Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper studies the problem of consistency and calibration in the setting of classification with an adversary that perturbs the inputs during inference. The authors highlight the critical difference in the consistency and calibration between the standard setting and the adversarial setting. They show the widely used convex surrogate losses for 0-1 loss are no longer calibrated or consistent. They then provide detailed analyses to build the necessary and sufficient conditions for continuous loss functions to be calibrated in an adversarial setting. They further advance toward consistency in the adversarial setting by showing a weak result of consistency.
strengths_and_weaknesses: The originality of the work is sufficient as the studies of calibration and consistency in adversarial settings for general functions are missing in the literature to the best of my knowledge. 

The quality of the work is high as the authors provide detailed and solid analyses of calibration and consistency in the adversarial setting, including the difficulty and (potential) solutions to specific and general results.

The paper is well-organized and clarified, with sufficient background and preliminaries provided. I am not an expert in calibration and consistency but I was able to follow the analyses step by step.

Finally, I believe the result is significant as the calibration and consistency in adversarial settings are important problems that are able to guide the training of adversarially robust classifiers. This paper is able to move one step toward this goal.
questions: Is it possible to analyze the level of “divergence” of widely used loss functions such as the logistic loss from the 0-1 loss? And perhaps provide some empirical results to validate it. Such analyses would be extremely helpful to motivate people to rethink the loss function for adversarial training and potentially provide new insights.
limitations: The limitations of this paper have been adequately discussed at the end of Section 4.2.
review_title: null

final_score: rating: 9: Very Strong Accept: Technically flawless paper with groundbreaking impact on at least one area of AI/ML and excellent impact on multiple areas of AI/ML, with flawless evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper shows that the usual continous loss functions like hinge loss and logistic loss that are used to approximate the $0/1$-loss are not consistent nor calibrated for the adversarial $0/1$-loss.

It shows that a certain assymetry is necessary in order to have calibration and proposes shifted odd functions as candidates that are shown to fullfill them.

Finally, difficulties with and potential pathways towards consistent losses for the adversarial setting are discussed and related with some interesting theoretical results.

The paper does not contain any experiments.
strengths_and_weaknesses: The paper is generally well written and presented.

Showing that the standard losses for adversarial robustness training do not satisfy certain basic theoretical properties is an interesting and potentially important insight. The paper rigorously and comprehensively proofs these results.

I checked the proofs up until Proposition 3.1 and they appear to be correct, with the only issue for me being the definition of $\eta$, see below.

Figure 1 is very helpful for understanding Proposition 3.1; more similar illustrations for the other results would be very beneficial for the paper, if possible.

I think that the paper is a very interesting contribution to the field of adversarial robustness. 
The paper is generally well written but some details are missing for me (also due to me not being very familiar with the literature on consistency); I hope for clarifications on the questions below, particularly on $\eta$.

While the results are interesting and partly surprising to me from the perspective of adversarial robustness, I cannot say much about the novelty in the context of consistency and calibration literature which this work builds upon.
questions: The definition/interpretation of $\eta$ should be clarified. In Definition 2.4, it is the conditional probability of the ground truth being $1$ for a given input $x$. While it is stated here that this is the meaning "in this case", it is not defined otherwise in the rest of the paper.
It seems like $\eta$ is a function of $x$? If so, it would make things clearer if it was written as $\eta(x)$ or $\eta_x$. If it isn't, pleased clarify.
Since the ground truth may not be constant in the $\epsilon$-ball around a given $x$, it appears to be a problem that the statements and proofs for the adversarial settings seem to use one constant $\eta$ over the ball. For example, in Appendix E in the equation of line 512, $\eta$ appears outside of the supremum over $x'$.


In Definition 4.4, $x,x'$ and $y,y'$ should be defined more explictly. It would help to include an explanation of the definition, for which referring to "[12] Meunier et al.: Mixed Nash Equilibria in the Adversarial Examples Game" didn't help me either.

In l. 139, I think there is a sign error in the ramp loss, right?

In l. 354, is "anticipated" the correct word?

A question about alternative losses: Would using logistic loss (KL-divergence) for evaluating adversarially robust models be an interesting metric that would lead to fewer problems since one does not need a surrogate to train it?

A comment and potentially a discussion in the revision on the relation to the very recent "Frank et al.: The Consistency of Adversarial Training for Binary Classification (https://arxiv.org/abs/2206.09099) " which at first glance states some contradicting results would be very welcome.
limitations: The limitations of currently achievable results on consistency are described in detail.

The authors "believe there is no potential social harm" which is not a statement that is not obvious for any machine learning research, due to potential dual use and other general risks.
However, there is nothing specific that needs to be mentioned for this paper, and I agree with the authors as in my opinion a work like this has non-negative expected social impacts.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper studies the consistency and calibration properties of adversarial losses. Specifically, it defines an adversarial loss as the highest loss in a $\epsilon$-ball around data examples and find the sufficient and necessary conditions when an adversarial loss is adversarially calibrated. Furthermore, this paper also studies the consistency of adversarial loss. However, the obtained result in Prop 4.2 regarding the consistency seems weaker than expected.
strengths_and_weaknesses: * Strengths:
- This is a comprehensive study about the calibration and consistency property of loss functions in the context of adversary.
- The paper is generally well-written and easy to follow.

* Weakness:
- The gained results seem to have less impact on practical problems of adversarial attack and defense.
- There is no hint of how to utilize the gained results to improve adversarial robustness.
questions: 1) What are $x,x',y$ in the definition of $A_\epsilon(\mathbb{P})$?
2) In Cor 4.2 and Prop 4.2, does $\phi$ needs to be a 0/1 like loss?
3) Why does not $\epsilon$ exist in the sufficient conditions in Theorem 3.2? Does it mean that the conclusion holds for every $\epsilon$?
limitations: This is a theoretically comprehensive study. However, it would be much better if the authors give hints of how the gained results can be exploited to benefit adversarial attack and defense.
review_title: null

Meta-review: metareview: Reviewers have expressed strongly in favour of acceptance, one improving their score to very strong accept after the rebuttal and discussion. Congratulations! I’m delighted to recommend acceptance.
confidence: Certain
Decision: Accept