Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper develops a meta-learning approach for re-weighting samples for better adversarial robustness. In particular, they parameterize the weights using an additional module and learn it with the MAML objective. Through a comparison with previous work, they show that the proposed method improves model robustness on benchmark datasets.

main_review: 
Strengths:
- As for as I know, it is the first learning-based re-weighting strategy for adversarial robustness, compared to previous heuristic methods like GAIRAT.
- The paper is well-written and easy to follow. The proposed approach is methodologically sound. 
- The evaluation includes strong adversaries, like AutoAttack, and they show their reweighing does not suffer from performance degeneracy like GAIRAT.

**Major Concerns**:

**1. Novelty.** The proposed approach is a direct adaptation of the classical MAML algorithm to adversarial training, which is of limited technical novelty and hardly meets the bar of this venue. Deeper investigation of the reweighting mechanisms should be discussed, for example, the effect on the multi-class margin by the proposed reweighting, should be demonstrated.

**2. Evaluation.** Unlike previous approach, the proposed BiLAW relies an additional reweighting module in the training stage. Therefore, in the (fully transparent) white-box setting, I believe this additional module should be included in the evaluation stage for crafting adaptive attack. I have read the authors’ response to other reviewers, while I cannot agree with that evaluating adaptive attack is “beyond the scope of this paper”. Instead, because the proposed method distinguishes itself as using a learned reweighting, the authors cannot use other methods for an excuse, and the evaluation of adaptive attack on the learned reweighting module is **within the scope of this work**. Even if the authors argue that the reweighting module is not included in the test stage, we can still use an independently learned reweighting head for adaptive attack. To wrap up, I believe this work would not be complete without evaluating adaptive attack, and I strongly suggest that the authors should do so in the future.

**3. Performance.** The improvement is still marginal under AA, and it relies on a combination with TRADES to obtain good accuracy, and lacks comparison to SOTA baselines like AWP. MNIST/F-MNIST is too old for the current research, and small CNNs are also unnecessary for CIFAR-10. On CIFAR-100, the result of BiLAW is **not shown**. I encourage the authors to be honest with the results even if it is relatively lower.

Minor concerns:

The authors spend too much space on preliminaries and lack enough discussion on introducing and justifying their own method. For example, the technical discussions of multi-class margin (Section 3.1) is unnecessarily complex, as the authors have not shown any rigorous connection between the theory and their proposed method. Also, in Step 2 (Section 3.2), the update rule is also unnecessarily complex, as the sum term could be simply replaced by the average loss.

summary_of_the_review: Based on the limitations above, I think that this paper, although having technical contributions to the community, is still not ready for publication due to the lack of fair evaluation. Therefore, I recommend rejection. I would suggest the authors address my concerns (as well as those from other reviewers) with additional experiments and submit it to a future venue.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors propose a bi-level adversarial training method to reweight the importance of samples in each mini-batch, aiming at building a more robust DNN model. The authors borrow the idea from meta-learning and design an auxiliary network to learn such weights. The results show their approach can improve robustness against certain attacks. 
main_review: Strengths:
1. It is interesting to combine MAML with adversarial training and formulate a bi-level reweighing adversarial training framework.
2. The definition of multi-class margin is intuitive but enlightening for rethinking the boundary of samples.
3. The structure of the article is relatively organized.

Weaknesses:
1. My biggest concern is that, from Table 2 and 3, using BiLAW alone is not competitive with others when facing more reliable attack methods like AutoAttack, especially TRADES. So when used in combination with TRADES, the gain is more likely to be brought by TRADES rather than BiLAW itself. Combined with the higher robust accuracy against PGD, it suggests that the boundary of the model trained by BiLAW may not significantly change. BiLAW is more likely to make the area near some hard samples (for PGD and its variants only) much sharper, which is virtually harmful to construct a certified robust model.
2. It seems that the uncertainty of the source of performance improvement. It is hard to say whether such robust performance comes from the reweighting strategy or just the increase in parameters or the structural change brought by the auxiliary network. Although this network will not be activated in the inferring stage, the inaccessibility of the auxiliary network to attackers may result in a performance boost.
3. Since the authors add an auxiliary network to train the model. It is natural to care about the running time for BiLAW in comparison with other methods.
summary_of_the_review: Overall, considering the weaknesses, not good enough experimental results and the limited novelty, I am inclined to reject the paper unless the authors can provide more interesting discovery and explain a compelling reason why it cannot perform well itself.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The authors propose a bi-level adversarial training mechanism to learn sample weights with the goal of training more robust neural networks.  In comparison with related work which derive sample weights using various definitions of class margins, the authors parametrize the weights using a neural network. They show the efficacy of their approach by testing the robustness of their model against a variety of attacks. 
main_review: Strengths:
1. The technique of learning the sample weights during training instead of simply using a function proportional to class margins is novel and interesting. Further, similar bi-level optimization has been used for other tasks (MAML, GAN training) for sample reweighing with a fair amount of success. 
2. The claims in the paper are well supported with experiments and comparisons are adequate. 
3. The authors also demonstrate the need for a new definition of multi-class margin through a very interesting experiment ranking the adversarial logit index.  

Weaknesses/Questions:
1. How will the defense fair against an adaptive attack? In this case, if the attacker knows the relative average weights of the various classes, the attack algorithm may be able to compensate for that. 
2. Sec 4.2 shows the distribution of high and low weighed training samples for BiLAW. It would be great to see similar plots for GAIRAT and MAIL to see if the weights are a property of the dataset or that of the training method. 
3. The ablation studies in the appendix should be in the main paper in order to demonstrate the advantages of BiLAW over other methods such as TRADES. The paper would benefit from a more involved discussion of the ablation instead of Sec 4.2.
4. I am also curious about training times for BiLAW models. Is there a significant difference in the number of epochs required in comparison with TRADES?
summary_of_the_review: Overall, the paper is well written. I especially like the way the authors have motivated BiLAW, and appreciate the detailed comparisons with related work. The improvements while not significant, do merit publication and further discussion.The experiments are also comprehensive and support all claims. I am therefore inclined to recommending an accept.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a novel approach (BiLAW) to reweigh training samples with the aim of improving models’ adversarial robustness. Different from previous reweighing methods, BiLAW uses multi-class margins and a trained neural network that learns to map the class margins to sample weights. The author claims that these two components improve sample reweighting to bring better robustness and clean accuracy. A meta-learning algorithm (MAML) is used to train the reweighing model. Experiments are conducted in the MNIST, CIFAR-10 and -100 datasets to show that BiLAW outperforms previous robustness and reweighting baselines.
main_review: Though the concept of reweighing training samples based on margins to improve robustness is not new, the paper presents novel approaches to reweighing by a) using multi-class margins and b) meta-learning how to reweight the samples from the class margins. The experiments show that BiLAW generally outperforms the current baselines. The paper is generally easy to follow.

The main weaknesses of the paper are the lack of 1) theoretical discussion/justification of why the use of proposed multi-class margin is better and 2) ablation studies to separately test that the two proposed components a) multi-class margin and b) meta-learned margin-to-weight mapping indeed improve the performance as claimed.

Comments & Questions:
What is the computational cost of BiLAW versus other reweighting baselines?
What could explain BiLAW underperforming some of the baselines in some settings?

Typo:
Testcases > test cases

summary_of_the_review: Despite the weaknesses and the limited novelty from previous reweighting algorithms, I am more inclined to accept given the improved empirical results.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a bilevel optimization procedure for adversarial training. While this has been done for empirical risk optimization, the paper may be the first that adapts such techniques for adversarial training. The new modification is their input encoding for the meta network: Def 3 (multi-class margin).
main_review: Strengths (motivation, soundness, correctness, clarity):

Writing: The writing is clear and easy to understand.

Methodology: The proposed methodology is sound. The authors clearly explained how they adapted from prior works (MAML, Meta-Weight-Net, etc.). Their motivation for Def 3. and how it can be used as an input to their meta net are well explained. I also appreciate that the authors make the paper more self-contained by giving their meta gradient derivation in the appendix.

Experiments: The experimental results are good, especially under harder attacks (e.g. AutoAttack).

Weakness (novelty, improvements decoupling):
Although the proposed methodology is new in adversarial training to my best knowledge, it essentially applies idea of Meta-Weight-Net in the adversarial training setting. On the surface, this lacks some novelty. I think the paper can benefit from explaining how the performance improvement is decoupled: 1. the bilevel framework, 2. their encoding (Def 3.), say by replacing Def 3 as inputs to the meta net by simply the raw input data or the input data's activations.

Minor suggestion or typo:
- Page 3: "An immediate consequence of Eq. 1 and Def. 2.1", the hyperlink in Def. 2.1 doesn't seem to point to any definition. I cannot see Def 2.1 in the main paper either.
- Page 3: "More concretely, given a norm p and radius $\epsilon$", do the authors mean to say: ... given $L_p$ norm ...
- Page 3: I understand this notation "$L(y; x + \delta; \theta)$", but this may be more natural: $L(y; f_{\theta}(x + \delta))$, unless this is defined again in the notations section.



summary_of_the_review: Overall, I think this is a nice contribution to the literature. The only drawback I can see is the lack of justification for their input encoding to the meta net, leaving the readers pondering where the improvements come from. I'd raise my score if the author can provide more justification on their input encoding (Def 3), or an ablation study.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper applies ideas from meta-learning to adversarial training. They train an auxiliary network that assigns each training sample a corresponding weight which indicates how useful the training point is for robust generalization performance. They compare their robust accuracy against several baselines and demonstrate improved clean and robust accuracy as compared to their baselines.
main_review: The paper is well-written, clearly motivated and related work is sufficiently discussed. The comparison with the baselines is fair and the evaluation seems thorough. The improvements over the baselines are also consistent and relatively significant.

My biggest concern is that some more modern baselines may be needed in order to keep the claim in the abstract "improves both clean and robust accuracy compared to related techniques and **state-of-the-art baselines**." According to the [RobustBench leaderboard](https://robustbench.github.io/) there are many papers that achieve higher robust accuracy. Most of them use either real or synthetic auxiliary data or larger architectures, so no direct comparison is possible. However, [Adversarial Weight Perturbation Helps Robust Generalization](https://arxiv.org/abs/2004.05884) is listed as having a 3% higher robust accuracy using a "WideResNet-34-10". Is this the same or different from what the authors call "Wide-Resnet-10-32"? Ultimately, I do not think that the paper absolutely needs to compare to all baselines that achieve higher robust accuracy, because the techniques may be very different, but in my opinion the paper would benefit from clarifying where it fits in the current SOTA. For example, could the SOTA be improved by combining the technique with prior methods?

It also seems that the method's novelty is not particularly high since it simply applies a previously known technique to adversarial training. Given the good results this is not an issue though, in my opinion.

I didn't understand why the MNIST and FMNIST models were not evaluated using AutoAttack or at least Auto-PGD.

One fact that I found quite striking in the paper is that Figure 3 a) shows that the learned weights are in fact very close to one another. This makes it all the more surprising that such small differences could really have a significant impact. It would be quite interesting to see if it is really the weights that make the difference or the altered training dynamics, i.e. that the objective is changing throughout training. A simple ablation would be to retrain a model from scratch using a fixed weighting network that is taken from a previous BiLAW run. If the weights really make all the difference, then they should be unaltered under this change.

Minor comments:
- the paragraph headers on page 2 have inconsistent punctuations
- visa-versa => vice versa
- punctuations after equations are missing
- the use of $\mathcal{L}$ on page 3 seems inconsistent with its definition on page 2
- on page 5 there is a notational clash between the meaning of $\Delta_i$ and $\Delta_j$. I would recommend using a superscript for one of them.
- in step 2 on page 6 the parentheses refer to the wrong line in Alg. 1
- a boldface is missing in the 6th column of Table 2

summary_of_the_review: The paper is well-motivated and has a solid evaluation showing consistent improvements on a well-studied task. Even though the authors could try to push their method's performance by additionally combining it with other baselines, in my opinion the results are significant enough to warrant a publication.
review_title: null

Meta-review: The paper introduces a meta-learning approach for re-weighting samples for better adversarial robustness. Specifically, they parameterize the weights using an additional module and learn it with the MAML objective. I have read the paper and reviews carefully by myself and found that the paper has several weaknesses that are not well addressed in the rebuttal. 

1) limited novelty. The proposed approach is a direct adaptation of the classical MAML algorithm to adversarial training, which is of limited technical novelty as pointed by serveral reviewers. 

2) Adaptive attack experiments are incomplete. The proposed BiLAW relies an additional reweighting module in the training stage, though it will not be used in the test stage. But we can still use an independently learned reweighting head for adaptive attack, which is should be considered in the white-box attacks. We do not want to see the new proposed defense will be defeated by other attacks quickly. 

3) The true performance for BiLAW is problematic. Table 1 on MNIST is not representative for current development in adversarial community. On Table 2, comparing BiLAW with TRADES, for AA (0.031), 45.3% vs 51.7% on small-CNN and 51.4% vs 52.1% on WRN-32-10. The performance of BiLAW is lower than TRADES, while when combine the two together, the results is very natural higher than TRADES and BiLAW but we are sure which component benefit the gains. For example, we can say TRADES benefits BiLAW because BiLAW+TRADES (52.6%) is much higher than BiLAW (45.3%). Also, the author did not show the results of single BiLAW on CIFAR-100. Considering the around two times running time, this performance is not acceptable in adversarial training methods. 

Due to the above reasons, I cannot recommend acceptance in the current verison to ICLR.
Decision: Reject