Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: The paper proposed a adversarial learning framework that tries to align the hidden features of data with simple prior distributions.  A training strategy similar to GAN  was exploited. The proposed framework was argued that it can well deal with the adversarial perturbations. Some experiments were conducted, verifying that the proposed algorithm seems useful and robust.

The main comments are listed as follows:

(1) To the reviewer, the adversarial framework to use a simple prior to align the hidden features seems new. However, in the literatures, there are some adversarial training algorithms which did similar things. For example, C1 tried to force the hidden features of deep learning follow a Gaussian distribution with the smooth regularizer. Though different,  I believe they share some common motivation, the authors may want to discuss and even compare this reference.
Similarly, in the literature, the so-called Center Loss will also basically force the means of different data are as further as possible, this is also relevant to the paper.

(2) The authors have reported a series of experiments, which is great. However, they only evaluated their model's robustness in case of PGD attack. This is very different from many adversarial literature which normally would discuss various attack such as l_2 attack, FSGM, and even black-box attack.  The evaluations may be more convincing  if more attacks can be tested on the proposed method.

(3) Further to (2), it is noted that the paper simply compared their approach's robustness  with Madry's adv, it would be more convincing to compare the other recently adversarial training algorithms like VAT (C2).

(4) It is good that the paper proposed a different way in dealing with adversarial examples. In comparison, the current work studying adversarial examples is based on the robust framework of minimax trying to impose the worst-case perturbation. It would be interesting to see if the proposed work can be also further applied in the minimax  framework and examine if a further robustness can be achieved.

(5) Some visualization may be interesting. For example, a visualization how Q would change as the training continues. This may be used to check the convergence property of the proposed algorithm.   

C1:Manifold Adversarial Learning, S. Zhang et al.,  https://arxiv.org/pdf/1807.05832
C2:Virtual Adversarial Training: a Regularization Method for Supervised and Semi-supervised Learning, T. Miyato et al. arXiv preprint arXiv:1704.03976, 2017.


==================

Thanks for the response made by the authors. Thought these response resolved some of my concerns, it is still not very convincing.  On one hand, it seems that the authors did not  comment (4) and (5).  On the other hand, the paper may be still in lack of comparisons and/or discussions with the related work. After PGD, there are a lot of new robust approaches. Overall, I enjoy reading this paper but I would still think the paper could have further room to be  enhanced. 
review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: This paper proposes a new regularization technique called Embedding Regularization to improve the adversarial robustness.  The idea is to use generative adversarial networks (GAN) to perform inference on the latent space by matching the aggregated posterior of the hidden space vector with a prior distribution. The proposed strategy could be combined with adversarial training to achieve state-of-the-art adversarial accuracy on several benchmark datasets. 

Overall, I find the idea interesting and the experimental results promising. The following are my detailed comments.

a. About the algorithm 
The idea of incorporating a GAN based model to regularize the representation learning is not completely novel. In [1], a similar approach has been considered for unsupervised learning (auto-encoders).  Besides the omission of reference, a few points about the algorithm need to be clarified :

a.1 What is the motivation of using the different of discriminator as loss in line 7 of Algorithm 1?
In the standard GAN literature, the discriminator loss is usually in the form log(D(z_{true})) + log (1 - D(z_{generated})). Is there any intuition to prefer the current formulation comparing to the this standard formulation?

a.2 Why do we separate the training of classification loss and regularized loss (line 8 and line 9)? 
From the optimization perspective, there is no difficulty to optimize 8+9 together, which corresponds better to the loss described in equation (2). (Just fix the discriminator and train the encoder and classifier jointly) Is there any reason to prefer the current alternative training rather than joint training? 

a.3 How large are the discriminator loss versus generator loss?
In the standard GAN training, it is crucial to balance the discriminator loss and the generator loss. A plot comparing the different loss in line 7, line 8  and line 9 will be helpful to understand the role of discriminator in the framework. In particular,  it would be interesting to see whether there is a difference when combining with/without adversarial training.

b. About the experiments 
b.1 Why Gaussian distribution is a good prior distribution?
Intuitively, we would expect the latent distribution to be well clustered in several class which is clearly not the property of a Gaussian distribution. It is very curious to me why imposing a Gaussian distribution could improve the robustness. Have you tried to use clustered distribution as a prior? (examples could be find in [1]) If not, it would be interesting to try and compare the results.

b.2 On CIFAR10, why the non-robust training outperform the robust training?
It is curious to see that on CIFAR10, ER-classifier- outperforms ER-Classifier with large epsilon. This is surprising since the min-max robust training explicitly minimize the robust loss. 

b.3 Have you tried to vary the regularization parameter lambda?
It would be interesting to see how the performance changes when varying the regularization parameter lambda. By the way, how is lambda determined in the current experiments?

Minor comments: 
b.4 There is a stronger version of Defense-GAN introduced in [2]
b.5 The study on the dimension of embedding space is interesting, is the non robust training giving similar results? 

[1] Adversarial Autoencoders, Makhzani et al. 2015
[2] The Robust Manifold Defense: Adversarial Training using Generative Models, Ilyas et al, 2017
review_title: Official Blind Review #3

final_score: rating: 1: Reject
review_content: 
Summary
========
This paper proposes to make neural networks robust to adversarial examples via dimensionality reduction.
The paper builds on and compares to prior approaches (e.g., MagNet and Defense-GAN) that are known to be broken, which casts serious doubts on the validity of the performed experimental evaluation.
The theoretical part of the paper is also very hard to follow.
For these reasons, I recommend rejection.


Comments
=========

The way I understand the proposed framework, it is trying to compress the data into a form that is as close as possible to a standard Gaussian distribution, while maintaining classification accuracy.
The intuition, formulated next to Figure 1, seems to be that compressing the data will force the network to only retain the most important features for classification, which will thus lead to higher robustness.
I have two main concerns with this approach:
- First, recent work by Ilyas et al ("Adversarial examples are not bugs, they are features") seems to suggest that models tend to learn features that are not robust yet generalize well. It is unclear why compressing the data would remove such features.
- Second, it is unclear why constraining the compressed data to be close to a Gaussian would have a positive effect on robustness. The authors claim that this is to remove some "pathological" mappings from the input space to the embedding space. Can you explain what you mean here? What are these pathological mappings and why should they be the source of non-robustness?

The theoretical analysis in Sections 2.3and 3. is very hard to follow. The authors first mention that "optimal transport theory [...] provides a much weaker topology than many other [distances]". What do you mean by this? What is the advantage of optimal transport theory that you are trying to exploit?
When Kantorovich’s distance is first introduced, the reader has no idea what any of the symbols represent. What are Y, U, \mathcal{U}, P_Y, P_C, etc?
The authors then mention a relation to the Wasserstein distance and to Wasserstein GANs. How does this relate to this paper?

I could not understand how Algorithm 1 related to the discussion in Section 3.
Algorithm 1 simply uses a standard cross-entropy loss to train the classifier C. Is this what you mean by minimizing the optimal transport cost between P_Y and P_C? This seems like a very convoluted way of justifying the use of the most standard loss function in ML.
Algorithm 1, step 6 mentions sampling from Q(Z|x_i). But isn't the encoder Q deterministic? If not, where does the randomness come from?

In the experimental section, the authors compare to Defense-GAN, which was shown to be broken in "The Robust Manifold Defense: Adversarial Training using Generative Models" by Jalal et al.
The authors mention that they evaluate robustness using an untargeted white-box PGD attack, but they do not specify which objective their attack is optimizing. As this papers proposed a different classification pipeline, adaptive the attacks to this pipeline is crucial.

The experimental results (Figure 2 & 3) raise a number of questions:
- Why does the ER-classifier variant without adversarial training perform so much better than the one with? The author's explanation about the difficulty of optimizing over the embedding space should be supported. 
- Do the attacks reach 0% accuracy for large enough epsilon? The very high accuracy even for large epsilon suggests that the evaluated attacks are not evaluating the right objective to fool the classifier. E.g., on MNIST, eps=0.4 can nearly destroy the whole image so the accuracy should be expected to be lower.
review_title: Official Blind Review #1

Meta-review: The paper suggests a new way to defend against adversarial attacks on neural networks. Two of the reviewers were negative, one of them (the most experienced in the subarea) strongly negative. One reviewer is weakly positive. The main two concerns of the reviewers are insufficient comparisons with SOTA and lack of clarity. The authors' response, though detailed, has not convinced the reviewers and has not alleviated their concerns. 

Decision: Reject