Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper describes an adversarial training approach that, in addition to the commonly used robustness loss, requires the network to extract similar representation distributions for clean and attacked data. The proposed method is inspired by domain adaptation approaches that require a model to extract domain invariant/agnostic features from two domains. In the context of this paper, the two domains are the clean and adversarially perturbed images, and the network is required to extract domain invariant representation. To achieve domain invariance, the authors propose a domain classifier ( i.e., an adversarial network) that discriminates the representations from clean and attacked images. The feature extractor is then required to generate features that fool the domain classifier. The authors then provide extensive experiments on small-scale benchmark datasets (SVHN, CIFAR10, CIFAR 100, and MNIST in the supplementary material ) to show the robustness of their proposed approach against the state-of-the-art robustness methods under white-box and black-box attacks. The authors show that their proposed method provides: 1) higher accuracy on attacked data (more robustness), and 2) higher accuracy on clean data, closing the gap between the performance on clean and attacked data. In addition, the paper provides insightful experiments on robustness to unforeseen adversaries, robustness to unforeseen corruptions, transfer learning, and ablation studies.


main_review: **Strengths:**

* The idea is simple, yet it leads to significantly more robust networks
* The paper is well written, and it is easy to follow
* While the experiments are only carried out on smaller scale datasets, they are thorough, and they support the claims of the authors


**Weaknesses:**

I don't see major weaknesses in the paper. Below are some minor points.

* DIAL-AWP comes out of the blue in Table 3. For the sake of consistency, I suggest adding it to Tables 1 and 2 as well and providing the formulation (for self-sufficiency).

* The TSNE plots in Figure 5 for clean and perturbed distributions seem to have been calculated separately, which means that we are effectively looking at two different embedding spaces when we look at (a) and (b). I suggest that the author append the clean and perturbed representations, calculate the TSNE embedding jointly, and then plot them into their corresponding plots.

**Additional Comments/Questions:**

* In your KL robustness loss you have,
 $$ \mathcal{L}_{rob}^{KL}=\frac{1}{n}\sum_i KL(G_f(x'_i;\theta_f)||G_f(x_i;\theta_f))$$
My understanding is that $G_f$
 is your feature extractor, and $G_f(x'_i), G_f(x_i)\in \mathbb{R}^d$  are not probability vectors, this is while $KL(\cdot||\cdot)$ is a dissimilarity measure defined only for probability distributions. Could you comment on this? Also, wouldn't a simple MSE work fine here?

* This might be a matter of style, but it could be helpful to add equation numbers to your equations.

* Typos:

  * Page 3 second paragraph: "belongs to the the family"
  * Page 5 second to the last paragraph: "the initial learinnig"

summary_of_the_review: **Overall assessment:** The paper is well-written and easy to follow. While the main idea of learning domain invariant features is simple, its use in the context of robustness against adversarial attacks seems to lead to a significant performance boost. The experiments and, in particular, the ablation study section is insightful and aligned with the paper's claims. I think the paper is above average, and therefore I would like to vote for its acceptance.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: In this paper, DANN is leveraged to generate domain invariant and robust feature representation. The authors claim that the proposed method outperforms other methods when the target domain is the adversarial examples.

main_review: + The paper is easy to follow and the idea is straightforward.
- The experiment section is not comprehensive. Only a few methods are included in the comparison. More recent SOTA methods are missing.
summary_of_the_review: + The paper is easy to follow and the idea is straightforward.
- The experiment section is not comprehensive. Only a few methods are included in the comparison. More recent SOTA methods are missing.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes DIAL to learn domain-invariant representations for clean and adversarial examples to improve model robustness and clean accuracy. The main idea is to treat the problem as a domain adaptation problem by considering the data shift between adversarial and clean distributions, and then use the generative adversarial network (GAN) principle to tackle this data shift.
main_review: Pros:

(1) The paper is clearly written and easy to follow.

(2) The motivation behind is very intuitive.

(3) The paper conducts extensive experiments including multiple-$\ell_p$-norm adversarial perturbations and unseen corruptions.

Cons:

(1) My biggest concern is the novelty of this paper. Though showing promising performance, the idea of learning a feature extractor to minimize the distance between adversarial and clean distributions/domains has been widely studied and adopted before in the domain adaptation (DA) literature. In this paper, the author just simply introduced several DA loss terms and used the GAN framework to learn a more robust model. The experimental results are persuasive, however, the approach is too simple and not novel enough.

(2) Some minor problems. I cannot find your paper in the autoattack leaderboard as you mentioned at the first line in Page 7.
summary_of_the_review: I think the paper conducts extensive experiments to demonstrate the effectiveness of the proposed method, including some interesting ones, e.g., robustness against unseen perturbations, transfer learning (I like them). However, the novelty of this paper is insufficient, and using the domain adaptation principle and learning invariant representation has been widely studied. Therefore, I vote for rejection.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a domain invariant adversarial training (DIAL) method, which learns the feature representation that is both robust and domain invariant.  Apart from the label classifier, the model is equipped with a domain classifier that constrains the model not to discriminate between natural examples and adversarial examples, thus achieving a more robust feature representation. Extensive experiments on image classification benchmark the robustness compared to other state-of-the-art methods. 
main_review: This paper proposes a simple and effective adversarial learning method DIAL, which brings the idea from domain adaptation for robust representation. 

Strengths: 
1. This paper is well-written and easy to follow.
2. It conducts various experiments to demonstrate the effectiveness of the proposed method ranging from robustness to white-box attacks, black-box attacks, unforeseen adversaries, unforeseen corruptions and transfer learning. The experimental results are solid and technically sound. 

Weaknesses: 
1. From my point of view, the novelty of the methodology is not enough, as the domain classifier and the gradient reversal layer are the same with those methods in domain adaptation such as [1].
2. To better understanding the reversal-ratio hyper-parameter $r$, can the authors provides the robustness under different values of $r$.

[1] Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pp. 1180–1189. PMLR, 2015. 



summary_of_the_review: Overall, this paper proposes a simple and effective adversarial learning method DIAL for robust representation learning. Extensive experiments are conducted to demonstrate the effectiveness of the proposed method and provide solid results. However, the novelty of the paper is not significant as similar methodology exists in domain adaptation.
review_title: null

Meta-review: The paper describes an adversarial training approach that, in addition to the commonly used robustness loss, requires the network to extract similar representation distributions for clean and attacked data. The proposed method is inspired by domain adaptation approaches that require a model to extract domain invariant/agnostic features from two domains. Although the experimental results are solid and technically sound, the novelty of the methodology is not enough, as the domain classifier and the gradient reversal layer are the same with those methods in domain adaptation such as "unsupervised domain adaptation by backpropagation". On the other hand, more recent SOTA methods are missing and only smaller scale datasets are used for evaluation. During the discussions, the major concerns from three reviewers are novelty. 

I totally agree that the simplicity of the method should be a virtue. However, the idea of domain-invariant representation learning is already established well, and its application to adversarial training is quite intuitive to the community. Also, the similar methodology already exists in domain adaptation. According to the top-tier conference culture in the ML community, what most valuable is the novelty and insight, not the performance. In the end, I think that this paper may not be ready for publication at ICLR, but the next version must be a strong paper.
Decision: Reject