Can standard training with clean images outperform adversarial one in robust accuracy?
Authors: Jing Wang
Jiahao Hu
Guanrong Li
Venue: ICLR 2022 Submitted (2022)
Keywords: Adversarial Training
Robust Accuracy

Abstract: The deep learning network has achieved great success in almost every field. Unfortunately, it is very vulnerable to adversarial attacks. A lot of researchers have devoted themselves to making the network robust. The most effective one is adversarial training, where malicious examples are generated and fed to train the network. However, this will incur a big computation load. In this work, we ask: “Can standard training with clean images outperform adversarial one in robust accuracy?” Surprisingly, the answer is YES. This success stems from two innovations. The first is a novel loss function that combines the traditional cross-entropy with the feature smoothing loss that encourages the features in an intermediate layer to be uniform. The collaboration between these terms sets up the grounds for our second innovation, namely Active Defense. When a clean or adversarial image feeds into the network, the defender first adds some random noise, then induces this sample to a new smoother one via promotion of feature smoothing. At that point, it can be classified correctly with high probability. Thus the perturbations carefully generated by the attacker can be diminished. While there is an inevitable clean accuracy drop, it is still comparable with others. The great benefit is the robust accuracy outperforms most of the existing methods and is quite resilient to the increase of perturbation budget. Moreover, adaptive attackers also fail to generate effective adversarial samples as the induced perturbations overweight the initial ones imposed by an adversary.

Under review as a conference paper at ICLR 2022
CAN STANDARD TRAINING WITH CLEAN IMAGES OUT- PERFORM ADVERSARIAL ONE IN ROBUST ACCURACY?
Anonymous authors Paper under double-blind review
ABSTRACT
The deep learning network has achieved great success in almost every field. Un- fortunately, it is very vulnerable to adversarial attacks. A lot of researchers have devoted themselves making the network robust. The most effective one ad- versarial training, where malicious examples are generated and fed to train the network. However, this will incur a big computation load. In this work, we ask: "Can standard training with clean images outperform adversarial one in robust accuracy?" Surprisingly, the answer is YES. This success stems from two innova- tions. The first is novel loss function that combines the traditional cross-entropy with the feature smoothing loss that encourages the features in an intermediate layer to be uniform. The collaboration between these terms sets up the grounds for our second innovation, namely Active Defense. When a clean or adversarial image feeds into the network, the defender first adds some random noise, then induces this example to a new smoother one via promotion feature smoothing. At that point, can be classified correctly with high probability. Thus the per- turbations carefully generated by the attacker can be diminished. While there is an inevitable clean accuracy drop, is still comparable with others. The great benefit is the robust accuracy outperforms most of the existing methods and is quite resilient the increase of perturbation budget. Moreover, adaptive attackers also fail to generate effective adversarial examples as the induced perturbations overweight the initial ones imposed by an adversary.
INTRODUCTION
The seminal work of (Goodiellow et al. 2015) pointed out a surprising weakness of modern deep neural networks: although they can perform on par with human beings, their reliability is far from satisfaction. Almost imperceptibly added perturbations will be enough to mislead the network to output wrong class label with high confidence. will dramatically undermine the deployment of networks in some safety-critical applications: autonomous driving, image-based ID verification, and medical image analysis.
Since then, researchers have heavily investigated this risk exposure and proposed different defense strategies. One direction is some prepossessing techniques such as bit-depth reduction (Xu al., 2018), JPEG compression, total variance minimization, image quilting (Guo et al.) 2018), and Defense- GAN (Samangouei save the network to some extent. Unfortunately, (Athalye et al. 2018) showed that most of these approaches are based on obfuscated gradients and can be defeated.
al., 2018). The idea to mitigate the effect of added noise and
The other line of research adopts various adversarial training techniques where malicious examples are generated and fed to the network. A simple rationale behind this is if the network has this knowledge. it will become wise in test time. While there are different mechanisms such Mixup inference (Pang et al. 2020). feature scattering (Zhang & Wangl 2019), feature denoising (Xic) et al. 2019), geometry-awe aware instance reweighting (Zhang al. 2021). and channel-wise activation suppressing [Bai et al. 2021), they all share the same philosophy.
While people are astonished by the fact that imperceptibly added perturbations fool the network, some theoretical works such as (Tsipras et al. 2019, Schmidt et al. 2018) showed that is not en- tirely unexpected. Unfortunately, there are no solutions without the awareness of attack models.

---

Under review as a conference paper at ICLR 2022
Feature Smoothing Loss
Classification Loss
Fealure Smoothing Loss
3
2
Input Image
Feature Map
Feature Map
Softmax Output Layer
Standard Training Stage
Active Defense Stage
Figure 1: Schematic diagram of our approach. On the left is our standard training stage. The input image undergoes a series of deep neural network units, for example, convolution, ReLU, batch normalization, etc., until the final softmax layer outputs the decision probability, Each input image will produce corresponding feature maps. In addition to the usual classification loss, we introduce the feature smoothing loss constrain the intermediate feature space. On the right is our Active Defense stage. total, there are four steps. In Step 1, some random noise is injected into the input. Then this noisy image feeds into the network. During the forward pass (Step 2), we get the feature smoothing loss, and the derivative to the input the backward pass (Step 3) will be adopted to smooth this noisy image (Step 4). This smoothing process (Steps and can iterate many times until it meets some criterion, then the final result is fed into the network for classification.
Ideally, all defenses should be ignorant of this. However, this knowledge is essential to the adver- sarial training method that remains most effective, although at the cost large computation load. Now the big question arises: "Can standard training with clean images outperform adversarial one robust accuracy?" Here "clean images" means there is no manipulation of inputs even by adding some random noise such as (Jin Rinard 2020). although rather than adversarial training. At first glance, it seems hopeless, as widely accepted principle in the adversarial learning community is that network can be clever only if it has been exposed to deceptions before. However, on the other hand, the networks are supposed to generalize well after standard training. How can it perform so badly for adversarial attacks? As a possible answer to this, [llyas al.) 2019) investigated the cause of adversarial examples and concluded that neural networks tend to exploit predictive yet brittle features to make classifications. These features are incompre- hensible humans and thus be modified by adversarial attackers to mislead the networks, but (llyas et al. 2019) did not show how to teach the network to disregard these non-robust features and discover the robust ones make final decisions. From this perspective, it is difficult to tell the network to learn robust features, what we add some hints in the loss function and let the network become robust in an implicit way? More specifically, in addition we use a feature smoothing term that encourages the features in an intermediate layer to be uniform, shown the left of Figure T It sounds counterintuitive as this term will constrain the space of features that may lead to wrong classification. However, due to the high capacity of networks, very high standard accuracy can still be achieved with this additional term.
for manifold regularization
the classical cross-entropy loss,
When training completes, given an input, whether clean or crafted, extra perturbations can always be created by some added random noise followed by the promotion of feature smoothing the cost of reduced accuracy. So long as these intentional perturbations overweight the adversary's and the reduction in accuracy affordable, the model will become robust. We call this procedure Active Defense, as shown in the right of Figure I We find experimentally, a clean example from CIFAR- 10/CIFAR- 100 can perturbed with L 25/255 ~ 32/255, three to four times of Loo = 8/255 usually adopted by adversary, yet be classified with high success rate. This fact sets up the ad- equate space for Active Defense for eliminating the effects of attacks. Our approach is independent of any attack models compared with other state-of-the-ar methods, and its performance is much
2

---

Under review as a conference paper at ICLR 2022
more stable under attacks with different budgets. The contributions of this work summarized as follows:
We propose novel training scheme with an extra feature smoothing loss term that only takes clean images as inputs, fundamentally different from all existing adversarial training methods that need supplementary crafted data.
We present Active Defense that adds the second round of perturbations through random noise and feature smoothing. It modifies the malicious examples in way that is friendly the network. This deviates from conventional passive ones that keep the input intact.
RELATED WORKS
Due to adversarial threats to deep learning applications, there are many works to improve the ro- bustness. Most of them adopt adversarial training. Among them, only a few take care of the features in intermediate layers as listed in the following.
Feature denoising in (Xie et al. 2019) found that small perturbations in pixel space can lead to very substantial noise in the feature maps of the network and proposed various filters to denoise. (Zhang & WWang 2019) proposed to generate adversarial images for training through feature scattering in the latent space. In essence, perturbed images are produced collaboratively via optimal transport distance minimization. (Zhang & Wang 2019) used the feature maps as a guide making new ex- amples. Compared with these two, we are trying to force the intermediate feature map to be uniform through an additional loss term within the standard training framework without any modification of the network as in (Xie et al. 2019) or any other manipulations of features as in (Zhang & Wang 2019).
Regarding Active Defense, we have not seen any similar work. Perhaps the most related one is YYngg jt al. 2019), which used sophisticated matrix completion techniques to reconstruct the random masked images. Our motivation is very different, as we try to exploit the deep network itself to enhance robustness without borrowing any third-party algorithms.
3 BACKGROUND
In the classification problem, given the training data set of image-label pairs { ys k where Y/ E 21, M), the goal is to find an output probability vector F(x) of length M indexed by j. ideally such that y = arg max, F Of course, there always mismatch between these two terms. The key thing here is to find suitable loss function such that the empirical risk minimization
(ERM) of ". Σ L(F(x;), y:) can be implemented with loss function L. Note that F(x;) a vector,
while ya is scalar of the label, the very first thing is to transform yi into vector through vector function Gyy.). People usually adopt the one-hot coding H (y:) of length M with all elements being 0 except Hy, (v,) 1. The two probability distribution vectors F(z:) and H (y:) can be compared with cross-entropy.
An adversary crafts adversarial example Fade which is closest with || |aadv =01p < but misclassified some other class. In this paper, only consider attacks with p The most commonly used strategy is the iterative projected gradient descent mPGD)
1+1 = P(x'do + 3 x sign V LLL G(y)))),
where 3 is the step size and projects the generated example to the feasible region. Please note that L in adversarial attack may be different from L in training. People may choose traditional cross-
entropy loss with one-hot coding or CW loss (Carlini & Wagner 2017) to implement Equation T Currently, budget-aware step free-free variant of PGD has been proposed by (Croce & Hein 2020), and since that, an ensemble of diverse parameter-fie free attacks called AutoAttack has become the de facto routine for robust accuracy evaluation.
3

---

Under review as a conference paper at ICLR 2022
4 METHOD
In general, our method very simple. In training, for feature map Fl of a particular layer / with W x H C. use the loss
L Lee + max
(L)
(2)
W
H
Le x ΣΣΣ
F biikk (ea-meaanFF
(3)
Here L has two terms. Lee is for cross-entropy loss, and Lμt is our novel feature smoothing loss function. is quite similar to the Lı norm of the particular feature cube and encourages the cube to be uniform. In order to avoid overfitting to the feature smoothing loss, we use max (Lpi, 6) which disables the derivative of Li when drops below 8. In summary, feature layer I and the smoothing upper bound 8. Although this loss function sounds straightforward for our purpose to make the intermediate feature map smooth, there is a novel insight from the perspective of the trade-off between these two terms. In order to get low L,t, Teee will increase. In other words, after training, the network somehow understands that feature smoothing is not very annoying, and it only causes accuracy drop to some extent. There is a huge implication in terms of robust accuracy. we only use Lee. the network has no idea to deal with the crafted example except to be fooled. However, in case, Lpt gives us dissipation channel of malicious perturbations that we can take via feature smoothing. Hopefully, this will remove most of the perturbations generated by an adversary, which we will elaborate on in our Active Defense design. The other concern may relate to the feature space constraints. Actually, due to the high capacity of networks, there is almost no difference standard training accuracy between ours and cross-entropy loss.
have two parameters, the
From the discussion above, our Active Defense is very intuitive. It consists of four steps depicted Step 1, we add some random noise an input which can somehow reduce the effect of adversarial disruptions; more importantly, this will ensure sufficient iterations of feature smoothing. Otherwise, the attacker can bypass this and our Active Defense will fail. Steps and 3 are just forward/backward passes related to Lpt. In Step 4, the noisy image get smoothed via gradient descent for Lps, and feeds into the network for another round of feature smoothing. The overall procedure of the proposed approach is in Algorithm There are only three parameters, i.e.,
in the right of Figure
for uniform noise, 3 for the updating step size, and 5 for the upper bound of feature loss in test that is usually lower than for training in Equation 2 as we pursue extra feature smoothing to deal with adversarial attacks. The updated example through Active Defense will feed into the network for final class decision. This algorithm can run a few times which we denoted as outerloop in the following sections.
Algorithm Active Defense Algorithm
1: procedure ACTIVE DEFENSE(t, Lpt)
f is a test example. Step 1, is the parameter of the uniform distribution.
2:
= t uniform(- (oom(-oo,))
3:
1= Lp (t)
>> Step
4:
while > 8 do
is the upper bound of feature loss in test.
5:
> Step
8t
6:
f t= 1 B x d
> Step 4, B is the step size.
7:
1 L (t)
b Step
8:
end while
return / 10: end procedure
9:
EXPERIMENTS
To evaluate the performance of our approach, we run it on two datasets, CIFAR-10 and CIFAR- 100 (Kizhevsky] 2009), and compare it with other sfate-of-the-ar adversarial training methods. The network choose is WideResNet-28-111
(Zagoruyko & Komodakis 2016) with three groups.
Naturally, feature maps Fr (I 0, 1, 2) are used to denote the outputs of three groups respectively, and we choose 1 = 0, it closest the input with the strongest backward pass derivative. We
4

---

Under review as a conference paper at ICLR 2022
CIFAR-10
CIFAR-10
100
Feature
Smoothing
Tast Loss with Feature Smoothing
0.5
Training Feature loss without Feature Smoolhing
Test Festure Loss without Feature Smoothing
0.1
Feature Loos
Accursc)
0.3
Training Accuracy with Feature Smeothing
Accuracy with Smoothing
Training Accuracy without Feature Smoothing
Test Accuracy without Feature Smoothing
25
30
75
100
125
150
175
200
25
50
75
100
125
150
175
200
Epoch
Epoch
Figure Training/Test aceuracy (on the left) and Feature Loss (on the right) for CIFAR-10.
CIFAR-100
CIFAR-100
100
Training Feature Loss with Feature Smeothing
Smoothing
Tra Training Feature Loss without Feature Smoothing
80
Tast Feature Loss without Feature Smoothing
0.6
Feature Loss
Accursyy
Trainnn Accuracy with Feature Smoothing
0.2
Test Accuracy with Feelure Smoothing
Training Accuracy without
Smoothing
Test Accuracy without Feature Smoothing
0.0
25
50
75
100
125
150
175
200
25
50
75
100
125
150
175
200
Epoch
Esoch
Figure 3: Training/Test accuracy (on the left) and Feature Loss (on the right) for CIFAR-100.
evaluate the robust accuracy with perturbation budget e as both 8/255 and 16/255. needs to be emphasized here that our algorithm is independent of s.
5.1 STANDARD TRAINING
Our approach adopts standard training with clean images using additional feature loss term which boosts the intermediate features to be smooth. In all our experiments, the smoothing upper bound ò in Equation 2 is set 0.02. Figures and demonstrate the training and test accuracy and the feature loss variation per training epoch.
As we expected, while they achieve almost 100% training accuracy, there is only tiny drop in test accuracy with and without feature smoothing terms: 95.02% vs 95.83% for CIFAR-10, 10, and 78.3% vs 79.86% for CIFAR-100. This is due the fact that the classifiers have large number of parameters and are powerful enough. Here is an interesting observation of feature loss: even when we do not impose any constraints, it still goes down slowly. While we do enforce this term, it goes down very quickly at the beginning. This strongly hints feature smoothing benefits the generalization ability of networks. The feature loss with and without feature smoothing terms are dramatically 0.0725/0.07/ for CIFAR-10. 10, and
different, listed in the pattern of training/test, 0.0130/0.0135 0.01258/0.013 vs 0.0901/0.0900 for CIFAR-100. This fact indicates the effects of this additional loss term. Also, although set the to be 0.02, the feature loss is lower than that number, especially for CIFAR-100, which is also evidence that classification and feature smoothing are cooperative to some extent. Our Active Defense design exactly takes advantage of this harmony.
5

---

Under review as a conference paper at ICLR 2022
Table 1: AA comparison (WideResNee-28-U) only), nal images.
denotes models that require additional exter-
# paper
clean
APGD APGD FAB
Square
AA
CIFAR-10 Im &
8/255
Ours (outerlogg
10)
86.69
73.71
77.64
85.30
79.03
68.54
2 Gowal et al. (020
89,48
65.64
62.83
63.29
68.74
62.76
3 Ours (outerloop 1)
85.35
73.10
74.11
83.49
76.73
62.31
Rade & Dezsovi (2021
88.16
63.75
60.99
61.39
66.67
60.97
5 Rebuffi et al. (021
87.33
63.99
60.76
61.14
66.52
60.73
Standard (using Active Defense)
16.20
16.13
15.94
16.10
15.79
7.40
CIFAR-100 - 8/255
Ours (outerloop = 10)
59.43
39.36
44.78
57.63
48.92
33.49
2
Rebuffi et al. (2021
62.41
35.66
32.08
32.30
36.76
32.06
3 Ours (outerloop
56.98
37.90
42.85
55.04
46.80
28.51
Hendrycks al. (2019)*
59.23
33.02
28.48
28.74
34.26
28.42
5 Rice et al. (2020)
53.83
20.57
18.98
19.24
23.57
18.95
Standard (usnng Active Defense)
2.69
2.54
2.65
2.78
2.56
1.39
5.2 ACTIVE DEFENSE
Equation takes two terms, Lp and Lee- What is the consequence if we make the image smoother further, i.e., decrease Lpt?. This essentially will remove train the network with Les, the network somehow understands that the remaining features are still useful for image classification. In other words, the drop in classification accuracy should be small. It is key to our success of Active Defense. To counter adversarial perturbations, we intentionally add some noise and smooth it out as Algorithm [ In all our experiments, we choose for uniform noise and 8 = 80 for the updating step size, while for the upper bound of feature loss 5. 0.0124 for CIFAR-10 and 0.0118 8 for CIFAR-100. Some experimental results with 8/255 in Figures and shoow Active Defense can effectively recover the semantically significant structures destroyed by the adversarial attacks and our intentionally added noise, which leads to correct final classification. This evidence highlights the role played by our Active Defense, Usually, a single Active Defense takes about 200-400 iterations of while loop body in Algorithm [ 8/255 and up to around 500 for e = 16/255. In practice, this while loop body can be implemented parallel.
brittle features, however, since
0.075
We evaluate the robust accuracy of approach using AutoAttack and compare the performance with other trae-offthee-as methods in Tables and 2 As AutoAttack comprises a set of attack methods, it will win if any of them succeeds. It poses some challenges for our approach since solution is stochastic. As one attack model may not be so strong on an average of 10k images, but for particular example, it still has some chance win. This chance will increase especially when given a row of ones applied sequence, namely, clean, APGD APGDT FAB and Square. For example, Table [ outerloop
for CIFAR-10 achieves the lowest accuracy of 73. 73.10% for APGD.e. but AA only gets 62.31%, more than ten percent drop. However for other comparison methods, this gap is small. To further improve the stability and narrow this gap. we run it ten times, i.e, outerloop 10, and aggregate the output probability of each run.
In Table I. we only consider WideResNet-28- 10. and ours with outerloop 10 is the best. One may still wonder what if we apply our Active Defense with classical training only with cross-entropy loss. We also list the results the rows of Standard (using Active Defense). turns out that
hard to exit the while loop in Algorithm [ so we set å to be 0.0562 for CIFAR-10 and 0.0880 for CIFAR-100 The accuracy is very low. This fact justifies the necessity of our feature smoothing loss term. Table 2 lists the AA accuracy with all model architectures, and ours is still among the best. 16/255, rerun the whole AA including clean with a little bit change in clean
Note that when accuracy due to the randomness of our method, and our AA accuracy significantly outperforms all others.

---

Under review as a conference paper at ICLR 2022
Table 2: AA comparison, denotes models that require additional external images.
paper
architecture
clean
AA
CIFAR-10 100 8/255
Ours (outerloop
10)
WideResNeet288111
86.69
68.54
2
Rebuffi et al. (2021)*
NideResNet-70-16
92.23
66.56
Gowal et al.
2020)
WideRessNet-70-16
91.10
63.87
4
Rebuffi et
2222
10de-esNeet106-16
88.50
64.58
5
Rebulh et al.
(2021)
70de
88.54
64.20
Rade Moosavi-Dezfool
2021
WideResNert34-110
91.47
62.83
7
Gowal ct al.
(2020)
WideResNNet28-100
89,48
62.76
Ours (outerloop
WideResNet-28-1
85.35
62.31
9
Rade & Moosavi-Dezfooll
2021
WideResNeet-2811
88.16
60.97
Rebulfi et al. (2021)
WideRessNet28-100
87.33
60.73
CIFAR-10 400 e 16/
Ours (outerloop 10)
WideRessNet-28110
86.79
54.24
2
Ours (outerloop 1)
85.21
49.24
Rebufli et al. (2021
WideRessNet28-110
87.33
25.39
4 Gowal et al. 2020
WideResNee-28--10
89,48
24.96
Wu et
2020
10
88.25
24.00
CIFAR-100 L2c
8/255
Gowal ct al. )
WideRessNet70-11
69.15
36.88
Rebulfi et al. 22021
7ideResNee:77-116
63.56
34.64
3 Ours (outerloop
10)
2810
59.43
33.49
4
Rebuffi et al. (2021)
28de
62.41
32.06
Cui
2020
WideResNNer34--20
62.55
30.20
6
Gowal et al. (2220)
VideRResNet-70-16
60.86
30.03
Cui et (2020)
WideResNet-344
60.64
29.33
8
Rade & Mloosvvi-Dezfoon
2021
PreActResNet-118
61.50
28.88
Wu et (020))
WideResNNet
60.38
28.86
10
Ours (ouzerloop 1)
28
10
56.98
28.51
11
Rebuffi et al. (2021)
PreActResNet-188
56.87
28.50
CIFAR-100 1.0
16/255
Ours (outerloop 10)
WideRessNet-8-111
59.16
22.76
2
Ours (outerloop =
-eet
57.10
19.15
Rebuffi et (2021)
WideResNeet28-11
62.41
12.45
4
Hendrycks et al. 2019
WideRes
59.23
8.89
5.3 ADAPTIVE ADVERSARIES
While it always not easy to propose adaptive attacks, we try our best to defeat our defense scheme. Since the APGD.. seems to be the best attack as listed in Table 1 we adapted it to generate possibly stronger adversarial examples. Specifically, the loss function APGD is modified
L = Leee X max 5).
(4)
other words, we try to understand how the feature loss term influences the efficiency of attacks with À spaced uniformly (on a log scale) from 1.1 to 100, both positive and negative. Positive À
means more distortion in feature space, which pressures our smoothing process via Active Defense. While for negative X. the iterations of the while loop in Algorithm should be small, which results in more effective attacks. However these efforts are useless, manifested in robust accuracy of Table 3 almost the same X 0.

---

Under review as a conference paper at ICLR 2022
0.75
006
0.75
0.50
0.4
0.50
0:25
02
0.25
Clean Plane
0.00
APGD CE Cat
0.
APGD-T Ship
0.00
1.0
0.75
0.50
0.25
0.00
0.0
Ptb. Deer
Ptb. Deer
Ptb. Deer
0.50
0.50
0.25
Aft. Plane
Aft. Plane
Aft. Piane
0.0186
0.01650
0.01625
0.0162
0.00500
000160
0.01600
Clean Horse
APGD-CE Cat
APGD-T Deer
0.01650
0.01650
01655
0.01525
0.01625
0.01600
0.01600
Frog
Frog
0.0166
0.016
0.0016
01664
0.0164
0.0152
0.0182
10.0000
10.0100
0000160
Aft. Harse
Aft. Harse
Aft. Horse
Figure 4: The top half is plane from CIFAR-10. In the first row, from left to right, we demonstrate the clean and adversarial images generated via APGD and APGD and the corresponding feature map in channel 7. The second and third rows are the noise- peise-perturbed and after Active Defense ones, respectively. The second half is arranged similarly except that the feature channel is 26. Our standard training model assigns each image label shown underneath it. The feature maps show strong distortions by adversarial attacks and our intentionally added noise, which can be somehow restored by our Active Defense.
Table 3: Robust accuracy on adaptive attacks with different À through a single run of Active Defense. The left half table is for negative \, while the remaining is for positive À in bold.
log1o ([AI)
-1
-0.25
0.5
1.25
2
-1
-0.25
0.5
1.25
2
C-FAR-10
72.95
73.06
72.62
72.95
72.79
72.87
72.91
72.7
72.76
72.43
CIFAR-100
37.72
38.06
38.02
37.32
37.72
37.79
37.69
37.66
37.64
37.32
5.4 DISCUSSION
All above attacks are one-time in nature, as attackers may take an arbitrarily long time and possibly get many options but can only shoot one. Since our method introduces random noise Active Defense phase, the results demonstrate the average success rate for 10K test examples. One may come up with simple attack that sends the same example many times, and there is always a chance to defeat. But this brute-force attack can be resolved by enhanced version of defense, that is, to run lot times of Algorithm [] and aggregate the probability of each run. However, this will increase the computation load. On the other hand, it makes sense since there is no free lunch. Also, very fortunately, our capacity of defense can scale up much more conveniently than perhaps retraining the model from scratch conventional adversarial training methods. Another very nice
8

---

Under review as a conference paper at ICLR 2022
000024566
0022566
0.012456
0.012454
0.012454
0.012454
0.124552
0.012452
0.014550
0.012450
Clean Pear
APGD CE Porcupine
APGD.T Baby
6 012456
0.012456
0124455
012454
0.012454
6.012452
0122552
0:012450
0.124500
0.012450
Ptb. Porcupine
Pth. Porcupine
Ptb. Porcupine
01015555
0.0124550
0.0124550
0.0124525
0.0124525
0.0124500
Aft. Pear
Aft. Pear
Aft. Pear
0:244666
0.012466
0.012466
0121164
0.012464
0.012464
0002462
0.012462
0.012462
Clean Lobster
APGD CE Caterpillar
APGD-T Caterpillar
0.012466
0.012466
0.012464
0 01014462
Ptb. Lobster
Ptb. Caterpillar
Ptb. Butterfly
012466
0.012466
0.012466
0.012664
0.012464
D.012462
0 0.012462
0.012462
1.0024600
0.012460
00.012400
Aft. Lobster
Aft. Lobster
Aft. Lobster
Figure 5: The top half is pear from CIFAR-100. In the first row, from left to right, we demonstrate the clean and adversarial images generated via APGD and APGD and the corresponding feature map in channel 43. The second and third rows the noise-perturbes and after Active Defense ones, respectively. The second half is arranged similarly except that the feature channel is 33. Our standard training model assigns each image label shown underneath it. We and restorations as in Figures 4 Moreover, comparing with the clean image, the lobsters in feature maps are much more integrated in the last row.
the similar destructions
advantage is that enhancement is definitively free from robust overfitting (Rice al. 2020). as there is no attack model engaged at all.
CONCLUSION
Adversarial learning of great interest the deep learning community. Most of the previous works focus on the efficient generation of malicious examples. However, in this paper, we shed some light on a question:
possible that network can robust without being taught with malicious examples? We propose standard training model with an additional feature smoothing loss term, which very different from all existing ones in that there is no adversarial input involved. The standard cross-entropy and feature smoothing loss can collaborate to some extent in training. At test time, we adopt Active Defense to distill feature maps of adversarial inputs. The experimental results demonstrate that this simple method can enhance the robustness of networks greatly. In future work, we will do some theoretical analysis and exploit other forms of cooperative loss that might be more beneficial than the feature smoothing one.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Anish Athalye, Nicholas Carlini, and David A. Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference
Machine Learning. ICML 2018, Stockholmsmässsan, Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of mlr.
Machine Learning Research, pp. 273-283. PMLR, 2018. URL httphhtttp///eeeeeeeeeeeeee press/v80/ at ye 8a.html
Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving ad- versarial robustness via channel-wise activation suppressing. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. /RLppttpp//pppeeeeeeee... wwt.:e/w.www..ormm.ee http://pp....reeeeee.oo.oo.eeeer
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pp. 39-57. IEEE Computer Society, 2017. doi: 10.1 109/SP2001.44..
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with ensem- ble of diverse parameter-free attacks. In Proceedings of the 37th International Conference on Machine Learning. ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 2206-221 2216. PMLR, 2020. URL htt.:t://// httt:::/prrceeeiiggg/ html
mlr. wttppppssllleceeeeeeeeeeeeeeeeee
Jiequan Cui, Shu Liu, Liwei Wang. and Jiaya Jia. Learnable boundary guided adversarial training. CoRR, abs/201 1.1 164, 2020. URL http:tts:/// /ttp:v///aivv.ea. wwtp:o/g//aaa.o.ooooooooo.. 20t./ 11164
lan J. Goodfellow. Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.). 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL
6572
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy A. Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against bounedd adversarial examples. CoRR, abs/2010.03593, 2020. httttttss http:aawwwww..rraa//araaa wwt./o/////a.a//oo//.o.ooo.eee// 03593
Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten. Countering adversarial images using input transformations. In 6th International Conference on Learning Representa- fions, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceed- ings. OpenReview.net, 2018. http:httt://openeeeettt
net. forum? (horum?id=SyJ700 WCb
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference fornia, USA, volume 97 of Proceedings of Machine Learning Research, pp. 2712-2721, PMLR, 2019. URL http:::ppppppeeeeeeeeeeee
Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, Cali-
mlr. www.sprssseeeepp..ppppp v www.hhenddlsls.cc html
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Alek- sander Madry. Adversarial examples are not bugs, they are features. In Hanna M. Wal- lach, Hugo Larochelle, Alina Beygelzimer, Florence d' Alché-Buc. Emily B. Fox, and Ro- man Gamett (eds.), Advances in Neural Information Processing Systems 32: Annual Confer- ence Neural Information Processing Systems 2019, NewrIPS 2019, 8-14 December 2019, Vancouver, BC, Canada, pp. 125-136, 2019. URL httlhtttp//pppeee .ips.. CC cc/paper/////ccpcc 8307 adversarial sesersaaiial-eeppleeseeeeeee are not bugs - are features
Charles Jin and Martin Rinard. Manifold regularization for adversarial robustness. abs/2003.04286, 2020. URL httth::///axii...t.t// http:////rrriiiorrraaa///0.....0
CORR,
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
10

---

Under review as a conference paper at ICLR 2022
Tianyu Pang, Kun Xu, and Jun Zhu. Mixup inference: Better exploiting mixup to defend adversarial attacks. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL htttps://cpenrevett net/
forum? 1 dd
Rahul Rade and Seyed-Mohsen Moosavi-Dezfooli. Helper-based adversarial training: Reducing excessive margin to achieve better accuracy vs. robustness trade-off. In ICML 2021 Workshop on Adversarial Machine Learning, 2021. URL https::/ net forumirr
BuD2LmNaUU3a
Allves Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation to improve adversarial robustness. CoRR, abs/2103.01946 2021. URL
wwtp:/orraaabaaaooeeee 01946
Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learming Research, pp. 8093-8104, PMLR, 2020. URL http: http:///poceeenngn..ee mir. www.p//nsw.i..p..s.s....e.ee.eee peress/vile https//1111////e..aaaaaa.a
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gam gan:: Protecting classifiers against adversarial attacks using generative models. In 6th International Conference on Learn- ing Representations, ICLR 2018, Vuncouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URLhttps: htttttt://oppereerer /ttp///pppeevveeeeeee ew. net forum?id BkJ3ibbo-
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicold Cesa-Bianchi, and Roman Gar- nett (eds.), Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada, pp. 5019- 5031, 2018. URL http::/ wttp::sssiss...pp.pepppeeeeee zat Latzzationn-ee rem-or---a.
7749- www.eevrrrallyyrbbusseeu
res
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In 7th International Conference on Learning Repre- sentations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019. URL net/ www.erorrmiiiim.mem.....m. d=
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- cralization. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tices Tien Lin (cds.), Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020. URL
neu..ipp...eu.s......o.........s CC/ cc/papprr/220//aas.
Cihang Xic, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 501-
509. Computer Vision Foundation / IEEE, 2019. doi: 10.1109/CVPR.2219000055
URL
thecvf. wtt.cccccccoo/o comtent wttpc///oeetttCcRre.c... Denoising www.ooroonoooongaaoorree Adwersarivaaiaaaa CVPR_ SVPR_2019/html/XXt Feature_ ht.ml
Srcuussness__cPPe pap_a__p____pprr__r_____
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Sympo- sium, NDSS 2018, San Diego California, USA, February 18-21, 2018. The Internet Soci- ety, 2018. URL htRl/ttt::/// httpt:::p//....nteeeeeeeeeeeeeee www.innneeeeeiiieemmmmmmmm www.ccitty.......e.. orrg/oos///ssss/// swadddss/p--oe /tt///w-ooee copp-coneeetuupl..c happo /tttle//25/2111/2/2222
03A-4 4 Xu paper.pdl
Yuzhe Yang, Guo Zhang, Zhi Xu, and Dina Katabi. Me-net: Towards effective adversarial robustness with matrix estimation. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, ICMI. 2019, 9-15 June 2019, Long
11

---

Under review as a conference paper at ICLR 2022
Beach, California, USA, volume 97 of Proceedings of Machine Learning Research, pp. 7025- 7034. PMLR, 2019. URL http:///opp/ mlr wwwpppsssss..... wttps//s/w//yaggg9.... html
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Richard C. Wilson, Edwin R. Hancock, and William A. Smith (eds.), Proceedings of the British Machine Vision Conference 2016, BMVC 2016, York, UK, September 19-22, 2016. BMVA Press, 2016. URthttp: //ww.. bmva. org/ hmve 201 /ttp///aaapeppaaapaa//////////// index html
Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering- based adversarial training. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelz- imer, Florence d' Alché-Buc, Emily B. Fox, and Roman Garnett (eds.), Advances in Neu- ral Information Processing Systems 32: Annual Conference
Neural Information Pro- cessing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC. Canada, pp. 1829-18333 2019. URL
neur neur ips CC/ htcp//paper//21//aat/// 07000000c60000033111000010000000
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan S. Kankanhalli. Geometry-aware instance-reweighhee adversarial training. In 9th International Conference on Learning Representations, ICLR 1021, Virtual Event, Austria, May 3-7, 202/. OpenReview.net, 2021. UtLLLttps://openreviiee net. htt.//formmiiiiix00000
12


Reviews:
[{"review_id": "poUcH4N9ZF9", "reviewer": "Reviewer_tMiw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The most significant concern I have is that the “adaptive attack” is not, in my view, a sufficient try at breaking the proposed method.  The authors should perform an adaptive PGD attack where each gradient is computed as follows: Draw multiple samples of random noise, add each of them individually to your current adversarial example iterate, run Algorithm 1 for each of the noised examples, plug the resulting images into the model to obtain a cross-entropy (also try CW) loss value, and finally backprop through the entire Algorithm 1 to compute a gradient with respect to the adversarial example iterate.\n \nImagenet experiments would be greatly appreciated as ImageNet data is far higher dimensional, more realistic, and typically has very different properties than low-dimensional data.\n\nThere are several issues with the writing of Algorithm 1:  What is lower case ell?  Also, s is only computed and never used or output.\n\nJust a note about formatting.  The authors should be careful about the difference between \\citep and \\citet natbib commands.  Additionally, there are numerous grammatical errors and misspellings which should be corrected before publication.", "summary_of_the_paper": "The paper proposes a new defense strategy involving both randomization and smoothing.  To my knowledge, no other paper has proposed precisely the same defense.", "summary_of_the_review": "The \"adaptive attack\" is not sufficient and needs improvement.  I am highly skeptical that this defense will stand up to scrutiny, and I don't think the current experiments demonstrate that it will.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "JFvhpT5ijT0", "reviewer": "Reviewer_9ZHX", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Strengths:\n- The introduced defense is sound and novel\n- The defense does not depend on adversarial training, so it is quite fast to train in practice compared to adversarial training.\n- The defense is evaluated using standard white-box and blackbox attacks and compares to SOTA robustness benchmarks.\n\n### Weaknesses:\n- The new defense requires smoothening the input at test time, which requires multiple (200 - 400) forward-backward runs through the network, which might be impractical in some scenarios.\n- The writing quality can be improved and it is hard to follow some sections on the paper.\n- The submission does not include code. \n\n### Detailed questions/suggestions:\t\n- As I understand, at test time, the defense smoothens the input by adding noise and doing 200-400 iterations through the network to minimize the smoothing loss. Does this have to be sequential? Or could these be done in parallel (batches)? This matters for assessing the practicality of the defenses. That being said, it would also be helpful to add an inference time table to make this clearer for the reader.\n- The paper mentions: “What is the consequence if we make the image smoother further, i.e., to decrease L_{F^l} ? The natural effect will be the increase of cross-entropy loss L_{ce} , but the drop in classification accuracy should be small since L_{F^l} and L_{ce} are comfortable with each other.” in an attempt to justify or motivate the introduced loss? But I didn’t really get what this means. What does it mean that two losses are “comfortable with each other”? I think this is too hand-wavy and I encourage the authors to fix this.\n- I am curious how the defense scales to ImageNet.\n- I am not sure what Fig 4 and 5 are adding to the paper. What should the reader be looking at in these figures? I think adding takeaways of these figs in text or caption should be helpful.\n\n### Small changes:\nIn Alg 1, “s” should be “l”.\n\n", "summary_of_the_paper": "The paper introduces a new empirical defense against adversarial examples. The new defense is competitive to SOTA adversarial training based defenses, but does not use adversarial training. Specifically, the paper proposes adding an additional loss to the standard classification loss which “smoothens” the feature maps of a specific layer in the model. At test time, random noise is added to each input, then the input is smoothened out (in an attempt to remove the adversary), by minimizing the Smoothening loss introduced earlier with respect to the input. The introduced defense is rigorously evaluated using SOTA attacks and shows competitive robust accuracies to adversarially-trained models on CIFAR-10 and CIFAR-100.\n", "summary_of_the_review": "Overall I think the introduced defense is novel and sound. The new defense is faster at training time than adversarial training, but slower at inference time. It achieves slightly better accuracies than SOTA and is properly evaluated to the best of my knowledge on white-box and black-box attacks. I will give a score of “marginally above the acceptance threshold” since the paper quality can be improved, and since I have several questions which I think require clarification from the authors (see above). ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "H0mMd5fRcZq", "reviewer": "Reviewer_qx2w", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n1. The paper develops an effective and simple adversarial defense that requires only adding a simple regularization term during training, and additional processing of inputs during testing.\n2. The proposed defense appears to outperform baseline defenses on strong attacks. The accuracies achieved by the defense appear competitive.\n\nWeaknesses\n1. The proposed defense is novel, but some ideas are similar to ones previously proposed in the literature. In particular, the idea of feature smoothing is related to prior work as noted in section 2. Moreover, the idea of adding noise to inputs as a defense has been explored in the literature on randomized smoothing.\n2. The proposed defense is not theoretically motivated. This is not strictly necessary given the strong empirical results; however, it would be helpful to provide further intuition on why the interaction between feature smoothing during training and during active defense may enhance adversarial robustness.\n3. It is not clear to what extent the noise (step 1 of active defense) by itself enhances robustness vs. the feature smoothing step of the active defense. The authors demonstrate that standard training by itself with active defense is ineffective, indicating the importance of the feature smoothing loss during training. It would be helpful to conduct a similar ablation experiment to evaluate the importance of the noise vs. feature smoothing steps in the active defense.\n4. It is possible that the high performance of the proposed method is due to obfuscated gradients since for the attacker, optimizing inputs through the active defense may be more difficult. Adding additional experiments to demonstrate that obfuscated gradients do not occur would strengthen the paper (the authors may want to consider the experiments in Athalye et al., 2018).\n5. The authors do not state whether the proposed method is state-of-the-art. To the best of their knowledge, do the authors achieve state-of-the-art robust accuracy on CIFAR-10 at $\\epsilon=8/255$?\n6. What is the role of the L1/absolute value penalty in eqn 3? Would the method still be effective with an L2/square penalty?\n\nMinor comments\n1. Some typos: \"AutoAttak\" in section 3, \" It needs to emphasize here \" -> \" It needs to be emphasized here\" in section 5\n\n", "summary_of_the_paper": "This paper proposes a defense against adversarial attacks that does not involve using attacks in the defense process. The defense consists of two parts: first, a feature smoothing loss is added to the main objective function during training. Then, when defending against attacks, noise is added to the input followed by additional perturbations to the input designed to decrease the feature smoothing loss. The proposed method achieves favorable accuracies relative to baseline defenses.", "summary_of_the_review": "The proposed method appears to achieve state-of-the-art performance. However, fully demonstrating this will require addressing the possibility of obfuscated gradients. Moreover, understanding the role of noise in the active defense via an ablation experiment will be important to see which aspects of the method actually improve robustness. If the authors can address these points, the paper would be significantly improved.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "5LpULtI_9sG", "reviewer": "Reviewer_R7ZE", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The motivation of its current version is unclear. The performance gain of robustness is not convincing. \n\n- The feature smoothing method is proposed for training robust model, but it also is used in the test phase. The motivation for applying this strategy in the test phase is unclear. Intuitively, removing the inference-time smoothing operation (the backpropagation process) will degrade the accuracy of the proposed method.\n- The proposed method is actually ‘attack’ the generation process of adversarial examples, so this strategy may give false robustness. This kind of approach is not novel [1].\n- Besides adaptive attack, the criterion suggested by [2] is also necessary to verify the robustness.\n\n[1] Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks. arXiv\n[2] Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ICML2018\n", "summary_of_the_paper": "This paper aims to provide an approach to train a robust model, where the model is trained without adversarial examples. To this end, the authors introduce an inference-time defense strategy. However, this idea is not novel. Moreover, the inference-time defense strategy may give false robustness.", "summary_of_the_review": "The motivation of its current version is unclear. The performance gain of robustness is not convincing. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper suggests a novel defense against adversarial perturbations where during training a loss term is added which enforces similar feature representations.
At test time: i) noise is added, ii) the feature loss is minimized

The authors report excellent results against AutoAttack but the problem is that AutoAttack expects a static, non-randomized defense. Both is not the case for the defense proposed in the present paper. Therefore,  the evaluation with AutoAttack could significantly overestimate the actual robustness and the evaluation of the paper is therefore not valid. Thus adaptive attacks are needed, which are tailored to the defense mechanism, see e.g. Carlini et al, On Evaluating Adversarial Robustness, https://arxiv.org/abs/1902.0670. 

As two reviewers noticed, the suggested "adaptive attack" in the paper is not properly attacking the whole defense mechanism by unrolling the test time optimization and using additionally EOT. Thus it is unclear at the moment if the method is really robust. Moreover, the inference time is significantly increased so that it is questionable if this approach is practically relevant. Therefore this paper is not ready for publication yet.
Decision: Reject