Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper studies the effect of data quality on adversarial robustness. Specifically, they focus on one measure of data quality (number of times there is a perturbation that is misclassified across training iterations). They study the effect of data quality on robust overfitting, robustness-accuracy tradeoffs and "robustness overestimation" (gap between strong and weak attacks). The main conclusions reported are that data quality as measured by their metric plays an important role in all three aspects, and a suggested takeaway is that we need data of higher quality to improve robustness. 
main_review: (Edited score post rebuttal)

Strengths: 
(i) This paper studies an important problem on the effect of data quality on different aspects of robust training. 
(ii) The paper starts with the intuitive idea that data quality should matter and attempts to make a systematic empirical investigation across multiple datasets. 
(iii) Overall, the paper is easy to read and the experiment details/results are clearly presented. 
(iv) The observation that different sets of points improve robust vs standard accuracy is quite interesting to me (though that wasn't the focus of the paper). 

Weaknesses: While the paper makes an interesting investigation, I worry that the conclusions/implications of the study are unclear and some inferences seem problematic to draw. 
(i) One claim the paper makes is that low quality data can be detrimental to robust accuracy. Concretely, if we remove points from the dataset, that would improve robustness. Looking at Figure 4, the cases where this happens are: CIFAR-100 with TRADES and Tiny Imagenet with TRADES. I am confused why the conclusions vary between TRADES and Adversarial training? How is the \beta parameter set in the TRADES experiments. The fact that TRADES and adversarial training differ in their trends suggests that the beta parameter that controls accuracy vs robustness is important. The paper mentions that the hardness is an "intrinsic" measure since the relative ordering doesn't vary much across methods. So is it true that removing the *same* points leads to different performance with TRADES and adversarial training?
(ii) Other than the (slightly questionable) claim that removing low quality data improves performance, I didn't find the other implications on robustness particularly surprising. Even in standard training, it has been shown that there are some "support vectors" (or prototypes) which effectively dictate the final model learnt, and the rest of the dataset does not matter as much. The paper seems to mainly replicate this for robust training. 
(iii) Computing the data quality measure: If I understand correctly, you need to compute the robust accuracy across the training checkpoints. Which attack do you use to compute this? Does it matter how strong the attack is?
(iv) What's an actionable takeaway from this work? Aside from the caveat of point (i) above on whether there is a reliable takeaway, I wonder how to actually operationalize the idea of using higher quality data? The data quality of each point seems to depend on the remaining points (since it comes from some ordering of robust accuracy), and computing this requires training the model on all the data. Can the authors please comment with any thoughts here?
(iv) Computing data quality for extra data: Can you use checkpoints trained on CIFAR-10 to evaluate data quality of additional data (for e.g. from Carmon et al. 2019) not present in the training set? Basically, this would involve computing the robustness at the new point (not in training) across different training epochs. If the authors could show that this improves performance over adding all the mined extra points, I would be convinced that there is something interesting here. Relatedly, how does this measure of data quality empirically differ from just logits for confidence (which was what was used to mine the extra data in Carmon et al. 2019). 

summary_of_the_review: This paper studies an interesting question about the effect of data quality on robustness. Unfortunately, I find the conclusions for robustness as emphasized in the paper either unsubstantiated (removing low quality data improves robustness) or difficult to make actionable. Nevertheless, there are some interesting empirical observations in the paper such as the difference between important points for standard and robust accuracy, the effect of data quality on robustness-accuracy tradeoffs which were not known previously. I apologize for the late review - there was some issue at my end and I realized the review didn't get submitted. I would really appreciate if the authors could respond to my questions above. Thanks!
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: **Few sentences summary**: the paper proposes an empirical study on how data quality impacts robust performance in the Lp-norm setting under three angles: robust overfitting (i.e. the difference in accuracy between the best and last checkpoints), robustness evaluation (i.e. consistency of the robust performance when trying various robust evaluations like AutoAttack) and clean/robust accuracy trade-off (i.e. the gap in performance between the clean and robust accuracies). They show that "high quality" data (selected with their proposed criterion) performs better than "low quality" data for these three performance metrics.

Regarding the **results** and **contributions**:
* The authors propose a quantitative definition of "quality"  based on the average training robust accuracy over epochs per sample.
* They show that "low quality" samples are better for standard training whereas "high quality" samples are better for adversarial training.
* Studies on 1) robust overfitting, 2) robustness evaluation and 3) clean/robust accuracy trade-off on the datasets CIFAR-10/100 and TinyImageNet for Adversarial Training and TRADES.
main_review: **Strengths**:
* The paper has a clear message that adversarial training and nominal training do not benefit from the same type of samples.
* Extensive experiments on CIFAR-10 to analyze the robust performance of "high quality" data (selected by their proposed criterion) under three angles commonly discussed in the Lp-norm community. 
* The paper is well written and very clear.

**Weaknesses/Suggestions/Questions**:
1) **Main Weakness**. It really lacks of an analysis in the extra data case. This case should be actually perfectly suited for the message of the paper as extra data for CIFAR-10 is known to be of lesser quality (as per the references in the paper). Similarly, recent works [1, 2] have proposed to use generated data in the Lp-norm case. The proposed quality criterion in the paper would be great to analyze the quality of the generated images compared to the original CIFAR-10 images.
2) In Figure 3, "with their labels predicted by a model", which model? This is a bit vague.
3) Figures 4 to 7. First, please put in the caption how the robust test accuracy is obtained. Against PGD-10, PGD-40? It is unclear. Second, all the first rows are labeled "PGD". I think you mean "Adversarial Training" as introduced by [3]. PGD is the optimization procedure and it also used on TRADES. So the naming "PGD" is misleading.
4) Typo: "can also be found in our Figure 1(a)" -> "can also be found in our Figure 1(c)" on page 3.

**References**:
1) Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, Timothy Mann. *Fixing data augmentation to improve adversarial robustness*. 2021.
2) Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, Prateek Mittal. *Improving adversarial robustness using proxy distributions*. 2021.
3) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu. *Towards deep learning models resistant to adversarial attacks*. 2017.
summary_of_the_review: Empirical study paper with an interesting message that adversarial training and nominal training do not benefit from the same type of samples. The paper could have gone more in depth by studying the extra data case which is commonly used in the literature and gets the SOTA results. Especially, this extra data case normally fits the message of the paper so it is a missing element in the paper.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a metric for evaluating the learning stability of data and point out that unstably-learned instances are of low-quality for adversarial training. Through extensive controlled experiments, this paper investigates the impact of low-quality data on three issues in adversarial training, i.e., robust overfitting, robustness overestimation, and robustness-accuracy trade-off. The experimental results show that removing the low-quality instances can mitigate the issues.
main_review: Strengths:

1.	This paper evaluates the learning stability of instances under various settings, which indicates that the estimation of quality for each data is almost accurate and consistent.

2.	This paper is well organized. The authors analyze the influences of low-quality data on the three issues separately, which empirically demonstrates removing the low-quality data can mitigate the issues.

Weakness:

1.	Calculating the quality of data is time-consuming and computationally expensive. The quality of data is closely related to a particular dataset. That is to say, when the dataset is updated such as adding some new data into the dataset, the quality of data in the new dataset needs to be recalculated. It should be a limitation for the practical use of low-quality data.

2.	Removing the low-quality data sometimes marginally improves adversarial robustness, but more often hurts the adversarial robustness and natural generalization. Therefore, the significance of the proposed low-quality data seems minor.

summary_of_the_review: Overall, this paper systematically study the influences of data quality on the three problems in adversarial training. However, I am skeptical about the practical values of the proposed metric for data quality.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper investigates the impact of data quality, measured by the proportion of epochs in which the model classifies a specific input correctly during training, on the robustness, generalization, and robustness-accuracy tradeoff of adversarially trained models.  Unlike with standard training, the authors find that more difficult inputs (lower quality inputs) can hurt adversarially trained models.  They find that compared to randomly removing data during training, removing low quality data can lead to higher robustness, less robust overfitting, less robustness overestimation, and less robustness-accuracy tradeoff.
main_review: Strengths:
- Interesting direction- I find this work very exciting since it contributes to our understanding of adversarial training.  Many works have demonstrated that adversarial training requires more data.  This work expands along this direction by observing how the quality of data impacts generalization of adversarial training.
- Good scope in experiments, significant results- The authors perform experiments on multiple datasets and adversarial training methods and the trends look consistent across methods.  Patterns discovered between data quality and properties like robustness, robust overfitting, and robustness estimation also look significant.

Weaknesses:
- In the main text, it say that results for WideResNet architecture are in the appendix, but when I looked at the appendix I couldn't find figures for WRN corresponding to the experiments in the main text.  I think adding some figures for WRN with gradually removing lowest quality vs random would also help show the generalizability of the observed trends.
- In section 3.2 related works, the authors state that prior works show that more data can be detrimental to adversarial training, but I don't agree that is the case.  I think prior works demonstrate that adversarial training benefits a lot from additional data.  For instance, Gowal et al. 2020 is cited to support the statement that additional data unrelated to the original dataset can hurt adversarial robustness, but Gowal et al. demonstrate that additional data always improves over the no additional data case.  There is also discussion of label noise in this section, but it isn't clear how label noise is connected to the idea of additional data and data quality.  Additionally, I think discussion of other works which measure notions of hardness and data quality for adversarial training can also be added to related works.  For instance, methods of measuring difficulty of adversarial examples used for curriculum adversarial training [1,2,3].  Recently there has also been a line of works discussing ways to measure the data quality of additional data generated by generative models for use with adversarial training [4, 5].


[1] Wang, Yisen, et al. "On the Convergence and Robustness of Adversarial Training." ICML. Vol. 1. 2019.
[2] Zhang, Jingfeng, et al. "Attacks which do not kill training make adversarial learning stronger." International Conference on Machine Learning. PMLR, 2020.
[3] Cai, Qi-Zhi, Chang Liu, and Dawn Song. "Curriculum adversarial training." Proceedings of the 27th International Joint Conference on Artificial Intelligence. 2018.
[4] Sehwag, Vikash, et al. "Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?" arXiv preprint arXiv:2104.09425 (2021)
[5] Gowal, Sven, et al. "Improving Robustness using Generated Data." arXiv preprint arXiv:2110.09468 (2021).
summary_of_the_review: I vote to accept this paper since I find the empirical contributions significant; the authors rigorously study the impact of data quality on various properties of adversarially trained models including robustness, robust overfitting and robustness overestimation, and robustness-accuracy tradeoff.  I think the discussion of related works can be improved though.
review_title: null

Meta-review: This paper studies the effect of data quality on adversarial robustness. It focuses on a single measure of data quality (number of times there is a perturbation that is misclassified across training iterations). The authors study the effect of data quality on robust overfitting, robustness-accuracy tradeoffs and "robustness overestimation" (gap between strong and weak attacks). The main conclusions reported are that data quality as measured by their metric plays an important role in all three aspects, and a takeaway is that data of higher quality may improve robustness. While the reviewers appreciated the premise of this work, some concerns remain post rebuttal. For example, few reviewers remain skeptical of the universality of the notion of "data quality" as measured in the paper because different training methods behave differently and the data quality measured in the paper is tailored to a particular training algorithm. Some reviewers also opined that at least one of the practical implications discussed in the rebuttal should be systematically investigated and that it is important to study the effectiveness of different data quality measures, especially for the extra data. Given all this, we are unable to recommend acceptance at this time. We hope the authors find the reviewer feedback helpful.
Decision: Reject