Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper introduces a regularization method for neural networks, namely Noise Injection node Regularization (NINR). The high-level idea is to inject random noise into the network’s training at a certain layer via a learnable weight. The authors provide analyses both theoretically and empirically to show how NINR could improve the robustness.


strength_and_weaknesses: Neural network’s robustness is one of the most important topics in deep learning, so searching for a new regularization method that makes neural networks more robust to various kinds of scenarios such as distribution shift, adversarial attacks is definitely worthwhile. The paper presents an intuitively simple yet interesting idea motivated by mathematical and empirical insights. The experimental results are also extensive. 

Regarding the weaknesses, I have some comments:

1. The novelty of this work compared to Anonymous, (2022), which I do not have the full context into.
2. It is unclear from the experimental results whether this regularization approach is more useful than other well adapted ones. For example, in Table 1, Dropout is much better than NINR-based regularization for FC. In Table 2, L2 outperforms the rest for both FC and CNN.
3. I may be mistaken, but it is unclear which layer of the neural network one should apply the NIN regularization. If applied on multiple layers, would the same analysis in Section 2.1 follow and how?



clarity,_quality,_novelty_and_reproducibility: Additionally, I have some questions and suggestions:

* What do “uncorrelated input perturbation” and “certain window of convergence” in Page 2 mean?
* Equations (1) and (2) are the key to the rest of the analysis, but as a reader I am not sure I follow them easily. I would find a detailed derivation here or Appendix very helpful. Also, using W_{NI} weight as a vector (versus W^(l) as a matrix) is somewhat confusing.
* In Equation (6), \sigma^2_delta can be very small. How does it factor into R_2 when you say “dynamics is controlled by H_0”?
* How would the authors make sense of the performance gap between NINR applied to FC and CNN? E.g., a big jump in performance for full-NINR Catapult.
summary_of_the_review: I think this work has some merits, but I also have some concerns as given above.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper looks at a new method for adding gaussian noise to nodes during training such that the amount of noise added is a learned parameter. The paper, the does some theoretical analysis, to obtain some heuristics about the effect of the noise. This followed up by empirical work looking at the evolution of the norms of noise scaling parameter during training for different noise variances. Finally, the paper tests the robust of such networks to input data corruption. 
strength_and_weaknesses: **Strengths**
---

1) I like the study on the norm of the scaling during training versus the noise variance this provides nice insights into how to set the noise. The theoretical underpinning for this comes from the Taylor expansion of the loss function with respect to the scaling parameters. The paper looks at the terms with the first derivative and the second derivative and in some simple case (such as 2 layer linear networks) derive heuristics for estimating these terms. Using the heuristics, the paper divides the variance into various regimes depending on whether the First derivative term or the second derivative dominates. 

2) The proposed method seems to drastically increase robustness of Convolutional neural networks. 

3) The idea of having adaptive noise is interesting. I will list this as a strength (because I don't fully know the literature) but two papers cited by the paper (Rakin et al. (2018) and Xiao et al. (2021)) might have already proposed something similar. 

**Weakness**
---

I think the major weakness of the work is putting itself in context of the existing literature. Specifically, the works on adding noise to the input data being equivalent to regularization is known (Bishop 1995). Further, based on a google search there is a lot of work analyzing constant noise injection.  For example, Camuto, Willetts, Simsekli, Roberts, Holmes 2020; Poole, Dickstein, Ganguli 2014; and  Cohen, Resnfeld, Kolter 2019. While the authors do not need to cite these particular work, but more discussion on work related to constant level noise injection would be appreciated. 

Further, in the experimental evaluation the authors do not compare against constant level noise injection. Since the main novelty of the paper seems to be the adaptability of the noise level, I feel that the constant noise level is a crucial baseline. 
clarity,_quality,_novelty_and_reproducibility: **Clarity**
---

While most of the paper is well written parts of the paper could be better written. Specifically, 

1) NINs are introduced implicitly rather than explicitly. That is, the paper talks about their expansion before defining what an NIN is. 

2) The paper mentions that when $\mathcal{R}_1$ is big this induces a random walk. But it is not clear what is meant by this. I think it means a random walk for the norm of the scaling parameters. 

3) The paper in the introduction (first paragraph) mentions chaotic dynamical systems and represent SGD as one such chaotic system. However, the paper then proposes adding further stochasticity to the training to improve robustness. These two statements seem contradictory as the first would suggest, that this additional stochasticity would increase the variance of the model. However, the rest of paper never touches upon this. 

**Quality and Novelty**
---

While the theoretical work and experiments seems reasonable, the novelty is difficult to judge because of the missing context for the work. 

**Reproducible**
---

The paper seems to highly reproducible. 

summary_of_the_review: In summary, I like the idea, the analysis and the experiment, but I am concerned about the novelty and the presentation.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on robust representation learning and attempts to propose a method that is robust to input perturbations. To achieve this goal, the authors propose Noise Injection Node Regularization (NINR) which severs as a “regularizer”. Experimental results demonstrate in some cases, this proposed method outperforms models trained with Dropout or L2 regularization.
strength_and_weaknesses: Strength: 
The paper covers an interesting topic as robust representation learning is a challenging but practical problem, especially for robust image classification. The overall presentation sounds good.

Weaknesses:

1) I doubt the novelty of this paper. Injecting noises to the input or to the learned representation is not a new thing. There are already several papers covering similar topics, such as Ref1 and Ref2.

2) All experiments are carried out on very simple and easy datasets such as MNIST and FMNIST. Thus, it is not quite sure how reliable these results are and whether it is a safe way to draw conclusions from them.

3) Also for the comparisons, the authors only compare models with Dropout and L2 regularization. However, as the paper claims to learn a robust representation, the authors should consider comparing the proposed method with other robust models and other more complicated datasets such as MNIST-C and ImageNet-C for example.

4) Even on the simple dataset, the proposed method cannot consistently outperform models trained with Dropout. Thus, I do worry about the benefits of this proposed method can bring us.

5) There are some typos in the writing.


Ref1:  Liu, Aishan, et al. "Training robust deep neural networks via adversarial noise propagation." IEEE Transactions on Image Processing 30 (2021): 5769-5781.

Ref2: Rusak, Evgenia, et al. "A simple way to make neural networks robust against diverse image corruptions." European Conference on Computer Vision. Springer, Cham, 2020.


clarity,_quality,_novelty_and_reproducibility: As I mentioned in the [Strength And Weaknesses], the idea does not sound novelty and there are several papers that have already proposed a similar idea. The authors have provided the code, so the experiments may be reproduced.
summary_of_the_review: Based on what I have mentioned in the [Strength And Weaknesses] part, I have concerns about the novelty of this paper and also its experimental evaluation does not sound comprehensive.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This works studies the noise injection node approach and how it improves the noise-resistance to various types of data perturbations. 
strength_and_weaknesses: The major problem of this manuscript is its writing, which cites a lot of analytical results from Anonymous (2022). Unfortunately, I cannot find this reference from the web at all. This makes the current version of  this paper lack of self-containess. Thus, frankly, I cannot judge the novelty of this work. 
clarity,_quality,_novelty_and_reproducibility: See the above. 
summary_of_the_review: Due to the issue of self-containess, I cannot give the acceptance to this paper.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The authors consider noise injection as a regularization method in neural networks. The authors make, both, methodological and theoretical contributions. Experimental evidence shows that the proposed approach benefits CNNs among others. The authors addressed the concerns of the reviewers during the rebuttal phase. However, I would like to emphasize that the authors to should 1/ more clearly position their work compared to related work and 2/ clarify novelty as they did in the rebuttal given that several reviewers legitimately had concerns.
justification_for_why_not_higher_score: The work should have been better positioned wrt recent and less recent related work at submission time.
justification_for_why_not_lower_score: The authors adequately addressed the reviewers concerns.
Decision: Accept: poster