Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The authors investigate the relation between network width and adversarial robustness. There are some attempts to connect to some theory, but the results are largely empirical. 

main_review: - The main problem I find with the current paper is that the main message is not clear. There are some empirical comparisons based on the width of neural networks in relation to adversarial robustness, and some theorems based on previous results on Lipschitz bounds on neural networks. But the main novelty or contribution of the paper is not clear. 

- The only main message I could find is that increasing the width does not necessarily add to the adversarial robustness, contrary to the claims of some of the previous works. But this alone is not a very significant contribution. 

- There is a problem with analyzing the relation between natural accuracy and robust accuracy using equation 3.1. Equation 3.1 is based on accuracy, whereas in practice we always optimize a surrogate loss function such as the cross-entropy loss. The tradeoff in the optimization is not the direct tradeoff of accuracies, but tradeoff of their respective loss functions. Given the cross-entropy loss can be unbounded, the actual tradeoff might not be similar to equation 3.1. 

- The analysis of perturbation stability using Lipschitz constant in section 4 is not particularly new. And apart from stating the bounds, there is little insight on how the bounds affect the tradeoffs and relate to the empirical results. 
 
- The rest of the paper is on empirical comparison of width vs adversarial robustness. But without better connections to other parts of the paper they seem like standalone empirical results. 

- I believe the authors need to improve on the clarity of presentation of their paper, and state more clearly what their actual contributions are. 

limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper studies the connection between adversarial robustness and model capacity in the form of width. The key idea is to decompose robust accuracy into standard accuracy and stability---i.e., on what fraction of test inputs the prediction of the model cannot be changed by an adversary.

The authors find that while increased width tends to improve robust accuracy (as has also been previously observed) the gain are mostly coming from an improvement in the standard (test) accuracy of the model, while the stability of wider models is actually _decreased._ To counteract this phenomenon, they suggest increasing the regularization term corresponding to stability as the width of the model increases and indeed observe empirical performance improvements. The authors further support their hypothesis by theoretically analyzing the effect of width on robustness in an NTK setting and observing similar results. Finally, they propose a heuristic scheme for adjusting the stability regularization parameter during training and demonstrate promising results.
main_review: Overall, this paper makes a significant contribution on an important topic---we still do not fully understand the connection between capacity and robustness. The perspective proposed is simple and intuitive but at the same time appears to be quite useful for reasoning about the empirical behavior of wide models. I believe that these results will be of interest to anyone who cares about robustness.

Questions and comments to authors (not affecting score):
- Figure 1 and 3: What is epsilon/norm used for training and eval?
- Did you perform additional experiments with different norms and values of epsilon? Were the results consistent?
- L167 (and similar discussion in other places): In all three works mentioned [68,59,50], the underlying trade-off actually manifests as a stability-accuracy trade-off. Specifically, in [68, 59] the trade-off manifests because robust models cannot rely on predictive but unstable features, while in [50] the trade-off is a precisely a result of the requirement that the model's prediction needs to be stable around training points. Thus, while this discussion appears to be contradicting these prior works, it actually doesn't.
limitations_and_societal_impact: Yes, they do.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper discusses how the width of ResNets related to their robustness. They do adversarial training with a hyper-parameter for the strength of the robust regularization and show that making the model wider while keeping the hyper-parameter constant will increase clean accuracy but reduce the robust generalization. 

They define a new metric, perturbation stability, which is the rate of samples keeping their label prediction under adversarial attacks, even if the label prediction is wrong without pertubations. The authors connect this metric to the local Lipschitzness and use it to study how the width of a network affects it. They show that both through an analytical calculation and empirical results that the local Lipschitz constant increases with the width of a network.

In further experiments the authors show that wider networks need a higher weight on the robust regularization loss to get optimal robust accuracy, while previous work often optimized this weight for smaller networks and then used the same value after increasing the width. The results are verified for other datasets and architectures and finally the authors present a strategy to adaptively choose the hyper-parameter for wider models by first optimizing it on smaller models and then optimizing during training to achieve the same ratio between natural loss and robust regularization loss for the wider model that was optimal for the smaller model.

main_review: I think the paper is well written and gives a new perspective on adversarial training of wide networks. The authors do a good job of exploring the topic from different directions:
- Given a motivation why they suspect better tuned $\lambda$ on wider models would help improve robustness
- Giving analytical insight through the Lipschitz constants.
- Showing the improvement in robust accuracy through empirical results.
- Proposing a method to automatically tune $\lambda$ for wider models while training.

Because of this I think this paper should be accepted to Neurips.

Some things that could be improved:
- In line 64 and at later points the authors say that increasing the width of models while keeping $\lambda$ constant would decrease the overall robustness. I find the a bit inaccurate as robustness is usually looked at in terms of the robust accuracy and it (as the authors show in figure 3) usually increase with the width. I think the authors should clarify that they mean the perturbation stability. 
- The authors in their analysis in section 4 show that $\lambda$ should grow with $\sqrt{mH}$ but don't use that later on. Could this be an easier way to optimize $\lambda$?

Minor comments:
- Line 3 "it remains elusive how does neural network width affect model" should be "it remains elusive how neural network width affects model"
- Line 45 same as above
- The notation in line 81-82 seems unnecessary. The defined notation is very standard and other similarly standard notation isn't explained.
- Line 84 "tremendous work" instead of "tremendous works"
- Line 216 "increases with" instead of "increases as"
- Line 264 "90-th epoch as in" instead of "90-th epoch in"
limitations_and_societal_impact: The authors have addressed limitations and societal impact adequately.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: In this paper, the authors evaluate the impact of network width on the robustness of models trained through adversarial training. The authors (1) formulates robust accuracy as the intersection of natural accuracy and perturbation stability and show that there is tradeoff between them (2) theoretically show that increasing network width leads to higher local Lipschitz constant which leads to lower perturbation stability, (3) empirically show that networks with larger width need a larger robust regularization hyperparameter to perform well and propose a method (WAR) to tune this value.


main_review: Originality: To the best of my knowledge, the contributions of this submission are original. Prior works have indicated that adversarial training performs better with models of larger capacity, but the authors explore the impact of increasing the model width and empirically and theoretically show that this is not necessarily the case.  The authors do a good job of citing related works.

Quality: The quality of the submission is good.  The authors provide theory as well as rigorous experiments to show that higher model width leads to lower perturbation stability and the need for a higher robust regularization value.  The scope of these experiments is good, the authors experiment with multiple architectures (WideResNet, DenseNet-BC) as well as different adversarial training techniques (TRADES, Adversarial Training), datasets (CIFAR-10, CIFAR-100, Imagenet), and different attack methods.  For the section where the authors introduce WAR, I can only see experiments on WideResNet and what I think is the CIFAR-10 dataset.  I think the authors can benefit by also extending these experiments to different architectures and datasets as well.

Clarity: Overall the paper is clear, but the paper can be proofread for grammar.  Some comments:
- try to use in text citations (\citet{}) when using the citation as a subject or object in a sentence
- I think the first paragraph under section 3.1 can be placed with related works
- line 163: "unlearned model" --> "untrained model"
- last sentence of 1: "... such that the learned models cannot be easily perturbed for the sake of model robustness" --> this wording is awkward.  I think what is meant is that the models aren't fooled by small perturbations which in turn improves model robustness
- 171-173: "Works including [49] and [43] also challenged this robust-natural trade-off [59] does not hold for some cases" --> awkward wording and "does not hold for some cases" is very vague and can be elaborated on
- 173-174: "Therefore, we argue ... of this trade-off"-->  these 2 sentences should be 1 sentence joined by a comma
- 179-180: "Do they only help natural risk, to robust regularization, or maybe both of them." --> should be combined with the previous sentence and should be a question
- line 182: "explains why the" --> "illustrates how"
- line 183: "it still remains unclear what is the underlying reasons ..." --> "it still remains unclear what the underlying reasons are ..."

Significance: The results lead to a better understanding of how width impacts the robustness of neural networks.  The authors also propose WAR to finetune the robust regularization hyperparameter for models of larger width which maintains the same tuning time that is used in practice while improving robustness for these larger models.
limitations_and_societal_impact: I do not see any discussion of limitations.  A potential concern is how well WAR performs on other architectures/datasets.
review_title: null

Meta-review: The reviewers had raised a few concerns which were mostly resolved after the authors' response. All the reviewer agreed in the discussions that the contributions of the paper are important and interesting. Also, the reviews contain all the points mentioned in the discussions, so there is nothing more to add here. 
Decision: Accept (Poster)