Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper shows experimentally that training on generated data (from a generative model not trained on external data) can improve adversarial robustness.  Surprisingly, even a class-conditional Gaussian generative model can improve adversarial robustness. The paper additionally provides sufficient conditions for generated data to help adversarial robustness.
main_review: The main idea (generated data for adversarial robustness) is a cool and potentially powerful idea. Unfortunately, this idea's execution in this paper has many issues. In particular, the theory part has some problems, both technical as well as not much insight beyond "better pseudo-labeling models help" and "better generative models help".

Specific issues:
 - The claim "Complementarity and diversity should improve robust generalization" is not evaluated/tested in section 3.2; only that generated data improves robust generalization.
 - Although the authors claim to prove the results, I cannot find them in section 4. Some propositions would make section 4 more clear.
 - In the theory part of the paper, script and non-script letters (e.g. W, X, S) are interchanged in an incorrect way.
 - I believe the indicator function notation used throughout the paper is incorrect (see wikipedia). Consider using Iverson bracket notation.
 - Condition 4 is either ill-stated or never true. The empty set will have measure 0 under \hat{\mu} even though the empty set is measurable. Furthermore, the statement "There must be a non-zero probability of sampling any point" is not true for any distribution with a pdf (such as Gaussians).
 - "original-to-generated ratio" should be something like "proportion of data that is original"
 - I think the complementarity and coverage metrics (table 1) aren't properly defined. For example, what does "To estimate complementarity, we report the proportion of samples with a nearest neighbor in either the train set, test set or the sampled set itself." mean? What other sets could the nearest neighbor be in?
 - The appendix in the main pdf is unfinished (many comments from the authors scattered around) which potentially breaks anonymity.

In summary, the core idea and main result are great, but I think the paper needs refinement, especially for technical statements.











limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This work shows that data augmentation using good generative models helps improve adversarial robustness. Various experiments are conducted to show the importance of the quality of the generated images. The proposed method achieves state-of-the-art adversarial accuracy on CIFAR-10 and CIFAR-100 datasets, while the clean accuracy is not sacrificed.
main_review: Pros
- The proposed method is simple yet works well empirically. It achieves about 3~4% gain on adversarial accuracy compared to the previous state-of-the-art, even though the clean accuracy remains the same or also improves.
- The paper provides thorough experiments to back up their intuition that the quality of the generated images is important.

Cons
- The proposed method is a simple combination of two well-known works, adversarial training and DDPM.
- The scalability of the proposed method is concerning. The experiments on the paper (e.g., Figure 5) show that whether the generated images help or not depends heavily on their quality. In fact, DDPM is the only generative method that provides notable performance gain. Therefore, would the proposed method work on more large-scale datasets such as ImageNet where generating quality images is much harder?
- Some of the experiments are misleading. The paper provides Figure 4 (b) and (c) to prove that the quality and the coverage of the generative model is important. To show this, the paper considers an ideal generative model which is able to sample from the test dataset. However, 'looking at the test dataset directly' is very different from 'matching the true data distribution'.
- The appendix is not the final version. In fact, it includes comments which seem to include the authors' names. I worry this might be a violation of the double-blind review process.

=============== Update ===============

I thank the authors for their thoughtful response. Most of my concerns are addressed. However, I keep the concern that the method may not be scalable, even though the authors provide some additional experiments on slightly larger images (64$\times$64). I suggest the authors to add ImageNet results on future updates. That said, I appreciate that the proposed method achieves surprising empirical performance on the considered datasets, and increase my score to 6.
limitations_and_societal_impact: Limitations
- Listed above

Societal Impact
- N/A
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper examines whether using additional generated data can improve the robustness through adversarial training.  They propose several conditions for generated data to best improve the performance of adversarial training and validate the impact of these conditions empirically.  They evaluate the performance of several generative models (DDPM, VDVAE, BigGAN, Class conditional gaussian) on improving robust performance and demonstrate that using samples from DDPM, they are able to outperform many models using external data in training.
main_review: Originality: The authors explore the possibility of using generated data to improve adversarial training which has not been explored before.  I think the contributions can be made more clear though since the generative models and adversarial training methods used are existing techniques.  For instance, I'm not very convinced that the second bullet in the contributions in the introduction is actually a contribution of this paper since DDPM has the lowest FID score. 

Quality:  The depth of the experiments is very good.  The authors propose several conditions which may affect the performance of how much generated samples can improve robustness and provide experiments to demonstrate.  Some comments on the experiments:
- In Figure 4, I was wondering if the results could also be put in comparison with the performance of the models with corresponding architecture trained without additional generated data.  When the conditions are not satisfied well is there a point in which using the generated data can harm robust performance?
- In Section 6.1 and Figure 4b, I was wondering if the evaluation on the test set also includes the test set samples included in the training.  In that case, it is not very surprising that increasing the test-to-generated ratio since those examples were also used during the training.
- Is there a relationship between FID and Inception score with coverage and complementarity that are being measured?  I think these 2 metrics should be explained in the text.
- Could a column be added to Table 1 to compare the adversarial robustness of training with the same amount of additional data from each set of augmented and generated samples to validate the use of coverage and complementarity in assessing how beneficial the dataset is for adversarial training?

Clarity: The writing is clear.

Significance:  I think the main significance behind using generated data is that adversarial training has higher sample complexity and gathering this extra data for training can be costly.  Training a generator on a smaller dataset and then generating the extra data needed is more feasible.  The authors demonstrate that this generated data is able to improve robustness.
limitations_and_societal_impact: Limitations are addressed well through section 4.2.  For a larger dataset such as CelebA or ImageNet, are current state-of-the-art generative models able to generate data with good coverage/complementarity to improve adversarial training on these datasets?
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper proposes to improve robustness of neural networks against adversarial attacks without using any additional data. For it, they make use of samples generated by a generative model as their proxy for additional data. They want the additional samples to be diverse enough, and list additional conditions needed for robustness to improve using generated data. Empiricall they obtain strong results, often performing better than the methods that use additional data.

main_review: Pros - 
I like the idea of using generated samples instead of using additional real samples. The better performance of DDPM compared to other generative models does suggest that better generative models should lead to better improvements.  The authors do a good job in explaining the idea nicely along with good ablation studies. The strong results do suggest the efficacy of the idea.

Cons - 

1. In order to truly realize the potential of the idea, the authors should try to test on other datasets for which it is difficult to easily get additional data. For example - some medical datasets or other datasets like DTD[1].

2. I don't agree with the 'Quality of Gnerative Models' paragraph in section 6.1. Using the test samples during training, should naturally improve the test set robustness. The authors should rather experiment with other datasets for which the generative process is known, such as CLEVER dataset [2] and show that as more samples are added from the true data distribution, the robustness increases.

3. It seems surprising that even with a low accuracy of the non-robust classifier, the robustness of the model increases. Can the authors justify/shed more light on this?

4. For Table 1 can you show results with stronger augmentations such as RandAugment.

[1] Cimpoi et al. Describing Textures in the Wild
[2] Johnson et al. Clevr: A diagnostic dataset for compositional language and elementary visual reasoning

[2] 


limitations_and_societal_impact: The paper works on making networks more robust which will have a  positive societal impact.
review_title: null

Meta-review: All reviewers agree that the paper should be accepted. In addition, the empirical results are strong (substantial robustness gains on CIFAR-10).

It was discovered late in the review process that this paper makes use of the 80 million tiny images dataset, which has been retracted (https://groups.csail.mit.edu/vision/TinyImages/).  Following the NeurIPS ethical guidelines (https://neurips.cc/public/EthicsGuidelines), this dataset should not be used.  For this reason, the paper is being conditionally accepted.

UPDATE: The authors have revised the paper to satisfy the conditions and it has now been officially accepted.
Decision: Accept (Poster)