Venue: ICML 2021 Workshop AML

Reviews:

final_score: rating: Accept
review_content: This paper is well organized and the expression is clear.

This paper proposes a novel idea in adversarial training that adversarial samples are generated by both multiple semantic transformations and an $l_\infty$ threat model. This paper not only optimizes each attack models but also optimizes the order of them. This method significantly improves robust accuracy on attack models compared to sota adversarial training methods.

The experiments are solid in the comparison with existing adversarial training methods, while they are only conducted on CIFAR-10, which might weaken the effectiveness of the conclusions.

I’m confused by the notation $A$ in equation (2). Is $A$ a list composed by $N$ attacks selected from $\Omega_A$? This is necessary to be mentioned in your paper.

review_title: It is a novel work in adversarial training which uses the worst-case samples from the combination of multiple semantic attacks

Meta-review: This paper proposed a novel idea in adversarial training. The experiments are solid. 
Decision: Accept (Poster)