Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper extends adversarial training to train robust classifiers against non-uniform adversarial perturbation for various security-critical applications (e.g., malware classification, credit risk prediction).

main_review: 1. The problem is very important and interesting. For instance, adversarially generated malware may cause serious security concerns. Therefore, how to train robust classifiers in security-critical domains is an important research problem.

2. The improvement of the proposed approach is marginal compared with adversarial training with uniform adversarial perturbations. As shown in Figure 1(a) and 1(b), the proposed approach only improve the baseline for several percent regarding defense success rate.

3. The technical contribution of this work is weak. The adversarial training is a very standard method to train robust classifiers. The extension of adversarial training to non-uniform adversarial perturbations is not challenge. 

4. A baseline is that the defender could leverage the adversarial examples crafted in the problem-space to perform adversarial training. Could the authors share more details (or comparison if possible) for this?

limitations_and_societal_impact: 1. The performance improved over the baseline is marginal.

2. The technical contribution is limited.

3. The certification for non-uniform adversarial perturbation is a simple generalization of existing studies.

Writing:

1. \sum_{y=0} for NUC-MDt, \sum_{y={0,1}} NUC-MD. This is hard to understand.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper proposes a method to generate non-uniform adversarial perturbation for applications where features normally have semantically meaningful dependencies, including malware detection, credit risk prediction and spam detection. Specifically, two choices are introduced for the non-uniform perturbation sets: one based on the Mahalanobis distance, and another one based on Pearson’s correlation coefficient or Shapley values. In addition, the authors modify two certification methods, linear programming and randomized smoothing, to provide provable guarantees for non-uniform robustness.
main_review: Strength:
1. It is novel to consider feature importance, feature correlations and domain knowledge when generating adversarial perturbations.
2. Evaluations on multiple tasks demonstrate the effectiveness of the proposed methods.
3. The authors provide certified robustness with non-uniform perturbations.


Weakness:

I have the following questions on the evaluation part:
1. Regarding the setup of the experiment, are the non-uniform defence approaches tested against non-uniform perturbations, while the uniform defence approaches tested against uniform perturbations? What if the non-uniform defence approaches are tested against uniform perturbations, or the other way around?

2. Does the new approach have any impact on the efficiency of adversarial training? It is mentioned that the covariance matrix and Shapley values are precomputed. How does this affect the results? 

3. In Fig. 1, why does the defence success rate increase with $||\delta||_{2}$?

limitations_and_societal_impact: The authors have addresses both issues.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The authors have proposed non-uniform adversarial perturbation generation algorithms to attack the classifiers trained on heterogeneous databases such as malware detection and finance. 
main_review: How the data dependency is incorporated in the proposed framework and what is the limitation of such dependency?

What are the parameters of the chosen PGD attack?

As compared to the claim in the paper, the performance of the proposed attack is comparable to a single chosen uniform attack. Are the values reported in the Figure statistically significant? For example in Figure 1b, the difference in the values between existing and multiple variants of the proposed attack is 1-2%. A similar observation can be drawn from other results as well.

Another limitation is that only a single attack and single network architecture is chosen for comparison with uniform perturbation? 

In appendix A.3, "This approach does not guarantee same range (min and max) for all features.
58 As a result, it is possible that the features have different scales even after normalization", then what normalization the authors have applied, and why does the above standardization reflect such observation?

The paper listed multiple appendices for the readers to refer to. It would be great if the authors can bring all the sufficient and critical information in the paper to make the understanding clear.

Why the proposed attack is applied to the bad class? What if the perturbation is applied to the data without knowing the class?

The analysis of table 1 is not clear. What to refer to from the table? What does the value mean, the higher the value, better the attack or vice versa, etc?

Contrary to figure 2, it seems from the values in Table 1 and Table 2 that the proposed attack is easy to defend as compared to uniform perturbation. 

How the precomputed values such as covariance matrix and Shapley values are obtained? have the authors noticed any data distribution apart from taking the assumption of Gaussian distribution? What is the impact if other distributions come?
limitations_and_societal_impact: The limitation of the work is well explained in the paper which might be due to the lack of ablation study concerning existing attacks, statistical analysis, ablation analysis in the absence of the assumptions, etc.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: In domains other than computer vision, a uniform bound for adversarial perturbations may not make much sense as different input features can have divergent value ranges and meanings. For instance, in malware detection, certain features are not allowed to be perturbed in order to preserve the functionality of subject programs. This paper tackles the robustness problem in this particular setting where non-uniform perturbations are required for crafting adversarial examples. Specifically, the paper introduces a transformation matrix $\Omega$ to first weight the perturbations before calculating the norm bound. It then uses such a weighted norm to perform adversarial training. Three types of transformation matrices are evaluated for denoting the importance of different input features. The experiments are conducted on three use cases, namely, malware detection, credit risk detection, and spam detection. The results show that using non-uniform perturbations leads to better robustness than using uniform ones on evaluated use cases.
main_review: The motivation of this paper is interesting and reasonable. It is indeed important to design problem-specific perturbation bounds for certain domains. I particularly like the motivation case where not all the features are allowed to be perturbed for maintaining malware functionality. I do see the value of such studies in domains other than computer vision. I have a few questions for the authors.

1. I can understand that we need domain knowledge to construct the transformation matrix $\Omega$ to achieve domain-specific constraints. But the paper mainly talks about different types of metrics for measuring the feature importance such as Mahalanobis distance, Shapley values. How are these two connected? It seems disconnected between the motivation and the actual addressed problem. That said, why does using those feature importance metrics have better results than a uniform bound? The gradient during adversarial generation already tells us the importance of different features. The paper mentions that the Mahalanobis distance can help generate adversarial examples "with feature correlations similar to the original dataset". This sounds reasonable. Can the authors empirically validate this argument?

2. The existing work [25] is closely related to this work as stated in the paper. It certifies non-uniform bounds for models. In Section 4, this paper also tries to certify the robustness with non-uniform perturbations. Why is work [25] not studied in the paper? A straightforward experiment would be just using work [25] to certify original models and models trained by this paper. This can illustrate how the non-uniform bound change before and after training.

3. For the transformation matrix $\Omega$, is it calculated once before the adversarial generation or every iteration during the generation? What is the time cost for the non-uniform adversarial training compared to the uniform one?

4. At lines 188-189, the paper states that "to model the expert knowledge with diagonal $\Omega$, we use Pearson’s correlation coefficient, Shapley values, and masking to allow perturbation only in mutable features". Did the authors also mask out those immutable features when training with Pearson’s correlation coefficient, Shapley values? How about the training with the Mahalanobis distance? If not, I am not sure how these metrics can mask out immutable features. It also comes back to my first point that the paper does not seem to address the problem introduced in the motivation. Could the authors care to explain?

5. In Table A.1 in the appendix, why do adversarially trained models have worse performance on C2 Pad. attack than the standard training? Almost all the adversarial training methods are worse than the standard training. Have the authors looked into this?
limitations_and_societal_impact: The authors have partially addressed the limitations. Please see details in the main review.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper is motivated by the fact that prior work on crafting adversarial examples focuses on perturbations which perturb the different features uniformly. However, they argue that such uniform perturbations do not result in realistic adversarial examples in general, since features often have semantic dependencies. To address this, their paper enables consideration of non-uniform perturbations, and demonstrates this approach using adversarial training on a number of problems using real-world datasets. In addition, they consider the effectiveness of the non-uniform bounds approach in improving the efficiency of two different techniques for certified robustness.
main_review: The approach of the paper appears to be original and largely technically sound. However, their use of non-uniform perturbations is quite a small and simple amendment to established techniques. As such, the results I would say are not of huge significance to those working in the area. In fact, in some cases, including some of those considered, the approach essentially amounts to no more than a change of basis for the features.

I had a few problems with the clarity of the motivation. Mention is made of basing the non-uniformity on either the importance of the features or on correlations between the features (in general, these are different). The claim is made that these approaches result in more realistic adversarial examples. However, this is not necessarily guaranteed. One can imagine that perturbation of some features could be very important to classification, but not be a realistic proposition if there are dependencies to satisfy. It feels like the approach of the paper, rather than using more realistic adversarial examples, works simply because it is focussing perturbations on the most relevant features. This is not a bad thing to do, but I think the motivation and explanation are somewhat confused. i.e. is the guiding motivation realistic adversarial examples or ones that are more effective in adversarial training?

Also, it is argued, correctly, in the Introduction that there can be certain constraints/dependencies amongst the features. However, the subsequent approach does not really allow for such dependencies in general as it is simply using a multi-variate Gaussian for the perturbations. For example, if feature 1 is always equal to twice feature 2, or say bounded below by 3 times feature 3, these dependencies cannot be accommodated in the approach. That is, the paper conflates dependencies with correlations.

More generally too, without a human in the loop to constrain perturbations to be imperceptible, larger perturbations are allowed, e.g. in their malware examples, huge changes can be made as long as the malicious functionality of the executable is not changed. This is also not covered by the proposed scheme of small non-uniform perturbations.

Though the above points are not saying the approach is incorrect – just that it is not as general as the introduction and motivation would lead one to suppose.

Some minor comments and typos:
-	Can the non-uniformity introduced, i.e. $\Omega$, be a function of $x$?
-	Theorem 2.1 is largely stating the obvious in terms of the correlation between gamma-consistency and epsilon – and the exact result does not, as far as I can see, get used subsequently. So why is this theorem needed?
-	Theorem 2.1 confuses the probability density function with P(X=x).
-	Theorem 2.1 does not state over what range of values of x $P(X=x|y)>=\gamma$.
-	In equation 5, should the argument of P on the LHS be $\delta$ and not $\Omega \delta$?
-	It is not clear in the examples if the different features are normalised first. Part of the non-uniformity imposed would then correspond to simply normalising the features.
-	In the paragraph beneath Theorem 4.2, it is argued that the result holds if $p_a$ is replaced by a lower bound. But the theorem is already stated in terms of the lower bound.
-	The statement of Theorem 4.2 in the supplementary material (erroneously referred to there as Theorem 5.2) essentially lumps the key part of the proof of the theorem into a “it can be shown that” and so is not really a proof. But reference can be made to Cohen et al for details of the proof anyway.

Edit: Score revised following discussion period.

limitations_and_societal_impact: The authors address potential societal impacts adequately.
review_title: null

Meta-review: This paper proposes to improve the adversarial robustness by using non-uniform perturbations in adversarial training. After the rebuttal and discussion, the reviewers raised several concerns on the novelty, the marginal improvement over baselines, and some experimental settings. The paper could be strengthened if these concerns could be addressed. 
Decision: Accept (Poster)