ALFA: Adversarial Feature Augmentation for Enhanced Image Recognition
Authors: Tianlong Chen
Yu Cheng
Zhe Gan
Yu Hu
Zhangyang Wang
Jingjing Liu
Venue:  (2021)
Keywords: Adversarial Training
Image Recognition
Generalization

Abstract: Adversarial training is an effective method to combat adversarial attacks in order to create robust neural networks. By using an auxiliary batch normalization on adversarial examples, it has been shown recently to possess great potential in improving the generalization ability of neural networks for image recognition as well. However, crafting pixel-level adversarial perturbations is computationally expensive. To address this issue, we propose AdversariaL Feature Augmentation (ALFA), which advocates adversarial training on the intermediate layers of feature embeddings. ALFA utilizes both clean and adversarial augmented features jointly to enhance standard trained networks. To eliminate laborious tuning of key parameters such as locations and strength of feature augmentations, we further design a learnable adversarial feature augmentation (L-ALFA) framework to automatically adjust the perturbation magnitude of each perturbed feature. Extensive experiments demonstrate that our proposed ALFA and L-ALFA methods achieve significant and consistent generalization improvement over strong baselines on CIFAR-10, CIFAR-100, and ImageNet benchmarks across different backbone networks for image recognition. 

Under review as a conference paper at ICLR 2021
ALFA: ADVERSARIAL FEATURE AUGMENTATION FOR ENHANCED IMAGE RECOGNITION
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training is effective method combat adversarial attacks in or- der to create robust neural networks. By using an auxiliary batch normalization on adversarial examples, it has been shown recently to possess great potential in improving the generalization ability of neural networks for image recognition as well. However, crafting pixel-level adversarial perturbations computationally expensive. To address this issue, we propose AdversariaL Feature Augmentation (ALFA), which advocates adversarial training on the intermediate layers of fea- ture embeddings. ALFA utilizes both clean and adversarial augmented features jointly to enhance standard trained networks. To eliminate laborious tuning of key parameters such as locations and strength of feature augmentations, we further design a learnable adversarial feature augmentation (L-ALFA) framework to au- tomatically adjust the perturbation magnitude of each perturbed feature. Extensive experiments demonstrate that our proposed ALFA and L-ALFA methods achieve significant and consistent generalization improvement over strong baselines CIFAR-10, CIFAR- and ImageNet benchmarks across different backbone net- works for image recognition.
INTRODUCTION
Neural networks often fall vulnerable when presented adversarial examples injected with imper- ceptible perturbations, and suffer sigmificant performance drop when facing such attacks (Szegedy) et al. 2013: Goodfellow et al., 2015b). Such susceptibility has motivated abundant studies on ad- versarial defense mechanisms for training robust neural networks (Schmidt et al.) 2018 [Snn et al.) 2019 Nakkiran 2019 Stutz al.
2019 Raghunathan et al. 2211)). among which adversarial train-
ing based methods (Madry et al. robustness than others.
2018b Zhang et al. 2019a) have achieved consistently superior
The general focus of adversarial training is to enhance the robustness of gradient-based adversarial examples. A few recent studies (Zhu et al. 2020 Gan et al.; (2020) turn to investigate the generaliza- tion ability of adversarial training on language models. However, in-depth exploration of extending this to the vision domain is still missing. Xie et al. (2020) proposes to utilize adversarial examples with an auxiliary batch normalization to improve standard accuracy for image recognition, but it still suffers from expensive computational cost from the generation of pixel-level perturbations.
To address this issue, we propose AdversariaL Feature Augmentation (ALFA) as a natural extension of adversarial training, with focus on leveraging adversarial perturbations the feature space to improve image recognition on clean data. As illustrated in Figure I ALFA introduces adversarial perturbations multiple intermediate layers. These perturbed feature embeddings act as a special feature augmentation and implicil regularization to enhance the generalization ability of deep neural networks. Consequently, two challenges arise: (i) how to efficiently find the best locations to intro- duce adversarial perturbations; and (iz) how to decide on the strength of the created perturbations. Although a few recent works (Zhu et al. 20200; Gan et al. 22020] Sankaranarayanaa et al. (2017) look into this field, they either add perturbations in the input embeddings or all the intermediate features, yet have not reached a coherent conclusion.
To efficiently learn optimal strategy of perturbation injection, further propose learnable adversarial feature augmentation (L-ALFA) framework, which is capable of automatically adjust- ing the position and strength of introduced feature perturbations. The proposed approach not only

---

Under review as a conference paper at ICLR 2021
Feodforward Prediction Clean Feature Embeddings
Adversarial Augmented Feature Embeddings
Generate Adversarial Feature Perturbations
Clean Images
lat
lstd
Network Backbones
Classifier
Figure I: Overview of Adversarial Feature Augmentation for image recognition. From left right, clean images are fed into network backbones to extract clean feature embeddings. Then, adversar- ial perturbations are generated augment several intermediate features (in the direction of purple paths). In the end, both adversarial augmented and clean feature embeddings are taken as inputs by the classifer, and optimized by adversarial (Cat) and standard training (Cara) objectives.
circumvents laborious hyper-parameter tuning, but also fully unleashes the power of adversarial feature augmentation. Experiments show that this strategy gains substantial performance margin over existing feature augmentation methods (Li et al. 2020). addition, we find that learnable ALFA and sshaustively-tunee ALFA exhibit consistent patterns: applying weak adversarial feature augmentations to the last layers deep neural networks can boost generalization performance.
The main contributions summarized follows. (t) We introduce ial feature augmentation (ALFA) to improve the generalization ability of neural networks, which applies adversarial perturbations to the feature space rather than raw image pixels. (ii) To tackle the dilemma laborious typer-paramete tuning in generating adversarial features, we propose learnable adversarial feature augmentation (L-ALFA) automatically tailor target perturbations and their locations. (iii) Comprehensive experiments on CIFAR-10, CIFAR-100) and ImageNet datasets across multiple backbone networks demonstrate the superiority of the proposed methods.
approach of adversar-
RELATED WORK
Adversarial Training Deep neural networks are notoriously vulnerable to adversarial samples (Szegedy al.] 2013 Goodfellow et al. 2015b). which are crafted with malicious yet negligible perturbations (Goodfellow et al. [2015a] Kurakin et al. 20166) Madry et al.) (0018)). order to im- prove the robustness against adversarial samples, various defense mechanisms have been proposed (Zhang et al.] 2019a] Schmidt et al., 2018 [un et al.] 2019 Nakkiran 2019 Stutz et al., [019]] Raghunathan al. 2019). Among these works, adversarial-trainine tra--rrinnnnnneeeddddd based methods (Madry al. 201 [b) Zhang et al. 2019a) have achieved consistently superior performance in defending state- thethe- adversarial attacks (Goodfellow et al. 2015a Kurakin et al.) 2016 Madry al. 2018a).
Although adversarial training substantially improves model robustness, it usually comes at the price of compromising the standard accuracy (Tsipras et al.] 2019), which has been demonstrated both empirically and theoretically (Zhang et al. 2019 Schmidt et al. 2018 Sun et al. 2019: Nakkiran
2019 Stutz et al. 2019; Raghunathan et al. 2019).
Recently, researchers start to investigate improving clean set accuracy with adversarial training XXe
ct al. 2020 Zhu et al. 2020; Wang et al.) 2019a] Gan et al., 2020; Wei & Ma. 2019) (Ishi &
Sato 2019). Xie al. (2020) shows that performance on the clean dataset can be enhanced by using adversarial samples with pixel-level perturbation generation. Zhu et al. (2020) and Wang
et al. (019a) apply adversarial training to natural language understanding and language modeling, both successfully achieving better standard accuracy. Gan et al. (2020) achieves similar success on many vision-and-language tasks. There also exist parallel studies that employ handcrafted auto-
2

---

Under review as a conference paper at ICLR 2021
generated perturbed features to ameliorate generalization (Wei & Ma 2019) Ishii & Sato 2019 robustness (Sankaranaraynaan et al. 2017).
However, two key issues remain unexplored: (i) which layers to introduce adversarial feature aug- mentations; (ti) how strong the perturbations should be. For the former, Zhu et al. (020); Wang et al. (2019a); Gan al. (2020) try to perturb the input embeddings of transformer models, while Wei & Ma (2019); Sanaaaaaaaaaaaanaaaaaaaaa et al. (017)) insert perturbations to all layers of a convolutional network. Regarding the above issue, all the methods need arduous and heuristic tunings. In our pa- per, we present a different observation that augmenting the last layers' feature embeddings with weak adversarial feature perturbations can gain higher standard accuracy. The L-ALFA framework inspired by this observation can effectively alleviate laborious tuning, which otherwise is inevitable.
Feature Augmentation Although pixel-level data augmentation techniques (Simard et al. 1993
Schölkopf et al., 1996) have been widely adopted, feature space augmentations have not received the same level of attention. A few pioneering works propose generative- based feature augmentation approaches for domain adaptation (Volpi et al. (0188), imbalance classification (Zhang et al. 2019b), and few-shot learning (Chen al. 2019). Another loosely related field is feature normalization (Toffe & Szegedy 2015, Li et al. 2020). Možx (Li et al.) 2020) is newly proposed method that can be regarded as a feature augmentation technique, which leverages the first and second-order moments extracted and re-injected by feature normalization. It is worth mentioning that all the approaches aforementioned are orthogonal to our proposed method, and can be combined for further generalization improvement, which is left future work.
3 ADVERSARIAL FEATURE AUGMENTATIONS (ALFA)
In the proposed ALFA framework, we generate adversarial perturbations in the intermediate feature embedding space, rather than applying perturbations to raw image pixels as in common practice. Thus, adversarial training can be formulated as effective regularization to improve the general- ization ability of deep neural networks.
3.1 NOTATIONS
Given dataset D = fx,y) y), where x is the input image and y is the corresponding one-hot ground- truth label. Let f(x: @) represents predictions of deep neural networks, and fi(x; @(+) m++ is the intermediate feature embedding from the i-th layer. The (r + 1)-th layer denotes the classifier, therefore fx+ (r+1)) = f(x: O). Adversarial training can be formulated as the following
min-max optimization problem:
min @
EX max (f 0) |1,1,
(1)
where is the adversarial perturbation bounded by the Ep norm ball, which is centered at x with radius which is the maximum perturbation magnitude. Las is the cross-entropy loss for adversarial
training (AT). E(xY)D takes the expectation over the empirical objective on the training dataset D.
The inner optimization generates adversarial perturbation 5 via maximizing the empirical objec- tive. It can be reliably solved by multi-step projected gradient descent (PGD) (Madry et al. 2018b) (without loss of generality, we take ||- |loe perturbation as an example):
8 = IT ||l| (5, + a cr.-sgg(( svgn(VxLat (/(x + 6,; θ O;y)],
(2)
where / is the number of steps, a denotes the learning rate of inner maximization, sgn is the sign function, and Lai is the adversarial training objective on adversarial images.
3.2 PERTURBATIONS THE EMBEDDING SPACE VIA ALFA
Here, we extend the conventional adversarial perturbations to the feature embedding space. We start from the training objective of ALFA follows:
min Exxy)D (x ①: + X
Σ
max 1889
-000; +
Lae (xx(f((x;(())
(3)
Se
3

---

Under review as a conference paper at ICLR 2021
where Latd is the cross-entropy (XE) loss on clean images, Lat here is the cross-entropy loss for adversarial training (AT) on adversarial augmented feature embeddings. is the hyperparamter to control the influence of AT' regularization, which tuned by grid search. 563 is the adversarial perturbation the feature of layer i, generated follows:
[1 (8% + a sgn Vx ( ,
0.v))
(4)
is worth noting that, for crafting 8(), at each step, the gradient is only back prok-pppppaaeed to the i-th layer without going further, which much more computationally efficient compared to gener- ating perturbations in the input embedding space. In practice, we set the maximum magnitude of crafted feature perturbation be unbounded, and the projected gradient descent will be replaced by gradient descent.
Standard Accuracy (%)
Baseline
Settings
93.0
ResNet-20s
ResNet-56s
92.5
Baseline
91.25
93.03
Block1&2&2
91.5
Block
0.5 255
92.52
94.38
00.0
90.5
1.0
92.47
94,47
255
Block2&3
Block
1.5
92.34
94.72
91.36
93.45
255
Block3
Table 1: Applying ALFA with different step size a to the feature embeddings from the last block of
Applying ALFA to the feature embed- dings from different blocks or the combinations of top-performing blocks. Experiments are con- duted on CIFAR-10 with ResNet-20s.
Figure 2:
CIFAR-10. Larger indi- cates stronger feature perturbations.
In ALFA, the two most essential factors are: (i) where to introduce adversarial perturbations: and (ii) how strong the perturbations should be. Table and Figure present some preliminary results to understand this. Results shows that the performance of ALFA relies particularly on the location (i.e., which blocks) and strength (i.e., step size a) of the introduced feature perturbations. An inadequate configuration (e.g., applying ALFA to all blocks 1, 2 and 3 as shown in Figure might cause accu- racy degradation. More analyses are provided in Section 4.3 To determine the best configuration, we further design learnable ad adversarial feature augmentation (L-ALFA) approach to automatically adjusting the location and strength of perturbations for best augmentation performance, which will be explained in the next sub-section.
3.3 LEARNABLE PERTURBATIONS VIA L-ALFA
To ascertain the two critical settings (locations and strength) of feature augmentations, we introduce an enhanced ALFA method, L-ALFA, which also eliminates laborious tuning. Specifically, in layer i, for the PGD-genarn -enerated perturbation (8),, we apply learnable parameter 7) to control the magni- tude of (()) before adding it to the corresponding feature embeddings. Thus. a learned near-zero 7)s indicates that it is unnecessary inject feature perturbations on layer i. Furthermore, we also intro- duce the & sparsity constraint on the learnable perturbation magnitude The design philosophy is that applying ALFA on all layers of deep neural network does not benefit (or even hurt) the standard accuracy, exemplified in andd Figure 3
The optimization problem is then formulated as:
E (xxu)>D nE.
min
Latd + A
max
(xx + + -(0:;;))) + 7. ||7
i= ||
(5)
where Land = LxE(x; y, 0), P of feature perturbations, 7 is the hyperparameter to control the sparsity level. y can be chosen from (0.5, 1.0, 2.0). To solve equation we first generate feature perturbations (4) via multi-step PGD.
1n 1}. (m 72. ) is the learnable strength
4

---

Under review as a conference paper at ICLR 2021
Algorithm Learnable Adversarial Feature Augmentation (L-ALFA).
1: Input: given Oo no, do. our case, n/o = (L, 1) E 1R")
for 2, .... . iterations do
3: Given , 7 generate adversarial perturbation 6,, =8%
)(
via multi-step PGD;
4: Given 8., perform SGD to update O Mp::
5: Project 7hn into P via the bisection method (Wang et al. 2019h).
6:
end for
Then, we minimize the empirical training objective to update the network weights O and through stochastic gradient descent (SGD) (Ruder) 2016). In the end, we project 17 into and repeat the above steps until the training converges. The full algorithm is summarized in Algorithm
4 EXPERIMENTS
We conduct extensive experiments on multiple benchmarks to validate the generalization ability of ALFA and L-ALFA, evaluating across different backbone networks for image recognition. Ablation studies and analysis of the learned distribution of perturbation magnitude are also provided.
4.1 EXPERIMENTAL. SETUP
Datasets and Backbones We consider three representative datasets: CIFAR-I0, 10, CIFAR- 100 (Krizhessky et al. (209).. and ImageNet (Deng et al. 2009). In our experiments, the original training datasets are randomly split into 90% training and 10% validation. The early stopping technique is applied to find the top-performing checkpoints are evaluated on the test set to report the performance. From our observations, the hyperparam- eters quite stable from validation to sets. We evaluate large backbone networks (ResNet- 18/50/101/152 (He et al. 2016)) on all three datasets, and test smaller backbones (Re5N55-20s/56s) as well on CIFAR- 10 and CIFAR-100 100. Ablation studies are implemented on CIFAR-10, where key observations can be generalized to other datasets.
the validation set. Then, the selected checkpoints
Training and Metrics For network training on CIFAR-10 and CIFAR-100, we adopt an SGD op- timizer with momentum of 0.9, weight decay of 5 10-4, and batch size of 128 for 200 epochs. The learning rate starts from 0.1 and decays to one-tenth at 50-th and 150-th epochs. We also per- form a linear learning rate warm-up in the first 200 iterations. For ImageNet experiments, following the official setting in Pytorch repository [ we train deep networks for 90 epochs with a batch size of 512, and the learning rate decay 30-th and 60-th epoch. The SGD optimizer adopted with a momentum of 0.9 and a weight decay of x 10-4 We evaluate the generalization ability a network with Standard Testing Accuracy (SA), which represents image recognition accuracy on the original clean test dataset.
4.2 EVALUATION AND ANALYSIS OF ALFA
For ALFA experiments, all hyperparameters are tuned by grid search, including PGD steps, step size a, and the layers to introduce adversarial perturbations. For generated adversarial feature embed- dings, we set the maximum perturbation magnitude to be unbounded ? since there are no explicit constraints for feature perturbations, and the effect of tuning can be absorbed by adjusting PGD steps and step size a.
Table 2 presents the standard testing accuracy of different models on CIFAR-10. Comparing the standard training with our proposed ALFA, here are the main observations:
(i) ALFA obtains consistent and substantial improvement over standard accuracy, e,g., 1.27% on ResNet-20s, 1.69% on ResNet-56s, and 0.51% on ResNet-50, This suggests that train- ing with augmented features generated by ALFA effectively enhances the generalization of
hnaps:/gtthhh.m//yyrreeeeaaam cwm./yyaee/caampisteenneerennnnn
In practice, the magnitude of crafted feature perturbation steadily stays in range from 0.97 to 1.10 under the &g Adversarial perturbations usually are applied the normalized feature from batch normalization.
5

---

Under review as a conference paper at ICLR 2021
Table 2: Standard testing accuracy (%) on CIFAR-10 dataset. Standard Training stands for the traditional training with only clean data. We utilize PGD-5 to generate the adversarial perturbations on the feature embeddings from the last residual block of ResNets. is unbounded here. Step size 1.0/255 for ResNet- 88 and ResNet-101, and = 1.5/255 for
0.5/255 for ResNet-20s, ResNet-56s and ResNet-50. f indicates the improvement over SA compared to the corresponding
baseline in standard training.
Settings
ResNet-20s
ResNct-56s
ResNet-18
ResNet-50
ResNct-100
Standard Training
91.25 92.52 (1 1.27)
93.03
94.30
94.73
95.17
ALFA
94.72 (f 1.69) 94.65 (1 0.35)
95.24 (1 0.51) 95.38 (1 0.21)
Table 3: Standard testing accuracy (%) on CIFAR-100 and ImageNet datasets. For CIFAR-100, apply PGD-5 to augment the feature embeddings in the last block with adversarial perturbations. e unbounded, and 0.5/255 for both ResNet-20s and ResNet-56s. As for ImageNet dataset, one-step PGD is selected for ALFA, with unbounded and a = 0.5/255. All perturbations are applied to feature embeddings the last block.
CIFAR-100
ImageNet
Settings
ResNet-20s
ResNet-56s
ResNet-18
ResNet-50
ResNet-101
ResNet-152
Standard Training
66.92
71.22
69.38
75.21
77.10
78.31
ALFA
67.79 (1 0.87)
72.36 1.14)
70 0.81)
76.23 1.02).
78.04 (1 0.94) 78.65 (1 0.34)
deep neural networks. We hypothesize that this is because adversarial perturbed features are treated as an implicit regularization, leading to better solutions for network training.
(ti) Different backbones prefer diverse strengths of adversarial feature perturbations, and there is no obvious pattern. For example, networks in middle size, such as ResNet-56s and ResNet-550, tend favor larger perturbations (i.e., a = 1.5/255) compared to small ResNet-22s (a = 0.5/255) and deep ResNet- 101 (a 1.0/255).
(itt) Shallow ResNets benefit more from ALFA than deep ResNets (e.g., 1.27% on ResNet- vs. 0.21% on ResNet-101). A possible reason is that the performance of standard trained ResNets is already saturated on the small-scale CIFAR-10 dataset, leaving little room for improvement.
Results on CIFAR- 100 and ImageNet are summarized in Table 3 We observe that ALFA consis- tently boosts the generalization ability of multiple ResNets on both CIFAR-100 and ImageNet, egg. 1.14% for ResNet-56s on CIFAR-101 1.02% for ResNet-50 on ImageNet. Furthermore, we notice that ALFA advocates different steps of PGD to achieve superior performance on diverse datasets. To fully understand these sensitive yet critical factors, we conduct systematical and comprehensive ablation study in the next sub-section.
4.3 ABLATION STUDIES
Strength and Locations of ALFA To understand the effect or the strength of injected adversarial perturbations, we implement ResNet-18 on CIFAR-10 and examine the performance across different step sizes and numbers of PGD steps. Table 4 shows that perturbing with step size obtains a larger gain by 0.35% SA. In addition, excessive weak (e.g., (e.g.. a 1.5/255) adversarial feature augmentations may incur performance degradation. For the ablation of PGD steps, we implement ResNet-18 18 on ImageNet as well. Table demonstrates that ALFA with PGD-5 and PGD-1 works the best for CIFAR-10 10 and ImageNet, respectively, indicating that the strength of generated perturbations is an essential and sensitive hyperparameter for ALFA.
1.0/255 0.5/255) or strong
Then, we analyze the effect of locations (i.e., where to apply ALFA) via two typical backbones: ResNet-56s on CIFAR-10 and R8 on ImageNet. In each setting, we present a detailed analy- sis on which layer and how many layers the feature embeddings should be adversarially augmented for achieving the best performance. Figure 3 presents the layer preference of feature perturbations when applying ALFA to different blocks or some combinations of blocks. We notice that introduc- ing ALFA to the last block achieves better standard accuracy, while the performance deteriorates

---

Under review as a conference paper at ICLR 2021
Table 4: Standard testing accuracy (%) on CIFAR-10 dataset. We perturb the feature embeddings in the last block of ResNet-18 via PGD-5 and diverse step size a. For reference, SA of standard trained model is 94.30%. TVG indicates SA improvemen/deegraattioo compared to the corresponding baseline in standard training.
Step size
U.S
100
15
2.0
4.0
265
265
255
235
ALFA
93.15 (U 1.15) 94.65 (t 0.35) 94.34 (1 0.04) 94.36 (1 0.06) 93.30 (L 1.00)
Table 5: Standard testing accuracy (%) on CIFAR-10 10 and ImageNet datasets. For CIFAR-10, we perturb the feature embeddings in the last block of ResNet-18, via PGID113/557//1 with step size
= 1.0/255. As reference, the SA of standard trained model is 94.30%. As for ImageNet, we also perturb the last block features of ResNet-18 via PGD-1/3/5 and step size a 0.5/255. The
reference SA is 69.38%.
CIFAR-10
ImageNNt
Steps
PGD-1
PGD-3
PGD-10
PGD-1
PGD-3
PGD-5
ALFA
94.46 (1 0.16) 94.43 (1 0.13)
94.65 0.35) 94.39 (1 0.09) 94.17 () 0.13)
70.19 ( 0.81)
68.65 () 0.73) 67.42 (,
1.96)
Baseline
Baseline
95.0
94.8
Block1&2&3
94.6
94.5
&4
94.4
Block
Block 1&2&3
94.0
94.2
93.5
Block 1
94.9
93-0
93.6
92.5
Block1&3&4
Block
92.0
Block 2&3
Block 2
B
Block3
Block 4
Block3
Figure 3: Standard testing accuracy (%) of ResNet-18 (Left) and ResNet-56s (Right) on CIFAR-10 dataset, with ALFA applied to different blocks and several combinations of rop-performing blocks. 'Block' represents the residual blocks in the ResNets. Block 4 of ResNet-18 and Block 3 of ResNet- 56s are the last blocks before the classifiers. The adversarial perturbations each block's feature embeddings are generated by carefully tuned configurations, including PGD-5, unbounded. c and step size
9. 1.0 1.5
255
255
255
after injecting ALFA to multiple blocks. These results demonstrate that the strength and location for ALFA play crucial role and need to be cautiously selected, which motivates us to design the learnalle framework, L-ALFA.
ALEA vs. Other Feature Augmentations One natural baseline is adding random noise to the fea- ture embeddings. For each training iteration, bution (0, (1.0/255) is applied to the same feature embeddings. Another representative feature augmentation recently proposed is MoEs (Li et al. 2020), which compared another baseline. For ALFA, we choose the best hyperparameter configurations for ResNet-56s and ResNet- on CIFAR-10. 10. i.e., perturbing the last block feature embeddings with PGD-5, and step size (a 255 1.5
random noise sampled from Gaussian distri-
255 for ResNet-56s and a 1.0 for ResNet-18), As shown in Table 7 ALFA significantly surpasses MoEx and crated from ALFA are non-trivial.
feature augmentation, demonstrating that feature perturbations gen-
ALEA vs. AdvProp We compare ALEA with AdvProp Xie et al. 2020) on CIFAR-10 with ResNet-18 and on ImageNet with EfficientNet-BO TTan Le 2019), as presented in Table Train- ing on a single GTX 1080 Ti GPU for CIFAR-10 experiments, AdvProp achieves 94.52% accuracy with 123 seconds per epoch; ALFA obtains 94.65% with 28 seconds per epoch, where standard train- ing takes 23 seconds per epoch. The experiments on ImageNet (batch size 256) are conducted on 2 Quadro RTX 6000 GPUs with 24Gx2 memory total, and the reported running time is per epoch.
We implement MoFx based on their released repository, https///giitnbhccm////////////

---

Under review as a conference paper at ICLR 2021
Table 6: Running time per epoch and standard accuracy (SA) comparison across standard training. AdvProp, and ALFA.
ResNet-18 18 on CIFAR-10
EfficientNet-B BO on ImageNet
Settings
Standard Training
AdvProp
ALFA
Standard Training
AdvProp
ALFA
SA (%)
94.30 23s
94.52 0.222
94.65 (1 0.35)
77.00 2628s
77.50 (f 0.50)
77.60 (1 0.60)
Time
28s
1238
3140s
13352s
Perturbation Magnitude
1.0
Block 1
Block 4
Block 7
Perturbation Magnitude
1.0
Block
Block
Block 7
2
Black
0.8
Block 3
Block 6
Block
0.8
Block
Block
Block 9
0.6
0.6
The Last Block
AMM
0.4
0.4
The Last Block
0.2
0.2
0.0
0.0
20
60
80
50
150
200
Epochs
Epochs
Figure 4: The learned distribution of perturbation magnitude vector n in L-ALFA training epochs on ImageNet (Left) and CIFAR-10 (Right). The curves of the last block (i.e., Block 9) feature embeddings highlighted by black arrows.
Table 8: Standard testing accuracy (%) of L-ALFA with different ResNets (dim(n) = 9). Perfor- mance differences computed between L-ALFA/ALFA and Standard Training.
Datasets
CIFAR-10 (ResNet-18)
CIFAR-I00 (ResNet-56s)
ImageNet (ResNet-50)
Standard Training
94.30
71.22
75.21 76. (f 0.91)
I-AL.FA
94.62 (1 0.32)
72.40 (f 1.18)
ALFA
94.65 (1 0.35)
72.36 (f 1.14)
76.23 (f 1.02)
As shown in Table 6 ALFA obtains similar performance improvement with less computational cost, compared with pixel-level adversarial augmentations (e.g., AdvProp).
Robust Performance of ALFA Although the robust testing accuracy (RA) is not the focus of ALFA, we report for completeness. We implement the standard, ALFA and the adver- sarial trained ResNet- 18 networks on CIFAR-
Table 7: Standard testing accuracy of ALFA vs. other methods. All experiments are repeated for 5 runs, with errorbars of one standard deviation reported.
10. The adversarial trained model uses PGD-10 10 2 and e 253 for training. with step size a = 255
Methods
ResNet-56s
ResNet-18
Then, PGD-20 with the same and is applied to evaluate the robust performance of the three models. We observe that ALFA trained models (4.86% RA) yield moderate robustness, com- pared models from standard (0.00% RA) and adversarial (50.72% RA) trained models.
Random Noise
93.17 + 0.09
94.34 + 0.10
MoEx
92.90 + 0.33
94.16 + 0.23
ALFA
94.72 + 0.06
94.65 = 0.08
AdvProp
94.52 = 0.28
4.4 EVALUATION AND ANALYSIS OF L-ALFA
Results on L-ALFA are presented in Table and Figure 4 L-ALFA consistently improves the generalization of trained networks by 0.32% CIFAR- 1.18% CIFAR-100, and 0.91% on ImageNet. Although the achieved performance close to ALFA, L-ALFA saves toilsome tuning by automatically adjusting the strength and locations of adversarial feature augmentations. Another interesting finding is that L-ALFA automatically learns the effective trick of only perturbing the last block feature embeddings, which is consistent with our observations made from ALFA.
8

---

Under review as a conference paper at ICLR 2021
Number of Perturbed Layers To study the effect of the di- mension of the learnable per- turbation magnitude 1) I.- ALFA, we implement ResNet- 18 on CIFAR-I0 for the addi- tional experiment. ResNet-18 has four residual blocks and twenty convolution layers, and perturbing them will result in dim(n) being equal and 20, respectively. We also try introducing adversarial feature augmentations to
Table 9: Ablation studies on the dimension of 7) SA (%) on CIFAR-10 dataset is reported.
Dimension of m)
dim(n)
dim(r))
dim(n) 20
L-ALFA
94.52 (1 0.22) 94.62 0.32) 93.54 (L 0.76)
only some of the intermediate layers. such perturbing the features after each skip connection (i.e.,
(1)( = 9). As shown Table 9 an unduly high dimension of v), i.e., perturbing features in
almost all the layers, is harmful to model generalization. Therefore, learning feature perturbations by blocks or by skip connections adequate for L-ALFA.
Table 10: Ablation studies of the & regularization. SA (%) on CIFAR- 100 dataset reported.
0.1
0.2
0.5
1.0
2.0
10.0
SA of L-LFFA 70.68 (1 0.54) 72.13 (* 0.91) 72.35 (t 1.13) 72.40 (f 1.18) 72.38 (1 1.16) 71.92 (1 0 .70)
Ablation the l regularization in L-ALFA Results of ResNet-56s on CIFAR- 100 are collected in Table 10 We observe that be roughly chosen from f0.5, 1.0, 2.0} and obtain similar com-
petitive performance. Excessive large or small values of y obtain less performance improvements or even incur degradation.
CONCLUSION
In this paper, we present ALFA, an advanced adversarial training framework for image recognition. By applying adversarial perturbations on feature embeddings, and by jointly training with both clean and adversarial augmented features, ALFA improves the generalization of diverse neural network backbones across multiple image recognition datasets such as ImageNet. Systematical ablation studies reveal that introducing weak adversarial feature augmentations to the last layers of networks contributes more, which is different from previous findings. Furthermore, we propose L-ALFA to learn better augmentation, and also save the laborious tuning on ALFA. For future work, we plan to extend the ALFA to other vision tasks, such as object detection and semantic segmentation.
REFERENCES
Zitian Chen, Yanwei Fu, Yinda Zhang, Yu-Gang Jiang, Xiangyang Xue, and Leonid Sigal. Multi-level semantic feature augmentation for one-shot learning. IEEE Transactions Image Processing, 2809):45944605, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pp. 248-255, 2009.
Zhe Gan, Yen-Chun Chen, Linjie Li, Chen Zhu, Yu Cheng, and Jingjing Liu. Large-scale adversarial training for vision-and-language representation learning. In NeurIPS, 2020.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial
examples. In International Conference on Learning Representations, 2015a. URL http://
arxiv. www..org/aae abwg//bb///e aba/////40 /112. 112..411666 6672
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015b.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, pp. 770-778, 2016.
Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. arXiv preprint 15XXv:1502.031 2015.

---

Under review as a conference paper at ICLR 2021
M. Ishii and A. Sato. Training deep neural networks with adversarially augmented features for small- scale training datasets. In 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1-8, 2019. doi: 10.1 10.1109//CNN.200999 88522200..
Alex Krizhevsky et Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv: 607.02233, 2016.
Boyi Li, Felix Wu, Ser-Nam Lim, Serge Belongie, and Kilian Weinberger. On feature normaliza- tion and data augmentation. arXiv preprint arXiv:2002.1 102, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018a. URL https:
//openzeview. http://eww...eeerooooooeeeeeerr.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018b.
Preetum Nakkiran. Adversarial robustness may be odds with simplicity. arXiv preprint
SSSiv:1901.00532 2019.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C Duchi, and Percy Liang. Adversarial training can hurt generalization. In ICMLW, 2019.
Sebastian Ruder. An overview of gradient descent optimization algorithms. 1.4Y::669..4747,, 2016.
arXiv preprint
Swami Sankaranarayanan, Arpit Jain, Rama Chellappa, and Ser Nam Lim. Regularizing deep net- works using efficient layerwise adversarial training. arXiv preprint arXiv:1705.07819. 2017.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Ad-
versarially robust generalization requires more data. In NeurlPS, pp. 5014-5026, 2018.
Bernhard Schölkopf, Chris Burges, and Vladimir Vapnik. Incorporating invariances in support tor learning machines. In ICANN, pp. 47-52. Springer, 1996.
Patrice Simard, Yann LeCun, and John S Denker. Efficient pattern recognition using a new transfor- mation distance. In NeurIPS, pp. 50-58, 1993.
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and general- ization. In CVPR, pp. 6976-6987, 2019.
Ke Sun, Zhanxing Zhu, and Zhouchen Lin. Towards understanding adversarial examples systemat- ically: Exploring data size, task and model factors. arXiv preprint arXiv: 1901, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2013.
Mingxing Tan and Quoe V Le. Efficientnet: Rethinking model scaling for convolutional neural networks. arXiv preprint arXiv:1905.1 1946, 2019.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. In ICLR, 2019.
R. Volpi, P. Morerio, S. Savarese, and V. Murino, Adversarial feature augmentation for unsupervised domain adaptation. In CVPR, pp. 5495-5504, 2018.
Dilin Wang, Chengyue Gong, and Qiang Liu. Improving neural language modeling via adversarial training. arXiv preprint arXiv: 90..90000000.. 2019a.
Jingkang Wang, Tianyun Zhang, Sijia Liu, Pin-Yt Chen, Jiacen Xu. Makan Fardad, and Bo Li. Towards a unified min -ax framework for adversarial exploration and robustness. arXiv preprint arXiv: 1it::1000 906.996..0.0 003663,3,, 2019b.
10

---

Under review as a conference paper at ICLR 2021
Colin Wei and Tengyu Ma. Improved sample complexities for deep networks and robust classifica- tion via an all-layer margin. arXiv preprint arXiv:1910.04284 2019.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoe V Le. Adversarial examples improve image recognition. CVPR, pp. 819-828, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, pp. 7472-7482,
2019a.
Yinghui Zhang, Bo Sun, Yongkang Xiao, Rong Xiao, and YunGang Wei. Feature augmenta- tion for imbalanced classification with conditional mixture wgans. Signal Processing: Image Communication, 75:89-99, 2019b.
Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. ICLR, 2020.


Reviews:
[{"review_id": "q_RpHZmdFvq", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Pros:\n\nMethod is clearly stated, and the learning adaptive perturbation strength seems novel.\n\nProvided experimental results for large datasets like ImageNet.\n\nMajor Concerns:\n\nThe method proposes crafting adversarial perturbation at different layers of the network. A small change in features space may correspond to a large change in input space for neural networks, hence it is doubtful whether the perturbations crafted will be meaningful. The method which attempts to cause perturbations in the feature space also ensures that perturbed image is similar to original image\n(imperceptibility constraint) [3].\n\nThe authors mention use of unbounded perturbation size in section 4.2 which goes against the goal of adversarial training (i.e. same prediction in the neighborhood of the image). Also, if the perturbation is unbounded then there is no requirement of Projection step in PGD (Projection is done for enforcing the boundedness of perturbation). Could the authors please clarify this?\n\nThe intuition why this method works is also not too clear, as it has been shown in [1] that adversarial training leads to drop in standard accuracy. But in this paper adversarial training has been shown to increase standard accuracy even without using any adaptive parameters (like batch normalization layers used in AdvProp [2]). This simply goes against the established facts. \n\nIt is hard to distill what settings work well across different datasets. As seen in Table 5, for CIFAR-10, changing from 1 step PGD to 5 step PGD increases accuracy, whereas it decreases in case of ImageNet. Also there exist only a certain range of step size values for which standard accuracy increases. Could the authors kindly offer additional theoretical or intuitive explanations to clarify the same? This would\nhelp substantially improve the submission.\n\nOther questions:\n\nThe authors could  provide info on fooling achieved by crafted adversaries which is required for confirming the success of adversary creation. Also, the adversarial training method proposed in this paper shows minimal increase in adversarial robustness which also supplements the need for details on fooling rate. Typically adversarial training  increases its robustness [5], which is not observed with the proposed method. Could the authors clarify this?\n\nThe accuracy reported for the ImageNet models is lower than Torchvision models [4] as the authors use the same code as PyTorch repo it is unexpected. This may be due to the use of 10% training data for validation which is not required in ImageNet, as it already has a validation set. (This is important as the magnitude of improvements are not very large over the standard accuracy in case of ImageNet and is\neven smaller when compared with Torchvision models). The Torchvision ResNet 50 model obtains 76.15% accuracy which is comparable to ALFA (76.23%) (present in Table 3).\n\n\nAs the perturbations are calculated for each layer, the complexity of the method would increase with large networks like ResNet-152. So it is unclear if the proposed method will continue to be cost efficient in comparison to pixel-based methods.\n\nAlso, could the authors clarify the network architecture used for comparison of the time complexity in Section 4.3 for ALPHA and AdvProp [2]?\n\nOverall, this seems a very complex method without any theoretical grounding to increase the generalization performance. \n\n[1] Zhang, H., Yu, Y., Jiao, J., Xing, E., Ghaoui, L.E. & Jordan, M.. (2019). Theoretically Principled Trade-off between Robustness and Accuracy. Proceedings of the 36th International Conference on Machine Learning, in PMLR 97:7472-7482\n\n[2]Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A. L., & Le, Q. V. (2020). Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 819-828).\n\n[3]Ganeshan, A., & Babu, R. V. (2019). FDA: Feature disruptive attack. In Proceedings of the IEEE International Conference on Computer Vision (pp. 8069-8079).\n\n[4]https://pytorch.org/docs/stable/torchvision/models.html\n\n[5] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018, February). Towards Deep Learning Models Resistant to Adversarial Attacks. In International Conference on Learning Representations.", "extra_scores": {}, "extra_text": {}}, {"review_id": "Q-xKdKUPrZ", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors suggest a method for adversarial feature-level augmentation, mainly framed as an approach to improve the clean-set accuracy rather than adversarial example robustness. The authors also propose a learnable version (LALFA), to automatically learn the location and strength of the perturbations.\nOverall, I think this is an interesting paper that can be considered for publication at ICLR. The following elaborates it further:\n\nStrengths:\n* Even though the adversarial feature augmentations at the feature level are not unprecedented, but the learnable tuning of the location/strength is an interesting approach that can potentially avoid expensive hyperparameter optimization. \n* The shown improvements of the best-achieved models seem consistent over the baselines, across different datasets and models.\n\nWeaknesses:\n* The obtained improvements are moderate on smaller networks and become marginal with deeper counterparts.\n* The performance and the offered advantages seem quite sensitive to the choice of hyperparameters in ALFA (Tables 4 and 5). I wonder, at least, how stable/conclusive the comparisons are when transferring the selected model from one set to another, e.g. validation to test. \n\nFurther detailed comments:\n* \" L-ALFA saves toilsome tuning by automatically adjusting the strength and locations of adversarial feature augmentations\" => It is fair to note that this is achieved at the expense of introducing a new hyper-parameter to tune, namely \\alpha. \n* An ablation study on the L1 regularization could have been useful.\n* In Table 1 and some of the other numerical comparisons, except for Table 6, where standard deviations are reported: I wonder how significant are these comparisons? Are the differences meaningful when considering the intra-experiment variations?\n* Insights on why MoEx, one of the three baselines compared against, is performing worse than both random noise and normal training, would be helpful.\n* Equation (1) defines \\delta \\in B_\\epsilon(x) and uses it as an offset to x: f(x+\\delta;\\theta). Later B_\\epsilon(x) is defined as \"The norm ball B_\\epsilon is centered at x with radius \\epsilon\": These are not consistent, if \\delta is used as an offset, it cannot be sampled around x.\n* \\mathcal{L}_{at} has been used inconsistency across equation (1) and equations (3) and (4), on the first argument; f_i(x;\\theta^{(i)}+\\delta^{(i)}) in equation (3) and (4) misses the second part of the network, transforming the intermediate feature maps to the required predictions.\n* \\mathcal{L}_{at} is used in equation 1, but is elaborated after equation 2.\n* Defining both F(x;\\theta) and f(x;\\theta) is referring to the neural network, and its output seems unnecessary and confusing; besides, F(x;\\theta) is never referenced before.\n* f(x+\\delta,\\theta) => f(x+\\delta;\\theta)\n* Adding a row in table 7, representing the results from ALFA, will make the direct comparison between ALFA and L-ALFA easier.\n* \"ResNet-18 has ... and twenty convolutional layers\" => It has seventeen convolutional layers, I think. Please clarify on dim(\\eta) = 20 in Table 8. Are some of the pooling layers outputs also taken?\n* typo: \"a unduly\"", "extra_scores": {}, "extra_text": {}}, {"review_id": "7edAIG3AVbB", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Overview of paper: this work tackles the task of adversarial augmentation for better generalization. Instead of augmentation the pixels space, which is expensive and potentially harder, they augment the intermediate feature representation. As the choice of the particular layer for application of the perturbations affects performance, the authors, optimize it jointly with the rest of the parameters. Experiments show this method  improves accuracy over standard training.\n\nNovelty: although adversarial training on raw image is known to improve generalization, doing so on image features is novel as far as I am aware. Additionally, jointly choosing the layers to be perturbed is also new in my understanding (although the main benefit is in the analysis, as the fixed strategy of perturbing the last block seems comparable).\n\nEvaluation: The proposed feature adversarial training seems to consistently improve generalization on several popular datasets, however there are a few limitations: i) the gap is not huge. ii) it is not clear that the difference is significant from Xie et al. iii) nearly all results are on Cifar10, including the baseline comparisons iv) the speed up due to operating on features rather than pixels is cited as the main motivation but limited effort exists to evaluate it.\n\nPresentation: the paper is nicely written, and is easy to follow.\n\nOther questions: did you use auxiliary BNs like Xie et al? In what experiments did ALFA-L beat ALFA on the last block? (Sec 4.4 is a bit hazy there)\n\nOverall: Adversarial feature perturbation for generalization is an interesting ideas and was shown to have some benefits. The evaluation of accuracy and runtime against other reasonable methods (particularly doing the same on pixels) is limited. I am positively inclined towards this paper and hope the authors can address by concerns in the rebuttal.\n\n##########################################################################################\n\nThe response addressed some of my concerns, but I am concerned about L-ALFA taking such a large part of the paper and then shown to not help so much over just picking the final laye nor being much faster than the baseline. The more important ALFA hyperparameters that would most benefit from automatic tuning are not sufficiently treated. Although I do like the objective of this paper and some of the approaches, I think it might need to be revised and resubmitted, incorporating the extensive discussion presented by all the reviewers.   ", "extra_scores": {}, "extra_text": {}}, {"review_id": "1HtSNxGra9I", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "--Paper summary--\n\nThe authors propose Adversarial Feature Augmentation (ALFA), which augment features at hidden layers by adding adversarial perturbations. Where and how strongly the augmentation is conducted is automatically optimized via training. Experimental results show that the proposed method consistently improves the performance of baselines over several datasets and network architectures.\n\n--Review summary--\n\nAlthough the motivation of this study is clear, the proposed method is not appropriately designed along with the motivation. Moreover, its novely is merginal. I vote for rejection.\n\n--Details--\n\nStrength\n\n- The motivation is clear and seems reasonable. Training with adversarial perturbations is known to be effective but computationally expensive. It can be problematic when the model or training data is large-scale.\n- The proposed method consistently improves the performance of baselines over several datasets and network architectures.\n\nWeakness and concerns\n\n- Is the computational complexity of the proposed method really small? Since the adversarial perturbation is computed for every layer, its computational complexity should be almost same with that of standard adversarial training.\n- The training objective shown in Eq. (3) is not reasonable. Since the norm of \\delta is upper-bounded by a certain constant \\epsilon, the effect of the adversarial perturbation can be reduced just by increasing the scale of features. Are features normalized ones?\n- The optimization of \\eta in L-ALFA is not reasonable. Since min_\\eta comes after max_\\delta, L-ALFA should choose the layer that corresponds to the smallest increase of loss by adding adversarial perturbation. Therefore, this design minimizes the effect of the augmentation, which is contradictive to the motivation of introducing \\eta. Moreover, since \\epsilon is common for all layers, the optimal \\eta should be sensitive to the scale of features, which indicates that the performance of the proposed method would heavily depend on both how to initialize the model and whether any normalization is conducted in the model or not. \n- Marginal novelty. An idea of adversarially augmented features has been already presented in [R1].   \n[R1] \"Training Deep Neural Networks with Adversarially Augmented Features for Small-scale Training Datasets,\" IJCNN 2019.\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Adversarial training is usually done on the image space by directly optimizing the pixels. This paper suggests the adversarial training over intermediate feature spaces in the neural network. The idea is very simple. The authors have done extensive experiments to justify its performance. But the performance gain though this idea seems to be marginal. Further, the layer to conduct the adversarial training can be optimized within the framework, which aligns with the general autoML idea. The new version L-ALFA has been well introduced, but unfortunately, the practical result can be very straightforward, that is just to select the final layer. The more important ALFA hyperparameters that would most benefit from automatic tuning are not sufficiently treated.  There have been extensive discussions between the authors and the reviewers. After incorporating the reviewers' comments, the paper will have a good chance to be accepted at another venue. 


Decision: Reject