Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: ###################
Summary:

This paper studies adversarial defense by combing purification and self-supervised loss. During inference, the authors propose an online-purification method based on (clipped) iterative gradient ascent. The loss used by purification is from some pre-defined self-supervised tasks. During training, joint loss of softmax and self-supervised loss are used to match the purification process in inference. Experiments on MNIST10 and CIFAR10 demonstrate the effectiveness of the proposed method over several SOTA baselines. The evaluation considers both the white-box and black-box attack setup.

###################
Pros

1. The proposed method is well-motivated and reasonable.

2. The paper is clear and easy-to-follow.


###################
Cons

1. What is the T  for the online purification? Large T will significantly slow down the test time efficiency.

2. In Table 2, "FGSM AT" + "PGD", why it is "37.4%"? My understanding is this should be very small value, since multi-step PGD attack is pretty strong.

3. I am curious to see the gain by purely online-purification, maybe using the encoder by "PGD AT".

4. Seems like self-supervised tasks are pretty ad-hoc. Is there a principled way of selecting a good self-supervised task?

5. The two datasets used in the paper represents limited visual patterns. I think larger-dataset needs to be used, like cifar100, tiny imagenet.

######################### post-rebuttal

I appreciate the additional explanations and experiments by the authors. I also read the public discussion threads. I raise my score to 6. Two things for future:
- Make it work on bigger and more realistic images, imagenet, pascal, coco, etc. Now the adversarial community and deep learning community in general, highly relies on experiments, because theoretical guarantee is still mysterious. So we should push the field forward, by proving ideas on harder datasets. 
- Explore stronger attacks, particularly gradient-free attack to avoid the obfuscated gradients.




review_title: reasonable and interesting idea, but needs more empirical validation

final_score: rating: 7: Good paper, accept
review_content: Summary: The paper introduces a defence for adversarial attack based on minimising a self-supervised loss on the test examples. Authors work under the assumption that minimising the self-supervised loss would be equivalent to minimising the supervised loss (to which they don't have access at test time). Authors evaluate their method on MNIST and CIFAR.

Strengths:
- The paper address the important topic of adversarial defence. Given the numerous adversarial attacks that have appeared in the last years and the deployment of novel classification methods into real world tools, I believe the field of adversarial defence is relevant.

- Authors use in a smart way the self-supervised loss which is traditionally used for learning good representation as pretrainining networks. I think self-supervised learning should extend its usage over the traditional framework and this paper is one example of its potential.

- Authors are also able to compute its own budget using the self-supervised loss, which I believe it's additional evidence that the usage of self-supervised learning for adversarial defence is interesting and useful. 

- Quantitative results show how the proposed method is competitive with methods.

- Authors also evaluate the effectiveness of the method when faced with an attacker knowing which defence method is using. Although I consider the proposed attack a baseline attack (maybe other alternatives can be used), I believe it's a relevant result. 


Weaknesses:
- I am missing evaluation of the method in larger scale datasets, or more natural images dataset. I think for this methods to be applicable and useful, authors should demonstrate its usefulness into real data. 

- I am missing some images of the CIFAR dataset similar to Figure 2. I know the supplementary material shows some, but it would be good to include some into the main paper.

- I think authors should at least have one of the self-supervised methods (LC, RP or DR) show performance in both dataset. Given a new dataset, which methods should I select?

Conclusion: I believe the paper presents an interesting method with strong experimental results. The paper deserves acceptance as I believe it contains enough evidence to proof the effectiveness of the method. 

review_title: Interesting method and results, I am missing results on larger and more complex datasets.

final_score: rating: 7: Good paper, accept
review_content: [Summary]
Online defenses of adversarial examples is an old topic: Given an input x (potentially adversarially perturbed) at test time, we want to sanitize x to get x', on which the trained classifier $g \circ f$ gives the correct answer. This paper proposes a new architecture for online defenses via self supervision. There are two new things in the proposal:

1. There is an explicit representation function f, namely the classifier is decomposed into $g \circ f$. And the auxiliary self-supervised component h works on the same representation. This thus creates a Y-shape architecture that is "syntactically" similar to the training structure in unsupervised domain adaptation (e.g., domain adversarial neural networks). This architecture for online defense seems new (as far as I know).

2. The paper leverages an interesting hypothesis that for a common f, a large classification loss happens if and only if a large self-supervision loss happens. And this paper provides solid evidence to justify this -- namely in Section 4.1 (auxiliary-aware attacks), it evaluates the defense against an adversary that is aware of h, in order to create adversarial examples that explicitly breaks the hypothesis (i.e. large classification loss but small self-supervision loss).

3. For the experiments -- the paper trained f, g, and h under Gaussian corruptions, and indeed found that this online purification strategy provides robustness under adversarial perturbations, even for auxiliary-aware attacks, which is interesting.

[Assessment]
1. My first worry is that the performance of the defense is still much worse than the performance from direct adversarial training (for example, check the MNIST numbers). For example, under PGD, on CNN architecture we can achieve 80%ish accuracy. Note that for MNST, a simple discretization can already achieve almost-perfect accuracy. This is especially the case if we consider auxiliary-aware attacks.

2. Following (1), what worries me more is that online-purification still needs to be aware of the attack type. Namely if one looks into equation (4), the objective has encoded norm-based attacks within it. This makes the results less interesting.

3. All in all, my major doubt is what is really the benefit of reduced training complexity if we cannot achieve better robustness, and also the defense still needs to be fully aware of the attack type? For these reasons, I vote for a weak reject.

[Questions]
1. Why do we need to know the results for FCN (fully connected networks)?

2. I am not sure the numbers reported for adversarial training match the state of the art reported in the MNIST challenge leaderboard: https://github.com/MadryLab/mnist_challenge. There the SOTA MNIST model always has >88% accuracy (so I am a bit skeptical about DF can bring down the accuracy to 78% for PGD AT). Also, how about applying those attacks for the self-supervision defense? (that's an additional request). Similarly, for CIFAR10, as shown by https://github.com/MadryLab/cifar10_challenge, PGD AT is never under 43%, but in Table 2, the robust accuracy is only 2% under CW attack. This is suspicious.

[Post rebuttal]

After more discussion and reading through the revision, I think this is a good paper and will be useful to the community for an instance of test-time defenses.
review_title: Official Blind Review #2

Meta-review: This paper presents a defense scheme for adversarial attacks, called self-supervised online adversarial purification (SOAP), by purifying the adversarial examples at test time. The novelty of this work is in its incorporation of self-supervised representation learning into adversarial defense through purification via optimizing an auxiliary self-supervised loss. This is done by jointly training the model on a self-supervised task while it is learning to perform the target classification task in a multi-task learning setting. Compared with existing adversarial defense schemes such as adversarial training and purification techniques, SOAP has a lower computation overhead during the training stage.

**Strengths:**
  * It is novel to incorporate self-supervised learning for adversarial purification at test time.
  * SOAP’s training stage based on multi-task learning incurs low computation overhead compared with the original classification task.

**Weaknesses:**
  * Although the proposed adversarial defense scheme is computationally cheaper than the other existing methods during the training stage, it does incur some overhead during test time. This may be undesirable for some applications in which efficiency during test time is an important factor to consider.
  * The choice of a suitable self-supervised auxiliary task is somewhat ad hoc. The performance varies a lot for different auxiliary tasks.
  * The experimental evaluation is only based on relatively small and unrealistic datasets even after new experiments on CIFAR-100 have been added by the authors.

It is said in the paper that SOAP can exploit a wider range of self-supervised signals for purification and hence conceptually can be applied to any format of data and not just images, given an appropriate self-supervised task. However, this claim has not been substantiated in the paper using non-image data.

Despite some limitations and that some claims still need to be better substantiated, the paper presents some novel ideas which are expected to arouse interest for follow-up work in the adversarial attack and defense research community.

Decision: Accept (Poster)