Kati8/ICLR_2023_2025 huggingface dataset:
authors: Jing Wang
authors: Liang Cao
authors: Guanrong Li
reviews: 
Comments: In this paper, the authors propose a new plug-in module, which can help the model against adversarial attacks. After using such a model, only standard training can fulfill the robust requirement.
Strengths: 1. The authors propose a random module to defend against various adversarial attacks.

2. The proposed module is lightweight without introducing too many parameters.

3. The authors consider different model structures cooperating with the proposed method.

4. There are EOT experiment results, which is important for a randomization-based defense.
Weaknesses: 1. Stochastic Neural Networks (SNNs) have been proposed for many years, which are not a novel approach to defend against adversarial attacks. Therefore, I think the authors overclaim their contribution.

2. The authors do not mention any related works under the topic of SNNs or other stochastic methods. I am not sure whether the authors are on purpose or not. But the Related Works should mainly discuss the most related papers.

3. The authors do not compare any SNN baselines, which causes unfairness in the experiments. For example, I can simply find a paper [1] from Google Scholar, which discusses SNN in adversarial defense. In experiments, they compared various stochastic methods, which I cannot find in this paper. This unfair comparison causes a false contribution.


[1] Yang, H., Wang, M., Yu, Z., & Zhou, Y. (2022). Rethinking feature uncertainty in stochastic neural networks for adversarial robustness. arXiv preprint arXiv:2201.00148.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 1 poor
Clarity: 2 fair
reviews: 
Comments: This paper addresses the challenge of adversarial attacks on deep learning models. The authors propose an approach that enhances network robustness without knowledge of the attack strategy. They introduce an input layer that reduces the impact of malicious perturbations, achieving robustness against various attack types through standard training with clean images on datasets like CIFAR-10 and ImageNet.
Strengths: - The authors focus on an important topic, namely adversarial training to robustify deep neural networks. 
- The idea of an approach that requires no prior knowledge of attacks is interesting. 
- The approach is straightforward. 
- The authors evaluate their approach on ImageNet.
Weaknesses: - Trivial technical contribution: The manipulation of early or other intermediate features has been proposed various times in the literature. Most of these defenses have also been defeated. 
- The authors do not provide any ablation studies to justify their design choices. 
- The title is chosen too general and is vague. 
- The writing is poor: 
	- Some parts of the paper are incomprehensible. 
	- The introduction is written like a related work section
	- The contributions are not clearly explained and distinguished to previous works
	- A proper explanation of the proposed approach  
- I can't grasp what Figure 2 is supposed to show. 
- While the authors evaluated with AutoAttack I am wondering how this method performs against the PGD-attack. 
- The authors might encounter obfuscated gradients here. Hence the authors should follow the guidelines in [1] and [2] and evaluate with BPDA. 
- Did the authors try if their approach also works for vision transformer models? 

[1] Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples; ICML 2018   
[2] On Evaluating Adversarial Robustness; ArXiv 2019
Recommendation: 1: strong reject
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 1 poor
Clarity: 1 poor
reviews: 
Comments: The paper introduces a specialized input layer to improve the adversarial robustness of deep neural networks. Each pixel in the normalized images goes through a perturbation and multiplication process, and then are fed into a Sigmoid function before proceeding with the rest of the network. Evaluations on CIFAR10 and Imagenet-1k in the white-box setting demonstrate that the resulting networks are robust to various $\ell_p$ bounded perturbations generated using AutoAttack.
Strengths: The proposed input layer design introduces virtually no computation overhead while improving the adversarial robustness of the network in the while-box setting, against gradient-based attacks. Empirical evaluations are performed on CIFAR10 as well as larger dataset such as Imagenet. Visualizations presented in Figure 2 are helpful in understanding the effect of the proposed input layer.
Weaknesses: Figure 2 shows that the output of proposed input layers are mostly 0's and 1's, which are towards the saturation range in the sigmoid function. This means that the robustness improvement comes mostly from obfuscated gradients [1]. In other words, the network is having trouble finding effective adversarial perturbations, rather than being truly more adversarial robust compared to the baselines. 

[1] Athalye et al, Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples ICML 2018
Recommendation: 1: strong reject
Reviewer confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
Soundness/correctness: 2 fair
Clarity: 1 poor