Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper tries to fix the failure of the direct combination of federated learning (FL) and adversarial training, which is indicated by the deterioration of the adversarial accuracy at the later stage of FL. The authors proposed the so-called "alpha-slack" mechanism that upweights the clients with smaller (local) adversarial losses (and downweights the clients with larger losses) during aggregation in the cloud. The authors also show that the proposed mechanism asymptotically converges to the optimal solution of the modified adversarial objective. Extensive experiments are presented to show the effectiveness of the proposed method.
strength_and_weaknesses: Strength of this work is primally empirical. Firstly it seems to be the first empirical breakthrough in terms of combining FL and adversarial training, with plenty of supporting experiments showing the effectiveness of the proposed method. Secondly, it provides plenty of interesting and inviting observations in multiple dimensions, which I believe would be of interest for the community.

However, the technical novelty issue is critical. And the core of the novelty issue is that the proposed method looks simply a modified aggregation method that has nothing related to the adversarial training objective. It perfectly applies to normal FL with only natural samples. Let me be more specific.

From the perspective of the motivation, that is discussed in Sec 3.1, it is purely a conjecture/argument and there is neither qualitative analysis or quantitative evidence that actually supports the statement that the local adversarial optimization process indeed "exacerbate" the heterogeneity.

From the perspective of the algorithm, as I said above, the proposed method simply upweights updates from clients that have smaller local (adversarial) objective. It does not matter if the local objectives are adversarial or not. And the final form of the algorithm is *very* similar to the **FedSoftBetter** aggregation method proposed in [1], which reweights updates from clients using a slightly different metric but also depends on the local objective magnitude. The existence of this prior work, in my opinion, significantly undermines the technical contribution of this work. However, I do recognize that [1] is quite new and is only a preprint work. I am not sure how it should influence the evaluation of this submission. I would love to invite comments from other reviewers and discussion from the authors on it.

From the perspective of empirical results, the proposed method seems to be most beneficial in the natural cases in every experimental setting presented in the paper (in terms of final accuracy improvements). This observation further convinces my points above that the proposed method is not specific to adversarial training at all.

Lastly, which is more of a constructive comment instead of criticism, the authors only consider constant alpha in this work, which for sure changes the original global adversarial objective. A natural idea is to gradually decrease alpha during FL so that the objective would asymptotically get closer to the real objective. However, this is empirically contrary to the observation that FAT degrades at the later stage of training. So the investigation on this question is worthwhile and interesting.


UPDATE: sorry that I forgot to attach the reference above.
[1] Mansour, Adnan Ben, et al. "Federated Learning Aggregation: New Robust Algorithms with Guarantees." arXiv preprint arXiv:2205.10864 (2022).
clarity,_quality,_novelty_and_reproducibility: The clarity and quality of this paper is great. For the novelty please refer to my points in the Weaknesses part. Reproducibility is not applicable for now since the authors have not provided the source codes, while they promised to do so in the reviewing phase. I will update then. However, I think the proposed is simple enough and there should be no problem in reproducing the results.
summary_of_the_review: This work is empirically solid but technically weak because of the clear disconnection of the proposed method and the adversarial setting AND the prior work (FedSoftBetter) which is very similar algorithmically.

====

Update: after reading the authors' responses to my review and their discussions with other reviewers, I found my concerns have been mostly addressed. Therefore, I raised my score from 5 to 6.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper studies adversarial training under the federated learning framework. The current challenge in federated adversarial training (FAT) is that robust accuracy deteriorates in the later stage of training.  The authors believe this is due to the intensified heterogeneity caused by the inner maximization step in each client's local training step. To overcome this, the authors proposed $\alpha$-slack mechanism. To my understanding, this mechanism reweights the parameter update by its adversarial loss. The clients with lower adversarial loss is upweighted by $1+\alpha$. On the theoretical side, this paper shows the convergence property of the reweighted loss. Empirically, this paper provides extensive experiments and demonstrates the effectiveness of the proposed mechanism.
strength_and_weaknesses: Strengths: 1. The problem itself is interesting. This paper provides a simple and practical solution.
Weaknesses: 1.  To my understanding, this convergence guarantee is a variation of the standard federated learning, e.g. (Li et al, 2019) with an $\alpha$-slack variable. Theorem 3.2 and 3.3 are saying this algorithm is converging faster compared to FAT. This is not related to any claims about better robust accuracy or generalization, which is demonstrated through experiments.  It would be better to provide theoreical results showing better robust accuracy or provide empirical results showing faster convergence, which verifies the theoretical claim.


Question:
1. I am confused about the second figure in FIgure 5. It seems that the SFAT robust accuracy also decreases after 40 rounds. How is this figure different from Figure 1 (b)?

2. I understand that SFAT could achieve better overall robust accuracy compared to FAT. But for those clients that have large adversarial loss. My intuition is that these clients are down-weighted and would have worse performance than FAT. Is this true? It would be better to provide some experiments that verifies generalization performance through clients.
clarity,_quality,_novelty_and_reproducibility: I think the overall writing is clear and easy to follow. It would be better if the authors could provide more interpretations of the theoretical result, like how this is related to the experiment section. 
summary_of_the_review: This paper provides a simple and practical approach to mediate the robustness deterioration issue induced by intensified data heterogeneity.  I am not an expert on this topic so I could not evaluate the significance of the contribution. The effectiveness of the proposed method is thoroughly studied through experiments.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper studies the adversarial robustness of federated learning, which is an important problem when training the model on the client side. Specially, the authors consider the incompatible dilemma between federated learning and adversarial training, and introduce a mediating slack mechanism to better bridge two paradigms. Both theoretical analysis and empirical study demonstrate the effectiveness of the proposed methods. 
strength_and_weaknesses: In a nutshell, the authors investigate an interesting problem motivated by the degeneration observation, and the proposed method is solid with sufficient evidences. However, there are still some concerns regarding the submission as follows,
(1)	Although the combination of two paradigms lead to the degeneration in performance, the reason that induces this phenomenon needs to be carefully discussed, since all toy studies even including the analysis on real-world dataset are from the perspective of the observation, which cannot attribute to the real cause. For example, it is not absolute in Figure 2 where the generated adversarial examples move in the clockwise direction, instead of the converse direction. I advise the authors should properly express the conjecture in the motivation part.
(2)	Equation (1) introduces a lower bound to the original objective, which is different from the general way that constructs an upper bound to minimize. Therefore, it is not necessary that minimizing a lower bound can lead to the minimization of the original objective. The authors should discuss more here and give some empirical validation if it is possible. 
(3)	The background part gives some basics of federated learning and adversarial training, while the review of current works is insufficient. I advise the reviewer should follow the conventional style and separate this part into related work and preliminary, respectively for literature review and basics.
(4)	In tables 1-4, the natural accuracy and the robustness performance in the centralized counterpart can be validated as references, and the gap in comparison to the achieved performance in federated learning framework should be reviewed so that the readers can deeply understand the limitation in this topic.
(5)	Again, I think the explanation about the problem in the combination of federated learning and adversarial training should be improved. Possibly, if the authors can find some supporting examples from the experiments as the visualization or some statistical analysis can make the claim more convincing. I advise the reviewers to trace the classification difference between the baseline and the SFAT-enhanced counterpart and analyze the common characteristics of these non-overlapping examples. 
(6)	The discussion about the systematic challenges in federated adversarial training is limited, yielding that it is hard to evaluate the value of this narrow direction. More analysis about the practical requirement in the real-world applications should be given both in the introduction and related work as well as the confusion remark.

clarity,_quality,_novelty_and_reproducibility: The authors really conduct an impressive work and give a range of experiments and the corresponding theoretical analysis to demonstrate the advantages of the relaxing mechanism.
summary_of_the_review: My main worry is not about the observation and the proposed method, but about the motivation description and analysis is lack of some sufficient justification. Please carefully consider above concerns and improve the submission, and I can consider to raise the score if they are well solved.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper aims to mitigate the loss of adversarial accuracy at the later stage of FL, when directly combing federated learning (FL) and adversarial training. The authors proposed the so-called "alpha-slack" mechanism that upweights the clients with smaller (local) adversarial losses and vice versa during aggregation in the cloud. They demonstrated the proposed mechanism asymptotically converges to the optimal solution of the modified adversarial objective. Extensive experiments are reported.

Reviewers initially raised concerns regarding the clarity of motivation, the comparison to several prior arts, and a few more ablation studies. The authors provide a robust rebuttal that seems to satisfy everybody, leading to a positive consensus of scores. AC agrees and sees this paper a clear accept case.
justification_for_why_not_higher_score: The problem studied is slightly niche. 
justification_for_why_not_lower_score: No ground to recommend negatively - it's a clear accept case
Decision: Accept: poster