Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: In this paper, the authors introduce SWEEN, an ensembling scheme for smoothed classifiers. This scheme uses pre-trained models and learns the weights used to sum the output predictions. During deployment, smoothed models rely on sampling a large number of input perturbations and ensembling exacerbates the computation burden. Hence, the authors also propose an adaptive scheme that automatically adjusts the number of samples.

Overall, the paper is well-written and provides solid evidence that ensembling can improve certified robustness.
1) In the experiments, the authors focus on SWEEN-3/7 with standard training and SWEEN-3 with MACER. Have the authors tried SWEEN-7 with MACER? (or simply to add the ResNet-110 to the SWEEN-3 ensemble). I am generally curious about the limits of the approach.
2) While the adaptive scheme is useful, it distracts the reader from the main message. I'd suggest moving it to the appendix and consider experiments on ImageNet.
3) The wording is slightly unclear on how exactly the ensemble weights are trained. From the supplementary material, I gathered that the weight are trained to minimize the cross-entropy loss on perturbed inputs (perturbed by Gaussian noise) - as done for "standard training". Is that correct?
4) It is unclear why the $\gamma$-robustness index needs to be introduced to demonstrate that SWEEN can be trained to near-optimal risk with a surrogate loss.

Details:
A) Fig. 1 is not color-blind friendly and difficult to read (small font).


---------
Update post-rebuttal: Thank you for addressing most of my comments. The new results on ImageNets are greatly appreciated too. However, in light of other reviews, I would have hoped that the authors try better training procedures on SWEEN-7 (e.g., MACER even if it means using other ResNets instead of VGG), as otherwise it is difficult to judge whether ensembling really helps. It is unclear why MACER was not used on ImageNet (since all models are ResNets). Overall, the work explores a really important direction of research, but could benefit from further improvements.
review_title: Initial review

final_score: rating: 6: Marginally above acceptance threshold
review_content: In this work, the authors study the effect of ensembling on randomized smoothing certification.  By learning diverse classifiers and then applying randomized smoothing the authors arrive at an ensemble of smoothed classifiers. Predictions are then made based on a linear combination of the models outputs which are weighted based on empirical risk and robustness of each model. The authors make an argument for the optimality of the proposed approach and show that it performs favorably compared to randomized smoothing certification of only a single model.

While I can confirm that the notion of certified robustness that the authors propose in (6) is sensible and sound in terms of probabilistic guarantees of robustness, it is not clear to me exactly how Theorem 2 is the consequence of a using the proposed SWEEN model and not a property which is generally true of ensembles. Using a linear combination of models based on their empirical risk seems to be something which one could do in general, just that in theorem 2 the authors are using a notion of risk which also includes the certified robustness of the models. Perhaps I have missed something here. Given some time, I will read further into the exact details in the supplementary which I was unable to do sufficiently during the initial review period. 

The results that the authors show for their models are favorable and show increased robustness wrt the adversarial smoothing criterion. I wonder if the authors have any results on adversarial attacks (e.g. FGSM, PGD) as there is some notion that using a diverse set of models can lead to a more robust predictor wrt attacks [1] but then there is evidence that for deterministic ensembles this may not be the case [2].

[1] https://arxiv.org/abs/2002.04359

[2] https://nicholas.carlini.com/papers/2017_woot_ensembles.pdf


Post rebuttal response:

I thank the authors for their response to my review and I take their point that establishing theorem 2 points to a limitation of using smoothing with ensembles, but I think this point could be made much more clear in the main text. Following a reading of all of the other reviews and re-evaluating the paper I remain optimistic and slightly positive about the paper as I think it is an important and interesting research direction; however, I am not fully convinced to increase my score given that some of the empirical comparisons could be greatly strengthened to be more than marginal improvements over MACER trained networks. I think that any insights that arise during the process of strengthening the results would contribute to a better understanding of the method and a stronger paper. 
review_title: An interesting finding for smoothing based certification

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper demonstrates the advantages of ensembles of smoothed classifiers to achieve better approximately provable robustness.
Theoreotically, it proves that under certain conditions, given enough amount of individual models, the function which the ensemble model represent can be archibitarily close to the optima within a function class. Empirically, the ensemble models have better performance in approximately provable robustness than an individual model of even more trainable parameters.

--Novelty and Contribution

Pros:

1. It is well known that adversarial robustness needs higher model capacity, so ensemble model can improve empirical robustness. Although not surprising, as far as I know, there is no prior work investigating ensemble in the context of randomized smoothing. 

2. The experimental result shows ensemble models can really improve the robustness. The results on CIFAR10 and SVHN is comprehensive. The authors also show that adaptive prediction ensembling can accelerate the computation.

Cons:

1. There is a significant gap between theoretical analysis and experimental settings. Based on the condition above Equation (25), both the number of individual models and the number of training samples are trivially large. Theorem 2 should also emphasize the need of sufficient training samples.

2. One assumption of Theorem 2: $l(0, y) = 0$ might be inconsistent with the practice. The most popular loss function is cross-entropy loss, which does not meet this assumption. I notice that this assumption is first used in Lemma 8 to prove Theorem 3. Removing this condition might result in a negative term on RHS of Theorem 4. I think the author should discuss on this assumption at least.

3. It is better to have results on ImageNet or its downsampled version,  like [Salman 2019].

--Presentation

Pros:

Generally, this paper is well-written. The notation and formulation are easy to follow.

Cons:

1. The author should discuss more about the condition to finish the loop in Algorithm 1. This part is not well-justified. Especially, the authors should point out what is new in Algorithm 1 compared with [Inoue 2019].

2. It is better to make an algorithm box demonstrating the whole method.

--Summary

From my point of view, this is a borderline paper. It systematically study the ensemble of randomized smooth models and demonstrate interesting results. The idea and the algorithm itself is somehow not intriguing.
review_title: An Interesting Work but Need Some Edits

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper claims that an ensemble of multiple classifiers can achieve better certified robustness than a single model with comparable cost in terms of the total # parameters. It also proposes to optimize the ensemble weights for maximizing the robustness, and an adaptive prediction scheme to reduce extra # inferences from the ensemble computation required for the certification. Experimental results show that their proposed ensemble models (which are smaller than ResNet-110 in total) achieves better ACR than standard training with ResNet-110, and comparable ACR when applied to MACER. 

Overall, the paper is clearly written and easy-to-follow. However, I generally feel both the theoretical and empirical results of the paper are somewhat weak to meet the ICLR bar for the current submission:
- It seems to me that Lemma 1 and Theorem 2 are somewhat straightforward (or incremental) implications of the (well-known) generalization theory (e.g., [1]), and I could not find a significant reason why they should be presented in the main text. The paper could highlight why those results are surprising compared to existing generalization bounds.
- I think Algorithm 1, on the other hand, should be rather justified more rigorously instead of SWEEN itself: "could Algorithm 1 really recover the MC estimate?", or "is there a theoretical guarantee that this algorithm is more efficient than MC?", just to name a few. Also, the paper should provide more detailed explanation and rationale on Algorithm 1.
- The empirical results are not fully convincing to show that model ensemble reliably improve robustness: the paper only present two specific configurations of ensemble, namely SWEEN-3 and SWEEN-7, but there should be much more combinations to verify the effectiveness of ensemble. Also, I feel the results on MACER ensemble (Table 2) are too marginal.

[1] Kawaguchi et al., Generalization in Deep Learning, 2017.

Minor comments
- p4, "the volume of the certified region are more comprehensive ... ": then why the volume measure was not considered for evaluation in the experimental results?
- p5, "... will require 10,010,000 local evaluations ...": it would be a bit confusing for some readers to figure out why it requires additional 10,000 inferences in the count. I guess it is from a rough prediction cost in the CERTIFY algorithm, but I could not find any related explanation of this in the paper.
- Could SWEEN further improve ResNet-110 if one consider ResNet-110 x 3 ensemble model?
- Why SWEEN-7 is not considered in Table 2?
review_title: Official Blind Review #1

Meta-review: The paper considers ensambling of smooth classifiers to improve certified robustness. Theoretical results are provided showing that taking ensambles of a large number of models is useful, while experiments show that combining only a small number of models improves performance. On the negative side, the experiments are somewhat inconclusive, as the base models are not state-of-the-art, and the combined results do not achieve state-of-the-art performance. In  this respect, further studies would be necessary to explore the effectiveness of the proposed technique.

In summary, while the topic of the paper is interesting and timely, the proposed ensambling technique is not especially exciting (as it is what one would naturally expect). On the other hand, the problem is reasonably well investigated (e.g., details are worked out well, both theoretical and experimental results are presented), although further experiments are needed (as recommended by the reviewers) to properly assess the potential and limitations of the approach. Accordingly, all reviewers agreed in the discussion that this is a borderline paper. Therefore, unfortunately, it cannot be accepted this time due to the heavy competition at the conference. The authors are encouraged to resubmit a revised version to the next venue, taking into consideration the reviewers' recommendations.
Decision: Reject