Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This is an interesting paper that discusses the robustness of the Transformer’s patch-wise architectural structure. The authors experimentally show that patch-based transformations largely destroy images to be unrecognizable to humans, but ViT recognizes them as the original class (e.g., keeshond or magpie) with high confidence as shown in Figure 1. Based on this investigation, they proposed patch-based negative augmentation and experimentally demonstrated that it consistently improves robustness of ViTs on ImageNet based robustness benchmarks across 20+ different experimental conditions.
strengths_and_weaknesses: Strength:
+ This is an interesting paper that discuss its robustness to the patch-wise data destroy. The motivation is very clear.
+ The patch-based negative augmentation based on the above observation is interesting and reasonable.
+ The experimental validation is throughout.

Weakness:
- The performance improvement from the baseline is not very large. Therefore, I admit that the concept itself is interesting, but I wonder how much this negative augmentation would give impacts to the community.
- Although it is claimed that the proposed method outperforms the baseline, the best condition differs from dataset to dataset. The authors should discuss the theoretical background of which approach is better in which case. If the authors could provide a strategy to choose the best setting, that would be great.
- The authors may want to show some specific cases where the proposed method helps a lot, not only discussing the average accuracy.


questions: Please answer to my comments above.
limitations: Nothing special.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: In this paper, the authors use the special patch-based data processing pipeline of ViTs to study their robustness. Authors find that ViTs tend to overfit on some unrecognizable features in the patch, making them not robust to distribution shifts. To alleviate this issue, the authors propose to use patch-based negative augmentations to train the ViTs and boost their robustness. Experiments show that the proposed patch-based negative augmentations can boost the robustness of ViTs and are complementary to traditional (positive) data augmentation techniques and batch-based negative examples in contrastive learning. 
strengths_and_weaknesses: Strengths:
- The observation on overfitting and its reason is interesting. 
- The proposed method is simple and effective in boosting the trained ViTs robustness. 
- Detailed evaluations are provided to show the performance improvement. 
- Writing is clear and easy to follow 

Weakness:
- Only evaluated on traditional ViTs, how about more recent ViTs? Will more intense use of convolution layers alleviate such overfitting issues mentioned? 
questions: - A curious question is whether the observed phenomenon exists in other vision tasks (e.g., detection and segmentation)? 
limitations: The authors have adequately addressed the limitations and potential negative societal impact of their work.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper investigates a small but non-obvious problem: vision transformers (ViTs) are known to be non-sensitive to patch shuffling, in contrast to humans. Could we make ViTs more robust by making them sensitive to patch shuffling (and other patch-based transformations)? The authors performed extensive experiments, and the benefits of doing so is decent and consistent across various settings. 
strengths_and_weaknesses: Strengths:
1. The investigated problem involves a basic aspect of ViT training. The benefits of this method can be cheaply incorporated to various downstream tasks.
2. The experiments are very extensive and convincing.

Weaknesses:
1. Some of the most significant improvements are achieved with patch-rotate (e.g. Table 1). But the insensitivity of vit to patch-rotate seems to be a result of the "whole-image rotation" augmentation (part of RandAug)? This is quite different from the insensitivity of vit to patch-shuffling, which is due to the invariance of transformers to token orders. So I think patch-shuffling is more inherent and more interesting to vits. 
2. I'm still not totally sure that the shuffle invariance of ViTs has only negative effects and should be completely eliminated. For example, in MAE [a], ViTs can recognize an image even when most patches are masked. Given this, it's natuaral that when patches are randomly shuffled, ViTs can still recognize the image. Therefore, I'm a bit concerned that maybe there are deeper explanations of the shuffle invariance, instead of just "exploiting texture/local patterns biases". 

[a] Masked Autoencoders Are Scalable Vision Learners Kaiming, CVPR 2022.

questions: 1. Is the negative augmentation done to every batch, or every N batches? 
2. It will help readers understand whether/how the ViT attends to different patterns after applying negative augmentation, using some attribution visualizations.


limitations: N/A
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper studies the robustness of ViT models. The authors find that ViT models can keep high in-distribution accuracy even when training on images with heavy patch-based transformations such as shuffle, rotate, and infill, which indicates that ViTs rely on the features that survived these transformations. However, these features are non-robust and render a significant accuracy drop on the out-of-distribution datasets. Based on such observation, the authors propose negative augmentation to improve the model robustness against data distribution shift. The algorithm first generates negatively augmented training samples using the patch-based transformation. It then incorporates the Uniform loss and L2 loss to regularize the training away from learning these non-robust features. The authors conduct extensive experiments to demonstrate the effectiveness of the proposed approach. The negative augmentation is complementary to existing positive augmentation such as AugMix and batch-based negative examples in contrastive loss, and can further improve the robustness on top of that.
strengths_and_weaknesses: Strengths:
1. This paper studies an important topic --  model robustness against OOD data, and proposes an effective approach to improve the robustness. 
2. The authors demonstrate an intriguing property of ViTs that they are resilient to patch-based transformations. They further show that the features that survived such transformations are not robust, which is a novel discovery. 
3. Based on the observation they propose negative augmentation and two losses to train models away from using the non-robust features. The proposed approach is technically sound and easy to understand.
4. The authors perform extensive experiments to evaluate the effectiveness of the proposed method, the results are convincing and support their claims.
5. The authors also show that the proposed method can collaborate with positive data augmentation and batch-based negative examples in contrastive loss and further improve the robustness.
6. The paper is well-organized and easy to follow.

Weakness:
1. For some experiment results, the authors didn't explicitly explain the rationale and possible reasons. Please refer to the Questions for details.
2. Missing discussion about related works in the same field. Please refer to the Questions for details.
questions: 1. In equation 1, for the loss on the negative augmented training samples, is it L_{neg}(B, \tilde(B); \theta) or L_{neg}(\tilde(B); \theta)? Do you use the clean dataset twice in the training? If so, what is the reason for doing so? 

2. For the experiments that use Uniform loss, how will the performance change if you use the regular cross-entropy loss on the negative augmented examples?

3. In Table 1, Uniform loss achieves the best performance on ViT-B/16 while the L2 loss achieves the best performance on ViT-B/32, what is the reason behind this? In practice, how do we decide which loss to use? Also, is there any strategy to pick the best type of patch-based transformation for negative augmentation?

4. Did you try to train models with the combination of Uniform loss and L2 loss, will that further improve the robustness or undermine the robustness? 

5. Can you please explain the setting difference between lines 306-307 and lines 133-135?

6. Another related direction to enhance model robustness is to improve the model architecture (e.g. Daquan Zhou et.al, Understanding The Robustness in Vision Transformers). It would be desirable if the authors could discuss this orthogonal research direction in the related work.

7. A small typo in line 35: showingthat --> showing that
limitations: Please refer to the questions above.
review_title: null

Meta-review: metareview: The reviewers agree that this is an interesting work. Some concerns were expressed, especially regarding the limited gain of the method and the generality to other types of ViTs. But overall the reviewers recognize the technical contribution from this paper and the AC agrees with their decisions.
confidence: Certain
Decision: Accept