Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper describes a method to learn data augmentation policies using an adversarial loss. It builds on the AutoAugment method. In AutoAugment, an augmentation policy generator is trained by reinforcement learning. At each iteration, a classifier network is trained from scratch based on the current augmentation policy, and its validation accuracy is used as the reward signal. This is extremely costly because it requires to train a complete network for every training step of the policy generator. Instead, the current paper proposes to train the policy generator and the classifier simultaneously. The policy generator is trained adversarially to find augmentation policies that increase the loss of the classifier. This leads to a significant speedup compared to classic AutoAugment.

The presentation of the algorithm and the results is very clear. The proposed method yields improved performance compared to AutoAugment at ~1/10 of the computational cost, which is impressive. Although the paper only evaluates on two datasets (CIFAR and ImageNet), the idea is likely applicable very generally. I recommend this paper for publication, but have some comments that should be addressed:

Major comments:
- It would be good to evaluate how well the learned policies transfer between datasets and architectures. Adversarial AutoAugment still comes with a significant computational cost compared to hand-crafted augmentation, so transfer of policies would be useful. AutoAugment is transferable by design, so any competing algorithm should evaluate transferability.
- The authors state that all results are mean of 5 initializations, which is great. Please use these replicates to compute a measure of uncertainty (SEM or confidence interval) and state this with all values in the tables.

Minor comments:
- Overall, there are many grammatical errors and typos that sometimes require interpretation and reduce clarity. Please proof-read carefully.
- Abstract sentence “... can simultaneously optimizes…” has grammatical issues.
- Second sentence of introduction has grammatical issues.
- Third sentence of intro: “et al.” is used for persons, use “etc.” for things.
- Contribution section: “...our proposed method outperforms all previous augmentation method.” Please be careful with the breadth of your claims. You do not compare against *all* previous augmentation methods.
- Figure 4: Please add units and/or refer to Table 5 in the legend.

review_title: Official Blind Review #4

final_score: rating: 6: Weak Accept
review_content: The authors propose a method for adversarial data augmentation which jointly trains the target network and the augmentation policy network. The authors claim that such learning set-up prevents overfitting and reduces computational cost with respect to competitors. Finally they provide extensive results and show that outperform the state-of-the-art in multiple datasets. 

* The rationale behind the idea is properly introduced and justified 
* The formulation is clear and sound
* The results show improvements over competitors in terms of accuracy and computational cost

* The contributions seem very incremental. Applying GANs for data augmentation is not new and regarding the policy search the authors strongly base their approach in Cubuk19. The main differentiator wrt the work of Cubuk is to jointly train both target and policy learner in a GAN setting, rather than learning the policies a priory with a fixed target network.

* I miss further discussion regarding the benefits of the GAN approach against pre-training policies. The overfitting argument seems pretty weak given the relatively marginal gains of accuracy. 

* It would make the experiments more complete if the Top-1 and Top-5 results were provided, as well as running experiments on the same networks as the Cubuk19 paper.

* How coupled are the policies learned to the specific dataset after training?. The work by Cubuk19 shows transferability properties that could somehow diminish the gain achieved by this work regarding computational cost.

review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: This paper proposes a technique called Adversarial AutoAugment which dynamically learns good data augmentation policies during training. An adversarial approach is used: a target network tries to achieve good classification performance on a training set, while a policy network attempts to foil the target network by developing data augmentation policies that will produce images that are difficult to classify. To train the policy network, each mini-batch is augmented multiple times with different policies sampled from the policy network. Each augmented mini-batch is passed through the target network to produce a corresponding training loss, which is used as the training signal for the policy network. Experimental results are shown for CIFAR-10, CIFAR-100, and ImageNet datasets, where Adversarial AutoAugment outperforms competing methods (AutoAugment and Population Based Augmentation) on a variety of model architectures.

In its current state, I would tend towards rejecting this paper. The overall structure, the figures, and the experimental results are very nice, but there are two major issues that are holding it back. First, I am skeptical that the policy network is actually learning useful policies. Secondly, there are many grammatical errors in the paper which hamper readability. Upon reading the first paragraph of the paper, my initial impression was already quite negative, simply due to the number of grammatical errors. Fixing these would strengthen the paper considerably, and I would increase my score accordingly if properly addressed.

Primary Concerns:
1) One of my main concerns with this paper is this line here: "To guarantee the convergence during adversarial learning, the magnitude of all the operations are set in a moderate range". Since the policy network has no incentive to select transformations that the target network can still learn from, I assume that the ranges are required so that the policy network cannot choose to apply extreme transformations which always fool the target network, such as setting brightness to 0 to make the entire image black. How are acceptable ranges determined? If cross validation is required, then this becomes very much like the original hand-tuning of data augmentations that we wanted to avoid in the first place. 

Additionally, I think it would be useful to to see a plot of the magnitude of each transformation versus training epoch, similar to Figure 4a in [1]. If the policy network simply learns to use the most extreme augmentations available in order to fool the target network, then this may indicate that the gain in performance is from tuning the magnitude ranges, and not from the policy network selecting good policies.

2) The paper could benefit greatly from some revision of the grammar. I would recommend either having a friend or colleague read it over, or even using an automated grammar checking program, such as Grammarly. For example, in the first paragraph alone there are several sentences that could be improved:
"Massive amount of data promotes the great success" -> "Massive amounts of data have promoted the great success"
"when more supervised data available" -> "when more supervised data is available"
"or better data augmentation method adapted" -> "or a better data augmentation method is adopted"
"which can automated learn" -> "which can automatically learn"
"there still requires tens of thousands of GPU-hours consumption." -> "tens of thousands of GPU-hours of computation are still required"


Things to improve the paper that did not impact the score:
3) In the first paragraph it is claimed that data augmentation policies have weak transferability across different tasks and datasets. I do not fully agree with this claim, since papers such as AutoAugment [2] have shown that learned policies are highly transferable to new datasets, and augmentation strategies such as CutMix have been shown to be highly effective for a variety of tasks. 

4) No citation for the original GAN paper, despite multiple mentions of adversarial learning, and GANs themselves.

5) There is no computation time comparison with PBA, which is about 1000x faster than Autoaugment, and therefore roughly 100x faster than Adversarial AutoAugment.

6) CIFAR-10 results are not necessarily state-of-the-art. The 1.36% error rate claimed by the paper is surpassed by work in [3], which achieved 1.33% using a combination of AutoAugment and mixup. 

7) Citation for the CIFAR-10 dataset incorrectly refers to the Adam optimizer paper [4].


References: 
[1] Daniel Ho, Eric Liang, Ion Stoica, Pieter Abbeel, and Xi Chen. Population based augmentation: Efficient learning of augmentation policy schedules. ICML, 2019.

[2] Cubuk, Ekin D., Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V. Le. "Autoaugment: Learning augmentation policies from data." CVPR (2019).

[3] Wistuba, Martin, Ambrish Rawat, and Tejaswini Pedapati. "A Survey on Neural Architecture Search." arXiv preprint arXiv:1905.01392 (2019).

[4] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ICLR, 2015

EDIT: The authors have addressed the majority of my concerns, and as such I have increased my score from a 3 to a 6.
review_title: Official Blind Review #2

Meta-review: This paper proposes a method to learn data augmentation policies using an adversarial loss. In contrast to AutoAugment where an augmentation policy generator is trained by RL (computationally expensive), the authors propose to train a policy generator and the target classifier simultaneously. This is done in an adversarial fashion by computing augmentation policies which increase the loss of the classifier. The authors show that this approach leads to roughly an order of magnitude improvement in computational cost over AutoAugment, while improving the test performance.
The reviewers agree that the presentation is clear and that the proposed method is sound, and that there is a significant practical benefit of using such a technique. As most of the concerns were addressed in the discussion phase, I will recommend acceptance of this paper. We ask the authors to update the manuscript to address the remaining (minor) concerns.

Decision: Accept (Poster)