Analytical Moment Regularizer for Training Robust Networks
Authors: Modar Alfadly
Adel Bibi
Muhammed Kocabas
Bernard Ghanem
Venue:  (2020)
Keywords: robustness
analytic regularizer
first moment

Abstract: Despite the impressive performance of deep neural networks (DNNs) on numerous learning  tasks, they still exhibit uncouth behaviours. One puzzling behaviour is the subtle sensitive reaction of DNNs to various noise attacks. Such a nuisance has strengthened the line of research around developing and training noise-robust networks. In this work, we propose a new training regularizer that aims to minimize the probabilistic expected training loss of a DNN subject to a generic Gaussian input. We provide an efficient and simple approach to approximate such a regularizer for arbitrarily deep networks. This is done by leveraging the analytic expression of the output mean of a shallow neural network, avoiding the need for memory and computation expensive data augmentation. We conduct extensive experiments on LeNet and AlexNet on various datasets including MNIST, CIFAR10, and CIFAR100 to demonstrate the effectiveness of our proposed regularizer. In particular, we show that networks that are trained with the proposed regularizer benefit from a boost in robustness against Gaussian noise to an equivalent amount of performing 3-21 folds of noisy data augmentation. Moreover, we empirically show on several architectures and datasets that improving robustness against Gaussian noise, by using the new regularizer, can improve the overall robustness against 6 other types of attacks by two orders of magnitude.

Under review as a conference paper at ICLR 2020
ANALYTICAL MOMENT REGULARIZER FOR TRAINING ROBUST NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
Despite the impressive performance of deep neural networks (DNNs) on numer- ous learning tasks, they still exhibit uncouth behaviours. One puzzling behaviour is the subtle sensitive reaction of DNNs to various noise attacks. Such a nuisance has strengthened the line of research around developing and training noise-robust networks. In this work, we propose a new training regularizer that aims to mini- mize the probabilistic expected training loss of a DNN subject a generic Gaus- sian input. We provide an efficient and simple approach to approximate such a regularizer for arbitrarily deep networks. This is done by leveraging the analytic expression of the output mean of shallow neural network, avoiding the need for memory and computation expensive data augmentation. We conduct exten- sive experiments CIFARIO, and CIFARI00 to demonstrate the effectiveness of our proposed reg- ularizer. In particular, we show that networks that trained with the proposed regularizer benefit from a boost in robustness against Gaussian noise to an equiv- alent amount of performing 3-21 folds of noisy data augmentation. Moreover, we empirically show on several architectures and datasets that improving robust- ness against Gaussian noise, by using the new regularizer, can improve the overall robustness against 6 other types of attacks by two orders of magnitude.
LeNet and AlexNet on various datasets including MNIST,
INTRODUCTION
Deep neural networks (DNNs) have emerged generic models that can be trained perform impressively well in a variety of learning tasks ranging from object recognition (He et al. 2016) and semantic segmentation (Long al. 2013) to speech recognition (Hinton al. 2012) and bio- informatics (Angermueller et al. 2016). Despite their increasing popularity, flexibility, generality, and performance, DNNs have been recently shown to be quite susceptible to small imperceptible input noise (Szegedy et al. 2014; Moosavi-Dezfoul et al., 2016 Goodfellow et al.] 2011)). Such analysis gives clear indication that even state-of-the-arr DNNS may lack robustness. Consequently, there has been an ever-growing interest in the machine learning community to study this uncanny be- haviour. In particular, the work of (Goodfellow et al. 2015 Moosavi-Dezfooli al., 2016) demon- strates that there are systematic approaches to constructing adversarial attacks that result in mis- classification errors with high probability. Even more peculiarly, some noise perturbations seem to be doubly agnostic (Moosavi-Dezfooli et al., (017)), i.e. there exist deterministic perturbations that result in misclassification errors with high probability when applied to different networks, irrespective of the input (denoted network and input agnostic).
Understanding this degradation in performance under adversarial attacks is of tremendous impor- tance, especially for real-worke DNN deployment, e.g. self-driving cars/drones and equipment for the visually impaired. A standard and popular means to alleviate this nuisance is noisy data aug- mentation in training, i.e. DNN is exposed to noisy input images during training so as to bolster its robustness during inference. Several works have demonstrated that DNNs can in fact benefit from such augmentation (Moosavi-Deztooli et al. 2016 Goodffllow et al., 2015). However, data aug- mentation in general might not be sufficient for reasons. (1) Particularly with high-dimensional input noise, the amount of data augmentation necessary to sufficiently capture the noise space will be very large, which will increase training time. (2) Data augmentation with high energy noise negatively impact the performance on noise-free free test examples. This can be explained by the fun- damental trade-off between accuracy and robustness (Tsipras al.) 2018 Boopathy et al. 2019). can also arise from the fact that augmentation forces the DNN to have the same prediction for two vastly different versions of the same input, noise-free and substantially corrupted version.

---

Under review as a conference paper at ICLR 2020
Therefore, in this paper, we propose a new regularizer for noise-robust networks to circumvent the aforementioned setbacks of data augmentation.
A natural objective for training against attacks sampled from a distribution D, that bypasses the need for data augmentation, is the expected loss under this distribution. Since a closed-form expression is generally difficult to obtain or approximate surrogate is expensive to evaluate (Monte Carlo estimates), we propose instead a closely related objective that is the loss of the expected predictions of the network under D-distributed adversarial noise. Since it has been shown that Gaussian noise can be adversarial (Bibi et al. 2018) and that such noise is widely studied in applications such as image processing, we restrict the focus in this paper to the case where D is Gaussian. While this may seem to be too restrictive, we later show that improving the robustness of networks against Gaussian attacks also improves the robustness against family of other types of attacks. However, even under such an assumption, only a memory and computationally expensive (expensive due to two-stage network linearization), closed-form approximate surrogate for network expected predictions exists Biii et al. 2018).
Contributions. (i) We formalize new regularizer that is function of the probabilistic first mo- ment of the output of a DNN to train robust DNNs against noise sampled from distribution D. (ii) Under the special choice of Gaussian attacks, i.e. D is Gaussian, we show how the first moment expression can be evaluated very efficiently during training for an arbitrary deep DNN by bypassing the need to perform memory and computationally expensive two-stage linearization. (iii) Extensive experiments using LeNet (LeCun et al. 1999) and AlexNet (Krizhevsky et al. 2012) architectures on MNIST (LeCun 1998), CIFARIO, and CIFAR 100 (Krizhevsky & Hinton 2009) datasets demon- strate that a substantial enhancement in robustness can be achieved when using our regularizer in training. In fact, in the majority of the experiments, the improvement is better than training on the same dataset, augmented with 3 to 21 times Gaussian noisy data. Interestingly, the results suggest an excellent trade-off between accuracy and robustness. Moreover, we show that networks that are trained to be robust against Gaussian attacks using our proposed regularizer enjoy orders of magni- tude boost in robustness against a family of other types of attacks.
2 RELATED WORK
Despite the impressive performance of DNNs on various tasks, they have been shown to be very sensitive to certain types of noise, commonly referred to as adversarial examples, particularly in the recognition task Mloosavi-Dezfooll et al. 2016 Goodfellow et al., (015). Adversarial examples can be viewed as small imperceptible noise that, once added to the input of a DNN, its performance is severely degraded. This finding has incited interest in studying/measuring the robustness of DNNs.
The literature is rich with work that aims to unify and understand the notion of network robustness. For instance, (Szegedy et al. (2014) suggested spectral stability analysis for wide class of DNNs by measuring the Lipschitz constant of the affine transformation describing a fully-connected or convolutional layer. This result was extended compute an upper bound for a composition of layers, iee a DNN. However, this measure sets an upper bound on the robustness over the entire input domain and does not take into account the noise distribution. Later, |Fwzi al. (2017a) defined robustness as the mean support of the minimum adversarial perturbation, which is now the most common definition for robustness. Not only robustness studied against adversarial perturbations but also against geometric transformations to the input. Fawzi et al. (2018) emphasized the independence of the robustness measure the ground truth class labels and that it should only depend on the classifier and the dataset distribution. Subsequently, two different metrics to measure DNN robustness were proposed: one for general adversarial attacks and another for noise sampled from uniform distribution. Recently, Gilmer et al. (2018) showed the trade-off between robustness and test error from theoretical point of view on simple classification problem with hyperspheres.
On the other hand, and based on various robustness analyses, several works proposed various ap- proaches in building networks that are robust against noise sampled from well known distributions and against generic adversarial attacks. For instance, Grosse et al. (2017) proposed a model that was trained to classify adversarial examples with statistical hypothesis testing on the distribution of the dataset. Another approach is to perform statistical analysis on the latent feature space instead (Li & Li 2017 Feinman et al. 2017), train DNN that rejects adversarial attacks (Lu et al.] 2017). Moreover, the geometry of the decision boundaries of DNN classifiers was studied by Fawzi et al. 2017b) infer a simple curvature test for this purpose. Using this method, one can restore the orig-
2

---

Under review as a conference paper at ICLR 2020
{
((:0) = 2 (ReLU, (T(:;:));;
T(.9)
(A.c)
ReLU
142
(2 02)
02
02
Ω 02
u4
{(.)
Figure Overview corresponds to an arbitrary network () viewed as the composition of two subnetworks separated by a ReLU. The stream on the bottom computes the output mean of the network 4(:, 0) assuming that (i) the noise input distribution is independent Gaussian with variances oz and (ii) 22 02) approximated hy a linear function. This evaluation for the output mean efficient as it only requires an extra forward pass (bottom strcam), as opposed to other methods that employ computationally and memory intensive network lincarizations or data augmentation.
proposed graph for training Gaussian robust networks. The yellow block
inal label and classify the input correctly. Restoring the original input using defense mechanisms, which can only detect adversarial examples, can be done by denoising (ridding it from its adversarial nature) so long as the noise perturbation well-known and modeled apriori (Zhu et al. 2016). A fresh approach to robustness was proposed by Zantedeschi et al. (2017). where they showed that using bounded ReLUUs (if augmented with Gaussian noise) to limit the output range can improve robustness. A different work proposed to distill the learned knowledge from deep model to retrain a similar model architecture as means improving robustness (Papernot al.]|2016) (016)). This train- ing approach is one of many adversarial training strategies for robustness Makhzani et al. (2016). More closely to our work is (Cisse et al. 2017). where new training regularizer was proposed for large family of DNNs. The proposed regularizer softly enforces that the upper bound of the Lipshitz constant the output of the network to be less than or equal to one. Moreover and very recently, the work of Bibi et al. 2018) has derived analytic expressions for the output mean and covariance of networks in the form (Affine, ReLU, Affine) under generic Gaussian input. This work also demonstrates how (memory and computation expensive) two-stage linearization can be employed to locally approximate a deep network with a two layer one, thus enabling the application of the derived expressions on the approximated shallower network.
Most prior work requires data augmentation, training new architectures that distill knowledge, or detect adversaries priori, resulting in expensive training routines that may be ineffective in the presence of several input noise types. To this end, we address these limitations through our new regularizer that aims to fundamentally tackle Gaussian input noise without data augmentation and, as a consequence, improves overall robustness against other types of attacks.
3 METHODOLOGY
Background Network Moments. Networks with single hidden layer of the form (Affine,
ReLU, Affine) can be written in the functional form g(x) Bmax (Ax C1, 0p) + c2. The max(.) an wisment-wise operator. A E RR**" and E Rdx,, Thus, N (pz, E.), Bibi et al. (2018) showed that:
IR" + Rd. Given that
Theorem The first moment of g(x) is R[g(()) = 122 ④
Pa 02
+ 02
2
M2
+ C2.
Note that μ2 = Ap + C1, 02 = diag (Ee), En AT,AT, and o are the standard Gaussian cumulative (CDF) and density (PDF) functions, respectively. The vector multiplication and division are clement-wise operations. Lastly, diag(.) extracts the diagonal elements of a matrix into vector. For ease of notation, we let μą = T'u2, 02) = ( O Φ U2 + O of (1)
To extend the results of Theorem IT to deeper models, a two-stage linearization was proposed in Bibi et al. (2018), where (A, B) and (c1, C2) taken be the Jacobians and biases of the first
3

---

Under review as a conference paper at ICLR 2020
order Taylor approximation to the two network functions around ReLU layer in DNN. Refer to Bibi et al. (2018) for more details about this expression and the proposed linearization.
Proposed Robust Training Regularizer. To propose an alternative to noisy data augmentation to address its drawbacks, one has to realize that this augmentation strategy aims to minimize the expected training loss of DNN when subjected to noisy input distribution D through sampling. In fact, it minimizes an empirical loss that approximates this expected loss when enough samples are present during training. When sampling is insufficient (a drawback of data augmentation in high- dimensions), this approximation is too loose and robustness can suffer. However, if we have access to an analytic expression for the expected loss, expensive data augmentation can be averted. This is the key motivation of the paper. Mathematically, the training loss can be modeled as
min Σ (e(0(x;0))))) + En-D (e (#xx; 0.))) A
(I)
Here, + IR" + Rd is any arbitrary network with parameters 0, E is the loss function, (xx;, v5) are the noise-free data-label training pairs, and a 2 0 is a trade off parameter. While the first term in Equation iis is the standard empirical loss commonly used for training, the second term is often replaced with its Monte Carlo estimate through data augmentation. That is, for each training example Xs, the second term approximated with an empirical average of Ñ noisy examples of X; such that En<DIE [E (#(x; + n; 0) 9:)] N size of the dataset by factor of N, which will in turn increase training complexity. As discussed earlier, network performance on the noise-free examples can also be negatively impacted. Note that obtaining a closed form expression for the second term in Equation [] for some of the popularly used losses l is more complicated than deriving expressions for the output mean of the network + itself, e.g. in Theorem
N ( + ny; 0), 14). This will increase the Ej=
Therefore, we propose to replace this loss with the following surrogate I
N Σ ( (E(() 0),8:) + al (EnwD [0(x; + n; n;
min B
Because of Jensen's 's inequality, Equation 2 is a lower bound to Eq Equation D when E is convex, which is the case for most popular losses including fz-loss and cross-entropy loss. The proposed second term in Equation [Jeecourages that the output mean of the network t of every noisy example (x; + n) matches the correct class label yi- This regularizer will stimulate a separation among the output mean of the classes if the training data is subjected to noise sampled from D. Having access to an analytic expression for these means will prompt a simple inexpensive training, where the actual size of the training set is unaffected and augmentation is avoided. This form of regularization is proposed replace data augmentation.
While a closed-form expression for the second term of Equation might be infeasible for a gen- eral network {-), an expensive approximation tion provides an analytic expression to evaluate the second term in Equation 2 for when 'D is Gaussian and when the network is approximated by two-stage linearization procedure as ((x) x Bmax (Ax + C1, Op)) C2. However, is not clear how to utilize such a result to regularize networks during training with Equation 2 as loss. This is primarily due to the computationally expensive and memory intensive network linearization proposed in Bibi et al. (2018). Specifically, the linearization parameters (A, A,C,,,, C2) are function of the network parameters, 0, which updated with every gradient descent step on Equation 2 thus, two-stage linearization has to be performed in every 0 update step, which is infeasible.
be attained. In particular, Theorem Equa-
On an Efficient Approximation to Equation 2 The loss in Sqquaioo[prrposse a generic approach to train robust arbitrary networks against noise sampled from an arbitrary distribution D. Since the problem in its general setting is too broad for detailed analysis, we restrict the scope of this work to the class of networks, which most popularly used and parameterized by 8, ((::6)= R - Rd with ReLUs as nonlinear activations. Moreover, since random Gaussian noise was shown to exhibit an adversarial nature Bibi et al. (2018;; Rauber et al. (017); Franceschi et al. (2018). and it is one of the most well studied noise models for the useful properties it exhibits, we restrict D to the case of Gaussian noise. In particular, D is independent zero-mean Gaussian noise at the input, i.e. n ~ D = N' (0. Σ Diag (o2)), where o E IR" is a vector of variances and Diag(.) reshapes the vector elements into diagonal matrix. Generally, it is still difficult compute the second
4

---

Under review as a conference paper at ICLR 2020
term in Equation 2 under Gaussian noise for arbitrary networks. However, if we have access to an inexpensive upproximation of the network, avoiding the computationally and memory expensive network linearization in Bibi et al. (2018), an approximation to the second term in Equation 2 can be used for efficient robust training directly on 6.
Consider the (th ReLU layer in (.:;0). the network can be expressed as Φ O)
M(RLLU;(T( 01)): 02). Note that the parameters of the overall network ((:; O) is the union of the parameters of the two subnetworks T(: and (2(:; 02), i.e. 0 0₁ U02. Throughout this work and to simplify the analysis, we set / = 1. With such a choice of L. the first subnetwork T(., 01) is affine with 01 = {A. c1). However, the second subnetwork Sx.,, 02) is not linear in general, and thus, one can linearize (x 02) at En..V(oEE.) [ReLU, (x; + n; 01)) T(22, F2) = Mg. Note that Jy is the output mean after the ReIUU and μ12 Ax; + C1, since T(x; + n; 01) = A (x; + n) + c1- Both T(..-) and d2 are defined in Equation 1 Thus, linearizing f2 at μ43 with linearization parameters D( 022 Byts, we have that, for any point v; close to P3: Q(vi, 02) R Bv, + C2. While computing (B, c2) through linearization is generally very expensive, computing the approximation to Equation 2 requires explicit access to neither B nor Cg-
(B, 02) being the Jacobian of Ω and C2
Note that this second term for 1 = 1 is given as:
l (En-N (xxx + n; 0). y1) = E (E [2 (ReLU, (T(,,; = l (R (x, E.) ( (ReL.U, (Az; + +c)) ;22]]. Mi)
(3)
= l (Bzi-N(x.))) E.) B (ReLUU, (Az; + +,)) + c2] vk)
= e (Bp3 + v.) = E (12(43, 02), yk).
The approximation follows from the assumption that the input to the second subnetwork (2) i.e.
V, ReLU, (Az, + c1)). is close to the point of linearization μı such that [2v;; 82) ~ Bv, C2- Or simply, that the input to 52 is close to the mean inputs, i.e. μs, to 52 under Gaussian noise. The penultimate equality follows from the linearity of the expectation. As for the last equality, (B, o2) are the lincarization parameters of Ω at μas where C2 = 22 0₂) Bug by the first order Taylor approximation. Thus, computing the second term of Equation 2 according to Equation R] can be simply approximated by a forward pass of [A3 through the second network Ω. As for computing Ji = T(22, 02),, note that μ22 = Ax; + C1 in Equation [ which is equivalent to forward pass of X; through the first subnetwork because (., 02) is linear with 0 = (A, c1 Moreover, since 02 =
V(A @ A). The expression for 02 can be efficiently computed by simply squaring the linear parameters in the first subnetwork and performing forward pass of the input noise variance of through T without the bias C1 and taking the element-wise square root. Lastly, it is straightforward
/diag (TE, ). we have: d2 = / /dag ( (ADiag
compute T[22, 02) as is an element- wise function in Equation]] [ The overall computational graph in Figure I shows summary of the computation needed to evaluate the loss in Equation 2 using only forward passes through the two subnetworks T and Ω. It is now possible with the proposed efficient approximation of our proposed regularizer in Equation 2 to efficiently train networks on noisy training examples that are corrupted with noise (O, Σx) without any form of prohibitive data augmentation.
4 EXPERIMENTS
In this section, we conduct experiments on multiple network architectures and datasets to demon- strate the effectiveness of our proposed regularizer in training more robust networks, especially in comparison with data augmentation. To standardize robustness evaluation, we first propose a new unified robustness metric against additive noise from a general distribution D and later specialize it when D is Gaussian. Lastly, we show that networks trained with our proposed regularizer not only outperform in robustness networks trained with Gaussian augmented data. Moreover, we show that such networks are also much more magnitudes times robust against other types of attacks.
On the Robustness Evaluation Metric. While there is consensus on the definition of robustness in the presence of adversarial attacks, as the smallest perturbation required to fool a network, i.e. to change its prediction, it is not straightforward to extend such definition to additive noise sampled from a distribution D. In particular, the work of Fawzi et al. (2018) tried to address this difficulty by defining the robustness of classifier around example the distance between x and the closest
5

---

Under review as a conference paper at ICLR 2020
(a) MNIST
(b) CIFARIO
(c) CIFAR100
0.911
2.875
12553
00011
38757
33399
0.066
23392
24393
22893
0-
A-21
Tranngg
Taaling
Takinng
018177
0.7922
1/004
0.9287
0.5342
0.8994
03300
0.444
0.8077
4445
0.540
0.5115
04230
0.000
2.0
Tran k3
Figure 2: General trade-off between accuracy and robustness on LeNet. We see, in all plots, that the accuracy tends to be negatively correlated with robustness over varying noise levels and amount of augmen- tation. Baseline refers to training with neither data augmentation nor our regularizer. However, it is hard to compare the performance of method against data augmentation from these plots as we can only compare the robustness of models with similar noise-free testing accuracy.
decision boundary. However, this definition is difficult to compute in practice and is not scalable, as it requires solving a generally nonconvex optimization problem for every testing example that may also suffer from poor local minima. To remedy these drawbacks, we present a new robustness metric for generic additive noise.
Robustness Against Additive Noise. Consider a classifier (.(.) with (x( arg max; (x(x) as the predicted class label for the example x regardless of the correct class label yi. We define the robustness on sample x against a generic additive noise sampled from a distribution as
(x) FLND(((( + n) - (x)).
Here, the proposed robustness metric (x) measures the probability of the classifier to preserve the original prediction of the noise-free example (xx) after adding noise, t0xx + n), from distribution D. Therefore, the robustness over testing dataset T can be defined as the expected robustness over the test dataset: (T) Ex-T [R Inspired by Franceschi et al. (018)), for ease, we relax Equation 4 from the probability of preserving the prediction score 0/1 robustness over randomly sampled examples from D. That is, Rp = 1 means that, among m randomly sampled noise from D added to x, none changed the prediction from (x).. However, if a single example of these m samples changed the prediction from (xx), we set RD(x)- = 0. Thus, the robustness score is the average of this measure over the testing dataset T.
Robustness Against Gaussian Noise. For additive Gaussian noise, i.e. D = NO Σ, Diag (d2)), robustness is averaged over a range of testing variances o2. We restrict Jr to 30 evenly sampled values in [0, 0.5). where this set is denoted as A In practice, this is equivalent to sampling m Gaussian examples for each a2 E A, and if none of the samples changes the prediction of the classifier şi from the original noise-free example, the robustness for that sample at that a, noise level is set to 1 and then averaged over the complete testing set. Then, the robustness is the average over multiple og E A. To make the computation even more efficient, instead of sampling a large number of Gaussian noise samples (m), we only sample single noise sample with the average energy over D. That is, we sample a single n of norm |||||2 = /. This is due to the fact that EE
|||x 12] 220, r( ((T)) n= T.
Experimental Setup. In this section, we demonstrate the effectiveness of the proposed regularizer in improving robustness. Several experiments are performed with our objective Equation 2 where we strike a comparison with data augmentation approaches.
Architecture Details. The input images in MNIST (gray-scale) and CIFAR (colored) are squares with sides equal to 28 and 32, respectively. Since AlexNet was originally trained on ImageNet of
We assume that the input is normalized [0, 1lm

---

Under review as a conference paper at ICLR 2020
(a) MNIST 99.14%, Ñ 21)
(b) CIFARIO (ace 69 89.85%, Ñ
(C) CIFARIOD (8cc 38.16%, Ñ 21)
6:0875
023
OF3
03445
0.3482
03587
142
62033
0A355
02722
Traking
Tramin
Fair robustness comparison of LeNet with data augmentation and regularizer. We only report results for models with test accuracy that is at least as good as the accuracy of the baseline with a tolerance: 0%, 0.39% and 0.75% for MNIST, CIFARIO, CIFAR100, respectively. Only the models with the highest robustness are presented. Training with our regularizer can attain similar/better robustness than 21 21-fold noisy data augmentation on MNIST and CIFAR 100, while maintaining high noise-free test accuracy.
Figure 3:
sides equal to 224, we will marginally alter the implementation of AlexNet in Torch Marcel & Rodriguez (2010) to accommodate for this difference. First, we change the number of hidden units in the first cully-connected layer (in LeNet to 4096, AlexNet to 256, LeNet on MNIST to 3136). For AlexNet, we changed all pooling kernel sizes from 3 to 2 and the padding size of conv1 from 2 to 5. Second, we swapped each maxpool with the preceding ReI.U, which makes training and inference more efficient. Third, enforce that the first layer in all the models is a convolution followed by ReI.U as discussed earlier. Lastly, to simplify analysis, we removed all dropout layers. We leave the details of the optimization hyper-parameters to the appendix.
Results. For each model and dataset, we compare baseline models, i.e. models trained with noise- free data and without our regularization, with two others: one using data augmentation and another using our proposed regularizer. Each of the latter has two configurable variables: the level of noise controlled by of during training, and the amount of noise controlled by the trade-off coefficient in Equation 2 N (number of added noisy training examples) in the case of augmentation.
Accuracy vs. Robustness. We start by demonstrating that data augmentation tends to improve the robustness, as captured by R(() over the test set, the expense of decreasing the testing accuracy on the noise-free examples. Realizing this is essential for a fair comparison, as one would need compare the robustness of networks that only have similar noise-free testing accuracies. To this end, we ran 60 training experiments with data augmentation on LeNet with three datasets (MNIST, CIFAR1O, and CIFAR100) four augmentation levels (Ñ E {2, 6, 11, 21)), and five noise levels (a, A = (0.125, 0.25, 0.325, 0.5, 1.0)). In contrast, Equation
robust training experiments using 2 with the trade-off coefficient a E (0.5, 1.5, 2, 5, 10, 20} on the same datasets, but we extended the noise levels o2 to include the extreme noise regime of o2 E {2, 5. 10, 20). These noise levels are too large to be used for data augmentation, especially since x E [o. 1]"; however, as we will see, they are still beneficial for our proposed regularizer. Figure 2 shows both the testing accuracy and robustness as measured by RY( over a varying range of training 0N for the data aug- mentation approach of LeNet on MNIST, CIFAR-10 and 100. It is important to note here that the main goal of these plots is not to compare the robustness score, but rather, to demonstrate very important trend. In particular, increasing the training 0r for each approach degrades test- ing accuracy on noise-free data. However, the degradation in our approach is much more graceful since the trained LeNet model was never directly exposed to individually corrupted examples dur- ing training as opposed to the data augmentation approach. Note that our regularizer enforces the separation between the expected output prediction analytically. Moreover, the robustness of both methods consistently improves as the training increases. This trend holds even on the easiest dataset (MNIST). Interestingly, models trained with our regularizer enjoy an improvement in testing accuracy over the baseline model. Such behaviour only emerges with a large factor of augmentation,
Ñ = 21, and a small enough training d₂ on MNIST. This indicates that models can benefit from better accuracy with a good approximation of Equation | through our proposed objective through extensive Monte Carlo estimation. However, as a. increases, Monte Carlo estimates of the second term in Equation| via data augmentation (with N 21) no longer enough to capture the noise.
Robustness Comparison. For fair comparison, it is essential to only compare the robustness of networks that achieve similar testing accuracy, since perfect robustness is attainable with a deter- ministic classifier that assigns the same class label regardless of the input. In fact, we proposed a unified robustness metric for the reason that most commonly used metrics are disassociated from
7

---

Under review as a conference paper at ICLR 2020
RID
LaFOS
FOSM
DF2
GNK
ACC
0
1.02
10
5.50 x 10
2.24
10-92
6.91 10 10-04
77.45
98.50
LeNet MNIST
0.125
9.36
10
00
3.43 x 10 10
8.19 x 10
2.05 10 00
93.1
97.50
0,250
4.58
10
01
4.31 x 10
1.21
2.63 10 10-01
95.64
98. 75
0,325
4.21
x 10
01
4.51 x 10 01
1.17
2:33 x 10 01
96.75
97.50
1.0
5.44
10
01
1.34
2,95 10
90.00
AlexNeron
CIFRRO00
0.12
2:30
3.64
10
10
05
2.50 x 0G
2.83 x 10
5.06
1.50
10
05
2.16 10 10-94
2:10 10 05
29.69
31.65
33.50
34.75
0.250
4.37
10
3.86 x 10 10-04
6.50
2.47
x 10-04
32.85
32.25
0.325
5.37
10
D4
4.04
10 004
7.29
10
3.18 10 10-04
33.84
34.25
1.0
4.92
10
04
3.26
x 10 04
6,50 x 10 04
2.85
10
34.65
35.50
Table 1: Gaussian robustness improves overall robustness. We report the robustness metries corresponding to various attacks (PGD, LBFGS, FGSM, and DF2), our proposed GNR metric, and the test accuracy ACC for LeNet and AlexNet networks trained on MNIST and CIFARI00 using our proposed regularizer with noise variance a in training. Note that = 0 corresponds to baseline models trained without our regularizer. We observe that training networks with our proposed regularizer (designed for additive Gaussian attacks) not only improves the robustness against Gaussian attacks but also against other types attacks which 4 of them listed here and the others are left for appendix.
the tround-truth labels and only consider model predictions. Therefore, we filtered out the results from Figure 2 by removing all the experiments that achieved lower test accuracy than the baseline model. Figure summarizes these results for LeNet. Now, we can clearly see the difference be- tween training with data augmentation and our approach. For MNIST (Figure we achieved the same robustness as 21-fold data augmentation without feeding the network with any noisy exam- ples during training and while preserving the same baseline accuracy. Interestingly, for CIFARIO (Figure 3b). our method is twice as robust as the best robustness achieved via data augmentation. Moreover, for CIFAR 100 (Figure Be). we are able to outperform data augmentation by around 5%. Finally, for extra validation, we also conducted the same experiments with AlexNet CIFARIO and CIFAR 100 which can be found in the appendix. We can see that our proposed regularizer can improve robustness by 15% on CIFARIO and around 25% that for CIFARIO, 10, data augmentation could not improve the robustness of the trained models without drastically degrading the testing accuracy the noise-free free examples. Moreover, it is interesting to observe that the best robustness achieved through data augmentation is even worse than the baseline. This could be due to the trade-off coefficient in Equation I
CIFAR1O0. It is interesting to note
Towards General Robustness via Gaussian Robustness. Here, we investigate whether improving robustness to Gaussian input noise can improve robustness against other types of attacks. Specif- ically, we compare the robustness of models trained using our proposed regularizer (robust again Gaussian attacks) with baseline models subject different types of attacks: Projected Gradient Descent (PGD) and LBFGS attacks [Seeedyy et al. (2014), Fast Sign Gradient Method (FGSM) Goodfellow et al. (2015), and DecpFool L2Attack (DF2) Moosavi-Dezfooli et al. (2016) provide by Rauber et al. (017)) For all these attacks, we report the minimum energy perturbation that can change the network prediction. We also report our Gaussian Network Robustness (GNR) metric, which the Gaussian version of Equation 4 along with the testing accuracy (ACC). We perform experiments on LeNet on MNIST, CIFARIO 10 and CIFARIOO 100 datasets and on AlexNet on both CI- FARIO and CIFAR100. Due to space constraints, we show the robustness results for only LeNet on MNIST and AlexNet of CIFARI00 and leave the rest along with two other types of attacks for the appendix. Table [ shows that improving GNR through our data augmentation free regular- izer significantly improve all robustness metries. For instance, comparing LeNet trained with our proposed regularizer against LeNet trained without any regularization, i.e. o = O, we see that robustness against all types of attacks improves by almost two orders of magnitude, while main- taining a similar testing accuracy. A similar improvement in performance is consistently present for AlexNet CIFAR100.
5 CONCLUSION
Addressing the sensitivity problem of deep neural networks to adversarial perturbation is of great importance to the machine learning community. However, building robust classifiers against this noises is computationally expensive, as it is generally done through the means of data augmentation. We propose a generic lightweight analytic regularizer, which can be applied to any deep neural network with a ReLU activation after the first affine layer. It is designed increase the robustness of the trained models under additive Gaussian noise. We demonstrate this with multiple architectures and datasets and show that it outperforms data augmentation without observing any noisy examples.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Christof Angermueller, Tanel Pärnamaa, Leopold Parts, and Oliver Stegle. Deep learning for com- putational biology. Molecular Systems Biology, 2016.
Adel Bibi, Modar Alfadly, and Bernard Ghanem. Analytic expressions for probabilistic moments of pl-dnn with gaussian input. In Computer Vision and Patter Recognition Conference (CVPRI8), 2018.
Akhilan Boopathy, Tsui-Wei Wei Weng, Pin- Yu Chen, Sijia Liu, and Luca Daniel. Con-cert: An efficient framework for certifying robustness of convolutional neural networks. In Association for the Advancement of Artificial Intelligence (AAAI19). 2019.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International Conference on Machine Learning (ICMLI7), 2017.
Alhussein Fawzi, Seyed Mohsen Moosavi Dezfooli, and Pascal Frossard. The robustness of deep networks a geometric perspective. IEFE Signal Processing Magazine, 2017a.
Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Stefano Soatto. Classifi- cation regions of deep neural networks. CoRR, 2017b.
Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of classifiers' robustness to adversarial perturbations. Machine Learning, 2018.
Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. CoRR, 2017.
dean-Yves Franceschi, Alhussein Fawzi, and Omar Fawzi. Robustness of classifiers to uniform 4 and gaussian noise. Proceedings of Machine Learning Research (PMLR18), 2018.
Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoenholz, Maithra Raghu, Martin Watten- berg, and Ian Goodfellow. Adversarial spheres. CoRR, 2018.
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. International Conference Learning Representations (ICLR15), 2015.
Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. CoRR, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Computer Vision and Patter Recognition Conference (CVPR16), 2016.
Geoffrey Hinton, Li Deng, Dong Yu, George E Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Tara N Sainath, et al. Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups IEEE Signal Processing Magazine, 2012.
Diederik P Kingma and Jimmy Ba. Adam:
A method for stochastic optimization. International Conference on Learning Representutions (ICLR15), 2015.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Tech- nical report, Citeseer, 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convo- lutional neural networks. In Conference on Neural Information Processing Systems (NeurIPS12), 2012.
Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mmist// 1998.
Yann LeCun, Patrick Haffner, Léon Bottou, and Yoshua Bengio. Object recognition with gradient- based learning. Shape, contour and grouping in computer vision, 1999.
Xin Li and Fuxin Li. Adversarial examples detection in deep networks with convolutional filter statistics. In International Conference on Computer Vision (ICCV17), 2017.

---

Under review as a conference paper at ICLR 2020
Jonathan Long, Evan Shelhamer, and Trevor Darrel.. Fully convolutional networks for semantic segmentation. In Computer Vision and Patter Recognition Conference (CVPRI5), 2015.
Ilya Loshchilov and Frank Hutter. 2017.
Sgdr: Stochastic gradient descent with warm restarts. CoRR,
Jiajun Lu, Theerasit Issaranon, and David Forsyth. Safetynet: Detecting and rejecting adversarial examples robustly. In International Conference On Computer Vision (ICCV17), 2017.
Alireza Makhzani. Jonathon Shlens, Navdeep Jaitly, and lan Goodfellow. Adversarial autoencoders. In ICLR, 2016.
Sébastien Marcel and Yann Rodriguez. Torchvision the pechine-vvsioon package of torch. In Pro- ceedings of the 18th ACM International Conference on Multimedia, 2010.
Seyed-Mohsen Moosavi-Dezfoolii Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. Computer Vision and Patter Recognition Con- ference (CVPRI6), 2016.
Seyed-Mohsen Moosavi-Dezfoolii, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. Computer Vision and Patter Recognition Conference (CVPRI7), 2017.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy (SP16), 2016.
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang. Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. In Conference on Neural Information Processing Systems Workshops (NeurIPSW17), 2017.
Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox v0...0: A python toolbox to bench- mark the robustness machine learning models. CoRR, 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference Learning Representations (ICLRI4), 2014.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. stat, 2018.
Valentina Zantedeschi, Maria-Irina Nicolae, and Ambrish Rawat. Efficient defenses against adver- sarial attacks. ACM Workshop on Al and Security, 2017.
Fengyuan Zhu, Guangyong Chen, and Pheng-Ann Heng. From noise modeling to blind image denoising. In Computer Vision and Patter Recognition Conference (CVPR16), 2016.
10

---

Under review as a conference paper at ICLR 2020
A EXPERIMENTAL SETUP AND DETAILS.
All experiments, are conducted using PyTorch version 0.4.1 Paszke et al. (017)) All hyper- parameters fixed and Table 2 report the setup for the two optimizers. In particular,
the Adam optimizaer Kingma Ba 2015) with 31 = 0.9, Bg = 0.999, c = 10 with amsgrad set False. The second optimizer SGD Loshchilov & Hutter (2017) with momentum=0.99, dampening=O, with Nesterov acceleration. In each experiment, we randomly split the training dataset into 10% validation and 90% training and monitor the validation loss after each epoch. If validation loss did not improve for Ir patience epochs, we reduce the learning rate by multiplying by Ir factor. We start with an initial learning rate of Ir initial. The training is terminated only if the validation loss did not improve for loss_ pes_peatence number of epochs or if the training reached 100 epochs. We report the results of the model with the best validation loss.
Hyper-parameter
LeNet
AlexNet
optimizer
Adam
SGD
minibatch_sizz
1000
128
Ir iriinitial
0,0001
0.1
Ir ir.paiieeee
3
5
Ir factoo
0.9
0.5
loss passinaeeece
10
20
weight_ddeca
0
0.0005
Table Lists the training optimization hyper-parameters.
B EXAMPLES ON NOISE LEVELS
Figure provides examples of the different levels noise on a given digit 8.
0.0
a= 0.1
= 0.2
0.3
0.4
a =
=
0.7
0.8 = 0.9 1.0
8
8
8
8
8
Figure 4: This Figure shows an example of the noise level over varying level of input a on the digit 8. In particular, one can observe that with a large than 0.7 the among of noise is severe even for the human level. Training on such extreme noise levels will deem data augmentation be difficult.
C A COMMENT ON THE ROBUSTNESS METRIC
We measure the robustness against Gaussian noise by averaging over a range of input noise levels, where at each level for each image, we consider it misclassified if the probability of it being mis- classified greater than a certain threshold. The final robustness is the average over multiple testing Tx- This is special case of the more general case in Equation 4 We then report the area under the curve the robustness with varying testing Ø₂ as shown in Figure The area under this curve thus represents the overall robustness of given model under several varying input noise standard deviation dz.
D OTHER ROBUSTNESS METRICS
We report the robustness of several architectures over several datasets with and without our trained regularizer. We show that our proposed efficient regularizer not only improves the robustness against Gaussin noise attacks but againts several other types of attacks. Table summarizes the types of attacks used for robustness evaluation.
11

---

Under review as a conference paper at ICLR 2020
o X
Figure 5: The robustness is a function of the ratio of the orange area to the blue area in the white circle.
zUg:
fold aug.
0.
15
Figure 6: The robustness is thus measured as the area under the curve of testing accuracy versus input noise level (standard deviation).
(a) CIFAR (ace 68.91%, Ñ 11)
(b) CIFAR 100 (ace 38.10%, Ñ 6)
0.6999
0.5530
Base ine
Beseline
Best
Dest
0.6603
0.4939
Robusthess 36
Reiusiness
0.6206
0.4348
0.3809
0.3158
0.5413
0.3165
0.125
0.5
5.0
10.0
0.125
0.25
0.325
0.5
2.0
20.0
Training &
Trahing d.
Figure 7: Fair robustness comparison of AlexNet with data augmentation and regularizer. The reported models trained with our regularizer on CIFARIO and CIFAR100 all training da are within 1.68% and 4.83% baseline accuracy, respectively. models trained with the proposed regularizer achieve better robustness than 11-fold and 6-fold noisy data augmentation on CIFARIO and CIFARIO0 respectively.
Attack Abbreviation
Attack Name
PGD
Projected Gradient Descent
LBF
LBFGS Attack
GSM
FGSM
AGA
Additive Gaussian Noise Attack Additive Uniform Noise Attack DeepFool & Attack
AUA
DF2
Table 3: The table lists all the attacks performed.
12

---

Under review as a conference paper at ICLR 2020
various attacks (PGD, LBFGS FGSM. AGA, AUA and DF2), our proposed GNR metric, and the test accuracy ACC for LeNet and AlexNet networks trained on MNIST, CIFAR I0 and CIFARION using our proposed regularizer with noise variance a in training. Note that a = 0 corresponds to baseline models trained without our regularizer. Wc observe that training networks with our proposed regularizer (designed for additive Gaussian attacks) not only improves the robustmess against Gaussian attackk but also against 6 other types of attacks.
ACC
98. 50
97.50 .50
97 .50
99.00
65 .0
71.25
68. 08.75
70.75
69.75
37.85
35.85
38 25
36.85
35.85
72.75
67.50
67.00 .0
64.50
66. 50
34.75
33 50
32. 25.25
31.25
35.50
98.
GNR
77.45
93.14
95.64 66.64
97.32
24.37
40.08
37. 77.
38.32
44.03
27.79
27.38
23.47
30.90
23. 33.49
57.08
54.13
54.03
57. 57.86
29. 69.69
31.65
32.85 22.85
33.84
34.65
96.
28.
10 04
10-01
10-01
2.33 x 10 01
10 10-01 01
3.22 x 10 06
10-08
1.98 10 03
1.64 x 10 03
08
2.11 10-08
05
1.33 x 10 03
1.26 x 10 10-03 03
1.18 x 10- 10-03
1.35 x 10 10-03
9.20 x 10 06
10-03
1.95 10-00 08
08
10 03
2.10 x 10 05
2.16 x 10 04
10 10-04
04
10 -0-04
1.63 x 10-10-00
10
DF2
1.15 x 10
5.91 x
2.05
2.63
2.95
1.64
1.71
2.05
2.47
3.18
2.85
2.49 X 10 02
1.71 x 10 03
10-91
7.80 x 10-01
6.56 x 10 01
10 03
10-00-1111
01
10 10-01 01
10 00-01-
5.69 X 10-01 01
2.77 X 10 03
8.55 x 10-01 01
8.41 X 10 00-01 01
7.93 X 10-00 01
8.57 x 10 01
9.60 X 10 04
1.49 x 10 01
1.63 10-01
2.05 X 10 01
1.85 X 10 01
AUA
5.08
6.95
8.85
9,33
1.12
x 10
Table 4: Gaussian robustness improves overall robustuess. We report the robustness metrics corresponding
6.99
4.46
6.00
5.96
3 3.83
2.68 x 10 02
1.67 x 10 03
10-01
10-01
10 01
03
01
01
01
5.36 x 10 01
2.93 x 10 03
7.96 10 10
10
10 01
8.72 x 10 01
4.33 x 10 10-00 03
10 01
10-01
10 01
10 01
AGA
5.15
7.41
8.04
8.72
1.06
4.24 x 10
6.05 x 10
6.08 x 10
4.13 x 10
6.67 x
6.73
7.97
8. 8.05
7.53
1.44
1.73
1.87
1.99
2.24 X 10 02
8.19 X 10-01
1.67 x 10 03
3 3.60 x 10-03
4.42 x 10
3.25 x 10 03
4.42 x 10-00 03
05
10 10-03
03
03
10 10-00
10-03
3.25 x 10-03
03
9.78 X 10
3.59 x 10-00 03
2.84 X 10 03
3.96 x 10 03
1.50 x 10 05
5.06 x 04
6.50 x 10 04
7.29 x 10 04
6.50 x 10 04
3.58 X 10
GSM
1.21
1.17
1.34
10
4.60
3.25
3.25
2.91
5.50 X 10 04
10-01
4.31 x 10-01
4.51 x 10 01
5.22 x 10-01 01
3.38 X 10 06
1.74 10-03
1.66 X 10 03
2.14 10-03 03
05
03
03
03
03
1.02 X 10 05
1.36 10 03
1.28 10-03
1.16 x 10 03
1.31 x 10 03
2.50 x 10 05
2.83 10 04
10-04
4.04 x 10 04
10 04
2.05 X 10
1.63 X 10-10-1
LBF
1.33 X 10
1.62 x 10
1.55 X 10
1.42 X 10
3.43
3.86
3.26
1.02 x 10 03
3.36 x 01
10-01
4.21 x 10 10 01
10-01 02
8.17 x 10 05
2.59 X 10 18
3.27 10-00
2.59 X 10 03
3.31 X 03
2.77 10 10-03
03
2.84 x 10 10-10----- 03
2.46 X 10-03
03
2.71 x 10-03
03
4.55 X 10 03
2.08 X 10 03
03
10 03
2.09 x 10 03
2.30 x 10 05
04
3.64 x 04
14
10 04
10 04
PGD
10
4.58
5.44
1.57
2.05
1.75
4.37
5.37
4.92
0
0.125
0.250
0.325
1.0
0
0.125
0. 0.250
0.325
1.0
0
0.125
0.25
0.325
1.0
0
0.125
0,250
0.325
1.0
0
0.12
0.250
0.325
1.0
DITARI
MNISTT
LeNe on
Alekkea un
Alekker on
LeNet on
Laxet on


Reviews:
[{"review_id": "H1gqLof79B", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a regularization method for achieving robustness to noisy inputs, with relatively less computation compared to standard data augmentation approaches. Specifically, the authors analyze the analytic expression of the loss on the noisy inputs, and using Jensen’s inequality, propose to minimize a surrogate loss over the expectation of noisy inputs. To minimize the loss over the expectation, the authors impose a regularization over the first moment of the network weights. The authors validate the model with the proposed regularization technique for its robustness against Gaussian attack and other types of attacks, whose results show that the model is robust. \n\nPros\n- The general idea of the regularization that replaces the generation of noisy samples and optimization over it is conceptually appealing and seems practically useful.\n- The derivation of the moment-based regularization makes sense. \n- The proposed regularizer seems to be effective to a certain degree, on the sets of experiments done by the authors.\n\nCons\n- Experimental validation seems highly inadequate due to lack of baselines. Thus it is difficult to assess the degree of robustness the proposed model achieves. The authors should perform extensive evaluation against state-of-the-art techniques against multiple types of attacks, in order to demonstrate the effectiveness of the proposed method.\n- While the authors emphasize the computational efficiency of the method, the authors do not report computational cost or actual runtime.  \n- The types of non-Gaussian attacks should be better described. Which ones use L-infinity attacks and which use L2 attacks?\n- Figure 3 doesn’t seem like a very favorable result to the proposed model, since we are generally more concerned with adversarial examples generated with small perturbations, as large perturbations may change the input semantics.\n\nIn sum, while I like the overall idea and find the work novel and potentially practical, it is difficult to properly evaluate the work due to lack of comparison against state-of-the-art data augmentation methods for achieving robustness. Therefore I temporarily give this paper a weak reject, but may change the rating with more experimental results provided in the rebuttal. ", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "B1lawgdQtH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a regularizer to encourage the robustness to the random contamination for training deep neural networks. The idea is straightforward and intuitive, but not that exciting. The experiments show some improvement. However, I have a few serious concerns:\n\n(1) Why do we care about the random noise, especially Gaussian noise? There has been a large amount of literature on training robust network, but they are also for the robustness to adversarial examples. The Gaussian noise is too simple and easy to defend. We can even apply a simple denoiser to preprocess the data, which does not even involve training a sophisticated neural network.\n\n(2) The proposed moment regularizer is very delicate. I do not think it can generalize to other noises or contaminations. This is because for other noises, the moment approximation can be fairly loose.\n\n(3) The Alexnet was proposed in 2011. Consider that it is already late 2019, the authors INDEED need to do experiments using more advanced and recent models, e.g., ResNet34/50 or even powerful ones, e.g, ResNeXt, DenseNet, Wide ResNet.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "B1lFqwX6YB", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "I am not fully convinced by the robustness result in Figure 3. In MNIST, the proposed method is worse than data augmentation. In CIFAR-10, the proposed method does perform better, however, \\tilde{N} for data augmentation is chosen as 2, which is too small in my opinion. The data augmentation's robustness is similar to the baseline. I don't know if there are any issues in the training but data augmentation with \\tilde{N}=2 is expected to be ineffective to improve robustness. For CIFAR-100, the improvement is marginal and can only be achieved when \\sigma is large.\n\nIs the GNR score in Table 1 calculated on all examples or only on correctly classified examples? If it is calculated on all examples, I think it would be better to also report the result of the correctly classified examples. Because at the end we care how the models can correctly and robustly make the classification.\n\nI think it would be better if the authors can have some discussion about the potential connections between the proposed method and the method in [1]. [1] proved that if a model can classify well under Gaussian noise, it is possible to turn it into a classifier that is certifiably robust (I don't think the proposed method is certifiable) to adversarial perturbations in l_2 ball. The training method in [1] is Gaussian data augmentation. An experimental comparison between the proposed method and the method in [1] is necessary. I am not sure how faster the proposed method can be. \n\n[1] Cohen, Jeremy M., Elan Rosenfeld, and J. Zico Kolter. \"Certified adversarial robustness via randomized smoothing.\" ICML 2019\n\n---------------------------\nupdate after rebuttal:\nI appreciate the authors' feedback. However, I am not convinced that the proposed method is highly effective (Table 1 and Figure 3) and I still think the contribution is kind of marginal (especially given [1]). So it is hard to recommend acceptance.\n\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper received two weak and one strong reject from the reviewers.  The major issues cited were 1) a lack of strong enough baselines or empirical results, 2) Novelty with respect to "Certified adversarial robustness via randomized smoothing" and 3) a limitation to Gaussian noise perturbations.  Unfortunately, as a result the reviewers agreed that this work was not ready for acceptance.  Adding stronger empirical results and a careful treatment of related work would make this a much stronger paper for a future submission.
Decision: Reject