Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: The paper studies how a min-max framework can incorporate different tasks related to adversarial robustness. Specifically, the authors study adversarial attacks against model ensembles, universal perturbations, and attacks constrained by the union of Lp norms. They propose optimizing a probability distribution over "domains" (models in an ensemble, inputs, Lp balls; respectively per task) and regularizing it to be close to uniform. They perform experiments to evaluate their method.

From a conceptual point of view, I did not find the contribution of the paper significant. All of the tasks discussed are direct application of the min-max framework and have been studied to a certain extent in prior work (https://arxiv.org/abs/1811.11304, https://arxiv.org/abs/1706.04701, https://arxiv.org/abs/1904.13000). The novel tools introduced are the regularizer on simplex probability and the attack diversity regularizer. However, the theoretical justification for these tools is rather weak and their utility would need to be demonstrated empirically.

From an experimental point of view, the baselines considered are very weak. At a high level, the authors compare their version of min-max optimization to a very simple average-case optimization. In order to demonstrate the utility of the tools introduced the authors would need to at least compare to a reasonable min-max baseline. For instance, a very simple heuristic capping the loss of each domain in the finite-sum formulation (https://arxiv.org/abs/1811.11304) would be the bare minimum. In their current state, the experiments only demonstrate that a min-max approach outperforms an average case approach, which is fully expected. At the same time, the diversity regularizer does seem to offer some empirical gains and I would encourage the authors to investigate further.

Overall, the conceptual and experimental contributions of the paper are rather weak and I thus recommend rejection.

=========================
UPDATE: I appreciate the authors' response and additional experimental results. 

I am still quite concerned about the universal perturbation baseline. I suspect that the clipping factor used might be too large since clipping barely has any impact (the attack is still focusing too much on B ignoring C). Conceptually, clipping should be quite similar to a min-max formulation. 

I do see that the proposed method outperforms the one proposed in Shafahi et al in terms of universal adversarial training. I feel like this is a more reasonable baseline and I am increasing my score to a 3.
review_title: Official Blind Review #4

final_score: rating: 3: Weak Reject
review_content: Note: I applied a higher standard to this paper given that it significantly exceeds the recommended page limit. Furthermore, important details are left out in the appendices, which make it difficult to read the main body of the paper in a self-contained fashion. Given that the main body was already over the recommended page limit, I did not read the appendices.

This paper generalizes the min max formulation of adversarial training, and proposes a formulation that encompasses adversarial training of an ensemble, robustness to universal adversarial examples, and robustness to non-adversarial transformations. This formulation is used to derive an adversarial training procedure that trains against the worst-case adversarial example among adversarial examples generated by a set of attacks. Experiments seek to demonstrate applicability of this framework to both attacks and defenses.

As far as experiments are concerned, Section 4.1 presents results on MNIST, which is known to be a poor dataset to study adversarial examples on [https://arxiv.org/abs/1902.06705]. If models C and D are more difficult to attack, could better baselines be employed than attacking the ensemble A+B+C+D? For instance, would an adversary evading models C+D only perform better? It is difficult to draw insights that are generally applicable from a single ensemble. How was the ensemble chosen? Why would a defender add models which are known to be significantly less robust to the ensemble?

When discussing universal perturbations, how are they generated? Given that the performance of the proposed approach significantly degrades average evasion across all images from all groups, what is the threat model for an adversary being interested in group-level success rather than average evasion across all images from all groups? How were the values of K chosen? This comment also 	applies to experiments over data transformations. For these experiments, what was the value of K?

As far as the defensive perspective is concerned, it is not clear whether the improvements observed are statistically significant. Were multiple runs averaged to produce Table 4? Given that without DPAR, the improvement is negligible, this is important to interpret results. It appears that most of the robustness gains in both the average and max settings stem from DPAR. This should be clearly surfaced in the introduction and presentation of contributions if DPAR is required for the proposed generalized min max formulation to improve robustness. In particular, it is not clear whether DPAR is “a beneficial supplement to adversarial training” or a required supplement to adversarial training - per the formulation in this paper.


There are issues with grammar throughout the document, which make it difficult to read. Some specific issues:

1 - Adversarial attack is a tautology (an attack is always adversarial)

7 - What does “robust” adversarial attack mean?

7 - What is CAAD-18?

7 - Define ASR_all: what does evade mean here? Is the attack targeted or untargeted?

7 - What is an “advanced” DNN?
review_title: Official Blind Review #3

final_score: rating: 8: Accept
review_content: The paper presents a unified framework for adversarial training & robustness. The problem is important and interesting. The proposed framework has solid theory and is well conceived. A generic method is proposed with O(1/T) convergence rate, which is also empirically demonstrated with good performance on often-used MNIST and CIFAR-10 benchmarks. An alternating multi-step PGD is also proposed. Empirical experiments are thorough and well organized. Overall I feel it is a well written paper with sufficient contributions and is of interest to a range of ICLR audience.

review_title: Official Blind Review #2

Meta-review: This submission studies an interesting problem. However, as some of the reviewers point out, the novelty of the proposed contributions is fairly limited.
Decision: Reject