural networks that improves robustness against multiple perturbation types. GBN consists of a gated subnetwork and a multi-branch BN layer, and each BN branch handles a single type of perturbation. Results were reported on MNIST, CIFAR-10, and Tiny-ImageNet. Though the idea and methodology are valid and of interest, some concerns regarding the experimental section remain after rebuttal discussions.
Decision: Reject