Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper introduced a regularization scheme based on the second-order Taylor expansion of the loss objective to improve the robustness of the trained models.

Theoretically, it used the simple linear model as an example to demonstrate 1) with a proper regularization term, the training algorithm can encode robustness without explicitly solving the inner maximization problem, i.e., generating adversarial examples. 2) using the second-order estimation at the origin may lead to gradient masking and using a perturbed input can tackle this problem.

The algorithm proposed is based on an upper bound of a quadratic.

The experiments show some results on CIFAR10 and SVHN in comparison with some baselines in both white-box and black-box settings.

Comments on the intuition and methodology:

1. We know that most modern deep learning models are based on ReLU activations (or its variants like leaky ReLU), which is not second-order differentiable. In these cases, the Hessian matrix of the loss is ill defined. The author should discuss this.

2. I cannot see the "uniqueness" or the advantage of regularization introduced in Equation (1). Actually, the quadratic form of (1) comes from the mean squared loss of $l$ instead of second-order Taylor expansion. In addition, the regularization term in (1) depends on $\Delta x$. That's to say, using a different perturbation $\Delta x$, the regularization term would be different. It is not necessarily in a quadratic form and can also drive the trainable parameter $w$ to the most robust one.

3. The upper bound derived in Section 4 is not a strictly upper bound of the loss function, because it is based on a second-order approximation. The highlight of the word "worst-case" is a bit misleading. In addition, the author did not point out why we need a "upper bound" here? In adversarial training, we are actually optimizing a lower bound of the inner maximization problem. It is reasonable as long as this lower bound is tight, corresponding to a stronger attacker. I think the key point is not the upper bound of the approximation, but how close the objective function you are training on is to the inner maxima of Equation (2).

4. In Equation (7), replacing $\|\delta\|_\infty \leq \epsilon$ with $\|\delta\|_2 \leq \epsilon \sqrt{d}$ is risky even if $\delta$ is a dense vector. The volume of $\\{\delta | \|\delta\|_\infty \leq \epsilon\\}$ is $2^d\epsilon^d$, while the volume of $\\{\delta | \|\delta\|_2 \leq \epsilon \sqrt{d}\\}$ is $\frac{\pi^{d / 2}}{\Gamma(1 + d / 2)} d^{d / 2}\epsilon^d$. The volume ratio of them goes quickly to zero as the dimension $d$ increases. As a result, the RHS of (7) is a much looser bound than LHS.

5. The authors should discuss the complexity of Algorithm 1 and compare it with baselines.

6. The authors should justify the claim "In such a case, the Taylor series expansion, computed using the gradient and Hessian evaluated at x, becomes an inaccurate approximation to the loss, and hence its maximizer is not a good solution to the inner maximization problem." in the second last paragraph of page 5. A regularizer of small values does not mean it is not a good regularizer in this case.

7. The sentence "our approximation might not be very good whenever
the loss function is close to being flat at x" in the end of page 5 is incorrect. The approximation error is approximately the third-order Taylor expansion term and does not connect to the flatness at $x$.

Comments on the experiments:

1. The author should evaluate the robustness of the model by the state-of-the-art attack, such as AutoAttack introduced in https://github.com/fra31/auto-attack. 

2. The results on the baselines is not convincing. The accuracy is a bit worse than the one claimed in their papers. For example, regarding adversarial training, the authors should use early stopping introduced in https://arxiv.org/abs/2002.11569 as it typically overfits in the end.

The writing is easy to follow. As far as what I know, there is no key missing references.

Based on the concerns listed above, my score is a reject unfortunately, but I look forward to the discussion with the authors, I will re-evaluate the paper after the rebuttal period.
review_title: Some Concerns Needed to be Addressed

final_score: rating: 7: Good paper, accept
review_content: Authors propose a second order approximation based training procedure to build robust networks against \ell_inf and \ell_2 attacks. 

The paper is very well written and ideas are clearly stated. The core intuition rests on building an approach similar to adversarial training, but without the computational expense and empirically inexact inner maximization procedure. The inexactness of inner maximization in adversarial training is indeed a crucial issue, which the authors highlight.  

The authors first formulate a second order objective which uses the Hessian information of the loss function Eq. 6. Through Proposition 1 and the approximation in Eq. 10, they derive a bound on this regularizer which only depends on first order terms, hence making it computationally inexpensive (Algorithm 1 SOAR). To my knowledge, the derivations are clean.

The experiments are only done on ResNet and not on WideResNet, although authors have reported the performance of other robust algorithms on WideResNet. The show that robust accuracy of ResNet-10 with SOAR is better than all competing algorithms using ResNet-10 and comparable to that other algorithms when used on WideResNet. It will be interesting to see the gains of SOAR on WideResNet as well.

Another key observation from the experiments is that SOAR does not lead to as significant drops in standard accuracy (i.e. not under attack), which I do think is also another important contribution of this paper. 

I do have a small issue with authors portraying regularization and robust training to be two separate objectives. Regularization is not specific to generalization properties, so I don't see why they dedicate several paragraphs to show that the two are the same. 

Typos:

l_FOAR Eq.4 - should be <= not =
review_title: New regularization based training against adversarial examples

final_score: rating: 7: Good paper, accept
review_content: Summary:

The paper proposed a regularizer loss as an alternative to adversarial training to improve the robustness of neural networks against adversarial attacks. The new regularizer is derived from a second-order Tyler series expansion of the loss function in the model robustness optimization problem. Clear mathematical derivation and thoughtful empirical experimental results are provided. The proposed method outperformed baseline adversarial training methods with better or on part robustness and higher standard accuracy.

Pros:
- The paper is really well-written and easy to understand. Both the intuition behind the method is conveyed clearly and the potential drawback of the method is discussed with solutions.
- The performance of the proposed method is outstanding with a large margin compared with other baseline methods.The experiments are extensive and rigorous. 
- The idea is easy to implement.
- There is a lot of valuable discussion and experiments presented in the supplemental materials. In fact, some might be better to be moved to the main text.

Cons:
- As also discussed in the challenges in Appendix E6, an expected advance of this approach would be the training efficiency. However it is not well discussed in the main text. It would make the paper an even better one with some efficiency optimization. 
- I have some concerns about the sampling steps in the regularization loss. Only a single sample is drawn for both eta and z. How does this sample affect the stability of the training? Some empirical analysis on the intermediate values would be nice.
- The author mentioned in the appendix that batch normalization layers are removed from the SOAR experiments. Do you also remove these layers from the baseline experiments? If not, how does the removal of BN layers impact the performance?

Other detail comments:
- I think the clipping of the regularization loss should also be mentioned and discussed in the main text.
- Missing space in conclusion: l2 attacks

---------------------------------------------
post-rebuttal
I would like to thank the reviewers for their efforts to improve the draft. Most of my concerns were resolved. However, I agree with other reviewers on the fact that the proposed method only present advantages in certain limited networks and scenarios.  To calibrate this weakness, I downgrade my score to 7. Overall, I think the paper explored an interesting and promising direction to improve network robustness using second-order regularization and solid progress was made. I will recommend accepting the paper for publication.

review_title: Official Blind Review #3

Meta-review: This paper proposes a regularization approach based on the second-order Taylor expansion of the loss objective to improve robustness of the trained models against \ell_inf and \ell_2 attacks. It is interesting to explore the second order-based regularization approach for network robustness. However, as pointed out by the reviewer, a major drawback of this approach is that SOAR is broken under a stronger attack - AutoPGD-DLR.  In addition, the theoretical bound seems very loose in the \ell_inf case.  
Decision: Reject