Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper discusses a very interesting question: what is the relationship between adversarial robustness and cross-domain transferability. The previous studies show that a more robust model can transfer better. This paper argues that the true reason for the cross-domain transferability is not the adversarial robustness, but the effect of regularization, which can also be achieved through other methods, such as data augmentation.
main_review: Strengths:
1. This paper challenges a fundamental claim in ML: stronger robustness leads to better domain generalization, and gives a solid analysis. 
2. This paper presents a theoretical framework to analyze the relationship between regularization strength and domain transferability. 
3. The empirical experiments are also very interesting. Specifically, they show that the robustness does not necessarily correlate to domain transferability.

Weaknesses/Question:
1. How to obtain robust accuracy? Using PGD to evaluate the robust accuracy while controlling the norm of the last layer is very tricky. See the temperature scaling attack here https://arxiv.org/pdf/1607.04311 . This is my biggest concern, please validate the results using a more advanced attack method, e.g., AutoAttack. If you can obtain the same conclusion with AutoAttack, I will raise my rating. 





summary_of_the_review: This paper provides a great theoretical framework for analyzing domain transferability and explains why improving adversarial robustness can improve domain generalization. The empirical experiments are very interesting. However, the method of evaluating the adversarial robustness is not very appropriate. This is very important, as it may alter the conclusion of this paper, especially for the norm controlling experiments. If the author can obtain the same conclusion with a more advanced attack method (e.g., AutoAttack), I will raise my rating.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper studies theoretically how adversarially trained models can transfer better, and disentangle the robustness and accuracy on the target domain. They claim that the main reason is more of regularisation rather than robustness. Corresponding examples and theory are presented.
main_review: The paper is well-written.

However, there are several big problems:

1. Overselling: transfer better due to regularization is not initiated by this work as they claim, for instance, Adversarial Training Helps Transfer Learning via Better Representations by Deng et al. have theoretically analyzed the regularization effect of adversarial training. Also, data augmentation served as regularization has also been extensively studied. Such as in On Mixup Regularization by Carratino, L et.al, Dropout Training as Adaptive Regularization by Wager et al.
More discussion is needed
2. The counterexample in 3.1, the explanation and intuition is not right, delta wishes to maximize the loss, instead, the author say there exists delta such that example is pushed outside the manifold of input, so the robustness could be arbitrarily strong. This intuition is completely mysterious. 
3. The monotonic relationship between regularization and performance is not quite right, since it is common sense that too strong regularization could result in bad performance. Thus, this claim is a little too exaggerated.
4. The tight upper bound has no lower bound to support. The tightness is not rigorously justified.


summary_of_the_review: This paper is overclaiming their contribution. Details are in the main review.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper aims to investigate the theoretical connection between domain generalization (aka Transferability) and adversarial robustness in some general settings. Authors claim that a thorough theoretical treatment of this problem has not been given yet, and therefore set out to establish a number of fundamental relations.

A simple example has been proposed which shows the existence of cases, where adversarial robustness and transferability can be independent (or even negatively correlated). Also, paper proves that adding more restriction (tighter regularization) on the feature extractor stage of a learning algorithm gives better domain generalization. Additionally, some intrinsic and fundamental measures have been defined to bound the domain generalization error for transferring a learned model from domain S to domain T. In this regard, uniform convergence bounds have been derived to show the gap between empirical and statistical versions of such measures remain small or even converge to zero when sample size asymptotically increases.

Finally, a number of experimental results have been shown to support the above theoretical achievements. I have not gone through the experimental parts nor the proofs, yet.
main_review: This paper investigates a very interesting problem from a theoretical standpoint. Author(s) have been somehow successful in bounding the domain generalization loss from a source domain to a target, via a number of newly-defined (and possibly fundamental) measures which involve the distributions and function sets of the problem configuration. In particular, a new (as far as I am aware) measure has been proposed which mimics the role of Rademacher complexity, but this time works when one wants to transfer a learned model from a domain S to a target domain T. I haven't completely checked the proofs yet, but results seem legit.


The main problem is that although the overall theoretical framework is interesting, but results might not be that much strong at the moment With some extra time and effort, far more interesting achievements can be reached. For example, the $\left(\mathcal{G},\mathcal{F}\right)$-pseudometric between source and domain distributions, i.e., $\mathcal{D}_S$ and $\mathcal{D}_T$, can be more mathematically analyzed and perhaps new theoretical insights might become available. In particular, how the similarity (for example in terms of TV distance) between $\mathcal{D}_S$ and $\mathcal{D}_T$ affects this measure? In another example, showing that adding more regularization on the feature extractor gives better "domain generalization" is not enough; Since this might degrade the overall performance in return. Please note that the constant function $f(x)=0$ performs equally bad on all domains. However, author(s) have not discussed this issue in details.

The other problem is that there are numerous grammatical errors and also a number of minor flaws inside the main body. Writing of the paper should be completely reviewed. I have pointed to some of the grammatical errors below in the "Minor comments" section. Also, some minor technical ambiguities are noticeable: At some point, authors have referred to Vapnik-Chervonenkis (VC) dimension of a function set, which includes functions from $\mathcal{X}$ to $\mathbb{R}^{+}$. Based on my understanding of SLT, VC-dimension can only be defined for a class of binary classifiers, and not functions that output continuous values.

-----------------------------------------------------------------------------------------------------------------------------------

Minor comments and suggestions:
- Abstract -> "On one hand,"
- Abstract -> "Norm of last layer norm"?
- Introduction -> please refrain from underlining long phrases for the sake of emphasis. Instead, you can use quotation marks ``...", or the italic form.
- Section 2 (Related Works) has been poorly organized. Sentences are vague, unrelated to one another, and need much more discussion to convey meaningful information to the reader. Fo example, what exactly "generalizing beyond convex hull" refers to here? Or, what are $\mathcal{H}$-divergences.
- Please use \ eqref{} (and not \ ref{}) to refer to equations. For example, your first reference to equation (1) is not standard.
summary_of_the_review: The proposed analysis, in its current shape and form, might not be ready for publication at ICLR. While the proposed framework in this paper is interesting and definitely worthy of more analysis, the current results including all high-probability concentration bounds and etc. are still incremental and need more work.

The other problem is writing. There are grammatical errors throughout the paper and the quality of writings can be greatly improved.

Overall, I believe the paper is not ready for publication yet. My vote is weak reject.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper aims to convey the message that adversarially robust models may not have better transferability in terms of transfer learning in vision tasks. However, this message is unclear due to the mixture of data augmentation, regularization, robustness in the presentation. Some definitions are confusing and the conclusion seems to contradict with existing literature, e.g,  Salman et al arxiv: 2007.08489.

--post rebuttal--

Thanks to the authors for the draft revision and the additional appendix C. Now the paper is clearer to me: the general idea is to say that robustness is a type of regularization, and this regularization is the key to generalization. However, I think the former is not novel as already mentioned in Roth et al NeurIPS 2020. Besides, there are still many presentation issues even after the revision, e.g.:
1) Prop 3.1 mentioned the relative domain transferability, but the formal definition is introduced later in Def 1.
2) The added paragraph is confusing to me. How would you define the input space ${\cal X}$? Is it a compact set? Why would the perturbation go outside ${\cal X}$? Shouldn't $x + \delta$ still be in the domain of $f_c^{{\cal D}_{\cal S}}$ as otherwise it is not well-defined?
3) Def 2 should be compared with existing metrics. 
4) In Section 3.4 the authors use the squared loss but in experiments they use cross entropy loss.

Despite the interesting topic, I would keep my current score until a more well-written version is presented.


main_review: Strengths: This paper studies the relation between robustness and generalization, which are both interesting and relevant topics in machine learning. On the theoretical side, it provides a new definition called relative domain transferability loss as well as a pseudometric, and gives generalization bound based on Rademacher complexity. On the experimental side, it says with a bigger regularization and stronger augmentation, the generalization measured by relative DT accuracy improves.

Weaknesses: 

This paper is not clearly written and there are many confusing parts. See below: 
1. Clarity: I'm not sure how the robustness is defined in this paper. Throughout the paper, I only see the discussion on the regularization (either Jacobian or last-layer) and the data augmentation, but how they correlate with robustness is unclear. Is the robustness mentioned distributional robustness or robustness wrt sample perturbation? More clarification is needed.
2. Clarity: In Sec 3.1, are you doing regression or classification? In Sec 4 the experiments are classification but here you are treating the label $y_S$ as real number. Shouldn't the predictor $f$ output a label?
3. Clarity: Prop 3.1, what is the relative domain transferability? Any reference? 
4. Clarity: I'm not sure about the motivation of Def 2. In domain adaptation there has been many papers that study the distance metric, e.g.:

[1] Ben-David et al, A theory of learning from different domains, Machine Learning 2010.

[2] Mansour, Y., Mohri, M., and Rostamizadeh, A. Domain adaptation: Learning bounds and algorithms. COLT 2009.

[3] D. Acuna, G. Zhang, M. Law and S. Fidler, f-Domain-Adversarial Learning: Theory and Algorithms, ICML 2021.

Could you compare your Def 2 with existing metrics? 

5. Clarity: In Theorem 3.2, what is individual loss function? How would it relate to $\ell_{D_S}$?
6. Minors: Def 3: reference for Rademacher complexity is needed; Prop 3.2, $D'$ is not defined; 
7. Clarity: in the experimental section, it is observed that wth stronger regularization/augmentation the DT acc is higher. However, the meanings of Relative DT Acc and Robust Acc are not clear or not well-explained in the paper.
8. Clarity: how would your theory help in the experiments? The connection between regularization and the proposed pseudo metric is not clear.
9. Novelty: how would you compare the conclusion in your paper with Salman et al 2020? In their paper it is claimed that robustness helps generalization, which seems to be contradictory.

summary_of_the_review: Overall this paper aims to address an important issue: does robustness help generalization? However, in practice it mostly does experiments on regularization and data augmentation, which may not be directly related to robustness. Comparison with existing work is needed, and the presentation (especially some introduction of Theorems and Definitions) needs to be improved. Therefore I would not recommend acceptance.
review_title: null

Meta-review: The paper tries to analyze the relationship between regularization, adversarial robustness, and transferability.

Pros:
- An interesting problem was tackled.

Cons:
- The main claim (Prop.3.1) is almost trivial.  Prop. 3.1 shows that "relative" transferability is smaller for stronger regulariation, which is just a slight generalization of the triangler inequality ||YT = YS|| <= ||YT - Y|| + ||YS - Y|| for any Y in Fig.2.  
- Experiments show negative correaltion between the relative transferability and accuracy, which is trivial.  Large regularization degrades the accuracy which increases the "relative transferability".  "Absolute" transferability in Appendix doesn't show clear negative correlations.
- Salmann et al. claimed that adversarially "trained" models transfer better, and did not claim that there are positive correlations between the transferability and robustness for general classifiers without adversarial training.  So the finding in this paper is not surprising nor against Salmann et al.

To prove that adversarial robustness is just a subproduct of regularization, the authors should show that the "absolute" transferability by adversarially trained classifier can be achieved by other regularization.  Defining relative transferability is fine if it is just a decomposition to conduct an analysis of the absolute transferability.  But no conclusion on the performance should be made from its analysis, because a trivial correlation will appear, i.e., (A-B) and B should be negatively correlated unless A strongly correlates to B.  Also, this is highly misleading so that some reviewers seem to have misunderstood that the authors would have claimed that negative correlations between regularization and absolute transferability were observed in the original submission.

Overall, the paper requires major revision.
Decision: Reject