Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 8: Accept
review_content: The paper is interested in robustness w.r.t. adversarial exemples. 

The authors note that:
* features reflecting the global structure are more robust wrt adversarial perturbations, but generalize less;
* features reflecting the local structure generalize well, but are less robust wrt adversarial perturbations. 
In hindsight, these claims are intuitive: adversarial perturbations and unseen shape variations are of the same flavor; one should resist to both or handle both, with the difference that the latter is bound to occur (and should be handled) and the former is undesired (and should be resisted). 

The goal thus becomes to define local features that are robust. 

The proposed approach is based on 
* enforcing the invariance of the intermediate representation through shuffling the blocks of the training images; 
* building normal adversarial images x' and deriving the block shuffling RBS such that the x' and RBS(x') are most similar w.r.t. the logit layer
* adding these RBS(x') to the training set;

The idea is nice; the experiments are well conducted and convincing (except for the addition of uniform noise, which is unrealistic; you might consider instead systematic noise mimicking a change of light);
I'd like more details about:
* The computational cost of line 7 in algo (deriving the best RBS).

You might want to discuss the relationship between the proposed approach and the multiple instance setting (as if the image was a bunch of patches). 
review_title: Official Blind Review #3

final_score: rating: 3: Weak Reject
review_content: The work suggests reshuffle images blocks of adversarial examples during adversarial training, in order to improve the generalization performance on benign and adversarial test samples.  The main method is based on the hypothesis in [Zhang et al 2019], [Ilyas et al 2019].  The assumption claims that robust models rely on global structural features, and non-robust models rely on local features. Thus, the work tries to learn local robust features, by cutting and reshuffling the image blocks. Overall the idea is interesting and the paper is well written .

However, there are some concerns about the presentation and the main methodology:
1.	Can the paper give more explanation on the purpose of inserting the feature transfer term in the objective function? What is the difference of the proposed one with directly minimizing the loss on both original PGD image and reshuffled image?
2.	For CIFAR10, TRADEs and PGDAT’s performance in the result is not as good as the ones shown in their original works, which is comparable to the performance of the proposed RLFAT method. More discussions are needed, otherwise the experimental results are not convincing. 
3.	More intuitions are needed  on what local and global features are, and why training on the reshuffled images can help learn generalizable robust local features. 

Overall the paper is easy to understand, but we suggest that more insight should be given on the success of the proposed method.

review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: In this paper, the authors proposed a new approach to improve the robustness of CNNs against adversarial examples.
The recent studies show that CNNs capture local features, which can be easily affected by the adversarial perturbations.
Thus, in the paper, the authors proposed to train CNNs so that they can capture local features that are robust against the adversarial perturbations.
The difficulty here is that existing adversarial training algorithms tend to bias CNNs to ignore local features and to capture only global features.
To avoid this unfavorable property of the adversarial training, the authors proposed the random block shuffle (RBS) that intensionally destroys the global feature of the images.
The authors demonstrated that combining RBS with the existing adversarial training algorithms can lead to robust CNNs.

I found the paper well-written and the idea is easy to follow.
Especially, the use of RBS seems to be an interesting idea.
As a small downside, the proposed approach looks rather straightforward, and I expect to see any theoretical foundations if possible.

### Updated after author response ###
In summary, the contribution of this study is in twofolds.
1. Proposed an algorithm for learning robust local features.
2. Demonstrated that learning robust local features is effective to improve the robustness of the model.
The possible downside is
3. The proposed approach looks straightforward.
Overall, I like the paper (especially for the reason 2 above), and therefore keep my score.
review_title: Official Blind Review #2

Meta-review: Earlier work suggests that adversarial examples exploit local features and that more robust models rely on global features. The authors propose to exploit this insight by performing data augmentation in adversarial training, by cutting and reshuffling image block. They demonstrate the idea empirically and witness interesting gains. I think the technique is an interesting contribution, but empirically and as a tool.

Decision: Accept (Poster)