Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: 
The author addressed my concerns. I’ll keep the score 6.

=======================

Summary:

The paper studied the relationship between adversarial robustness and calibration, then use the findings to improve label smoothing method. An adaptive label smoothing method (AR-AdaLS) is proposed to improve the calibration performance. Combining AR-AdaLS and deep ensemble can further improve the performance of deep ensemble method.

Strength:

1. The idea is novel and easy to understand. Experiments show the positive relationship between high adversarial robustness and better calibration. This work connects two field of studies.
2. AR-AdaLS improves the performance of label smoothing. AR-AdaLS can also be used to improve deep ensemble.
3. Improving calibration of deep neural networks is an important task.

Weakness:

1. Comparing the performances of LS and AR-AdaLS on CIFAR100 and CIFAR100-c, the improvements are actually not significant on CIFAR100, but AR-AdaLS is more computationally expensive. AR-AdaLS (on-the-fly) generates adversarial examples during training. This is very computationally expensive and will restrict the ability of the method to scale up to large dataset.
2. AR-AdaLS does not perform better than deep ensemble, which is the state-of-the-art (claimed by the author).
3. Three datasets are used in the paper but it seems that not all datasets are used to compare the performances of proposed model and other baselines.


Clarity and Correctness:

The paper is well written and easy to follow. The experiments look convincing. Boxplots comparison of ECE on CIFAR10 and ImageNet are provided.

Reproducibility:

Details of training and pseudocode is given but code is not available.

Questions:

The comparison of performances of ensemble models on CIFAR10 is provided but the comparisons on CIFAR100 and ImageNet are not. Why is that?

Conclusion:

The idea is novel and interesting but the empirical performance is not outstanding. Overall, I'm ok to accept the paper. I like the idea of using adversarial robustness to improve calibration. This paper reveals some interesting connections between the two things. 

review_title: Improving Calibration with Adversarial Information

final_score: rating: 2: Strong rejection
review_content: The authors propose an extension to label smoothing, where the smoothing parameter is determined based on the miscalibration of the validation set. They then compare the performance of their method in terms of calibration under domain shift to a small set of baselines. 

I have 3 main concerns regarding missing baselines, missing experiments and only marginal benefits over state-of-the-art.

My first main concern is that the authors limit their comparison to rather dated baselines (2018 and older), when there has been a lot of active research in this field in the past year. In particular, I am disappointed that while the authors cite recent work on MixUp showing its benefits for calibration (Thulasidasan et al., NeurIPS 2019) they do not include MixUp as baseline (where also inputs are smoothed rather than labels only). Other notable recent work that should be included as baseline is Verified Uncertainty Calibration, Kumar et al., NeurIPS 2019, which has been shown to be superior to Temperature Scaling.  In addition, a baseline which also exploits links between calibration and adversarial, Stutz et al., ICML 2020, should be included as prior work.
Another aspect of the presented work is the exploration of constructing an ensemble of neural nets trained with label smoothing. In light of this, it is crucial to also compare the presented approach to Mix-n-Match, Zhang et al., ICML 2020, who present work on ensemble methods for uncertainty calibration using label smoothing. 

 My other main concern is a whole set of missing experiments investigating calibration in truly OOD scenarios. Snook et al, on whose work this paper heavily builds, point out that in addition to the domain drift scenarios explored by the authors, it is crucial to investigate performance in truly OOD scenarios, where the test data is drawn from a distribution far a way from the training distribution. Since the model is per definition not able to make a correct prediction, in this scenario entropy is used to quantify model the quality of the predictive uncertainty. The authors should add these experiments for all datasets. 
In this context, it would also interesting to investigate the quality of predictive uncertainty of OOD detection methods. While such comparisons are not always meaningful, a model strongly related to label smoothing/MixUp is Hendrycks et al., ICLR 2019, where a GAN is trained to learn OOD samples, where in MixUp inputs are smoothed to generate OOD samples. A comparison to this approach would also be interesting. 

Finally, even though important baselines as well as experiments for truly OOD scenarios are missing, benefits over a simple ensemble of vanillas remain unclear. For large-scale data (i.e. Imagenet), ensemble of Vanilla perform consistently better than the proposed method in terms of ECE under domain shift. For CIFAR-10, performance is comparable to deep ensembles and only for AR-AdaLS of Ensemble for CIFAR-10 there is a marginal improvement for a subset of perturbation strengths. I would have liked to see also evaluation of ECE under domain shift for CIFAR-100 and SVHN. Also missing is an evaluation of AR-AdaLS of Ensemble for Imagenet. Finally, results for non-image data, e.g. using a recurrent architecture (as in Snoek et al) are missing. 

Other concerns and open questions include: 
Although the authors explain the hyperparameters they use in the appendix, a detailed sensitivity analysis is missing to understand how sensitive the method is with respect to alpha and R. 

The authors use „Ensemble of Vanilla“ as baseline - however, Snoek et al. have shown that it is actually deep ensembles that perform best; in addition to the ensemble effect they are also trained using adversarials. What is the performance of actual deep ensembles rather than ensemble of vanilla?

A conceptual concern is that in the proposed approach the validation set becomes part of the training set since it is used during training to update epsilon and thus is not anymore the independent set that may be necessary to tune other hyperparameters/for early stopping; I wonder whether this data leak may lead to problems related to overfitting?

Please report a proper scoring rule in addition ECE (e.g. Brier score).

A minor point ist that different colors are used for AR-AdaLS  and Ensemble of Vanilla in figure 3 and figure 4.

Unfortunately the authors do not provide any code, which make reproducibility difficult. 



####post rebuttal####
The contribution of this paper is marginal only. The link between adversarial robustness and calibration has been explored previously: Snoek et al. NeurIPS 2019 have shown that adversarial training as part of deep ensembles leads to better calibration under domain shift. Unfortunately the authors do not compare their approach to these deep ensembles, but only an ensemble of differently initialised vanilla networks without adversarial training, which they call deep ensembles (section 5.1). Also in terms of label smoothing the contribution is marginal: in their rebuttal the authors show that MixUp training - a different implementation of label smoothing combined with input smoothing - has a better performance than their method (ECE of 1.8 MixUp vs 2.3 their method for CIFAR-100); they do show that further post-processing improves their method, but this is likely true for MixUp too (results not shown). For ImageNet results for MixUP are not shown, nor for calibration under domain shift where MixUp is likely to perform well too.
 Taken together, this suggests that the link between adversarial robustness and calibration is mainly a link between OOD samples and calibration: generating OOD samples with input smoothing in MixUp works very well compared to the proposed approach, as does adversarial training in deep ensembles (both of which was shown in prior work). In summary, the proposed approach lacks novelty and performs worse than baselines for complex datasets.

Lack of code during the reviewing phase means it is not possible to review reproducibility of results.
review_title: Missing baselines, incomplete experiments, only small and unclear benefits

final_score: rating: 5: Marginally below acceptance threshold
review_content: ### Main contribution
1. The author find that unrobust data may cause worse calibration.
2. This work propose to encourage models to be adversarial robust to help calibration with a modified version of label smoothing: AR-AdaLS

### Clarity
1. The introduction of the backgrounds for uncertainty estimates is not very clear
2. The proposal of AR-AdaLS is clear and reasonable
3. The argument of "that unrobust data may cause worse calibration" is not fully demonstrated in Sec 3. 

### Questions
1. In adversarial learning area, people usually refer "robustness" for models rather than data. We can say a model is robust or not. But it is a little bit confusing when you apply the term on data. Can the author provide references of other canonical works that also use this phrase?
2. In Sec 3, the author stated they consider adversarial perturbation δ as a measure of robustness. Then why bother to divide the data into ten sets based on δ in your most import illustrations, which is Fig 1. What will happen if you directly present the relationship between δ and score? Does the 10th set represents the most robust data or does the 1st set do?
3. What conclusion can we draw from the first row of Fig 1? How does it relate to the argument that "the model is sensitive to small perturbations are more likely to have poorly calibrated predictions"?
4. I am familiar with the area of adversarial robustness and out-of-distribution detection, but not very confident about uncertainty estimates. I also did not find any specific introduction or helpful information in Sec 2. It seems to me that this area is not very popular and you can only compare your method with a few of other works, most of which are not even proposed for calibration in the first place (Label Smoothing/Mixup/Temperature Scaling). So can the author illustrate how the area of CALIBRATION differs from OOD detection? What is the most important evaluation metric for this problem? And maybe tell me which one is the most canonical work in this area so that I can refer to it as a comparison.

I will raise my score if the author can fully address my questions.
review_title: Good motivation, some parts remain unclear

final_score: rating: 7: Good paper, accept
review_content: Summary: This paper proposes a new method (AR-AdaLS) for label smoothing to improve deep network calibration. In particular, the authors draw a connection between lack of calibration (overconfidence) and examples which are prone to adversarial attacks. They show that by generating smoothed targets based on the adversarial robustness of an example, they can further improve model calibration beyond traditional label smoothing.

Pros: The paper demonstrates a clear connection between per-example calibration error (in general, overconfidence) and a lack of adversarial robustness. 

Method and results are clear and seem to be well situated in the literature.

They demonstrate the outperformance of their method relative to Label Smoothing in calibrating across several datasets, model architectures, and domain shifts. 

Cons: I'm not an expert in this field, but the novelty of the adversarial robustness - overconfidence connection is not entirely clear to me. Muller et al. describe the behavior of label smoothing as necessarily reducing the difference between logits of two classes and thereby the confidence of the prediction, particularly for outliers. This would seem to be the same effect you describe, but perhaps less explicitly.

The methods used as baselines, label smoothing and temperature scaling, are attractive for their simplicity and ease of training. While you note that your model has the same latency at inference, it seems important to know how much extra computation is required in training.

The improvement of AR-AdaLS relative to vanilla ensemble (and ensemble vanilla relative to AR-AdaLS of ensemble) is meaningfully different for ImageNet. You mention this may be due to larger dataset/less overfitting but it would be useful to better understand this - how do other forms of regularization relate to AR-AdaLS?

I find the discussion of Figure 5 somewhat unsatisfying - it's not entirely clear to me why averaging the predictions of 5 well-calibrated models results in a miscalibrated model

What is sensitivity to hyperparameter R? 

Minor:

Complementary, not complimentary

In related work: multiclasss
review_title: a useful connection and compelling results but not fully explored

Meta-review: This paper improves calibration of neural networks by investing its connection to adversarial robustness. Two reviewers suggested acceptance, and two did rejection. As the authors and some reviewers highlighted, AC also agreed that the correlation between adversarial robustness and calibration is interesting to explore. However, as R1 pointed out, AC also thinks that the experimental results are not strong enough to meet the high standard of ICLR, e.g., Mixup often outperforms the proposed method (without further post-processing) and the proposed method does not outperform the deep ensemble (although deep ensemble is expensive and both method can be combined). Due to this, AC doubts whether adversarial robustness is indeed the best way to improve calibration (it can be useful though). Hence, AC recommends rejection.
Decision: Reject