Local Reweighting for Adversarial Training
Authors: Ruize Gao
Feng Liu
Kaiwen Zhou
Gang Niu
Bo Han
James Cheng
Venue: ICLR 2022 Submitted (2022)
Keywords: adversarial training

Abstract: Instances-reweighted adversarial training (IRAT) can significantly boost the robustness of trained models, where data being less/more vulnerable to the given attack are assigned smaller/larger weights during training. However, when tested on attacks different from the given attack simulated in training, the robustness may drop significantly (e.g., even worse than no reweighting). In this paper, we study this problem and propose our solution--locally reweighted adversarial training (LRAT). The rationale behind IRAT is that we do not need to pay much attention to an instance that is already safe under the attack. We argue that the safeness should be attack-dependent, so that for the same instance, its weight can change given different attacks based on the same model. Thus, if the attack simulated in training is mis-specified, the weights of IRAT are misleading. To this end, LRAT pairs each instance with its adversarial variants and performs local reweighting inside each pair, while performing no global reweighting--the rationale is to fit the instance itself if it is immune to the attack, but not to skip the pair, in order to passively defend different attacks in future. Experiments show that LRAT works better than both IRAT (i.e., global reweighting) and the standard AT (i.e., no reweighting) when trained with an attack and tested on different attacks.

Under review as a conference paper at ICLR 2022
LOCAL REWEIGHTING FOR ADVERSARIAL TRAINING
Anonymous authors
Paper under double-blind review
ABSTRACT
rnstences-reweighteed adversarial training (IRAT) can significantly boost the ro- bustness of trained models, where data being less/more vulnerable to the given attack are assigned smaller/larger weights during training. However, when tested on attacks different from the given attack simulated in training, the robustness may drop significantly (c.g., even worse than no reweighting). In this paper, we reweighted adversarial train-
study this problem and propose our oolution-localll ing (LRAT). The rationale behind IRAT is that we do not need to pay much attention to an instance that is already safe under the attack. We argue that the safeness should be balack-dependent so that for the same instance, its weight can change given different attacks based on the same model. Thus, if the attack simulated in training is snis-ipe, the weights of IRAT are misleading. To this end, LRAT pairs each instance with its adversarial variants and performs local reweighting inside each pair, while performing no global reweighting the rationale is to fit the instance itself if it is immune the attack, but not skip the pair, in order to pas- sively defend different attacks in future. Experiments show that LRAT works better than both IRAT (i.e., global reweighting) and the standard AT (i.e., no reweighting) when trained with an attack and tested on different attacks.
INTRODUCTION
growing body of research shows that neural networks are vulnerable adversarial examples, i.e., test inputs that are modified slightly yet strategically to cause misclassification (Carlini & Wagner, 2017a; Finlayson al., 2019; Kurakin et al., 2017; Nguyen al.. 2015; Szegedy et al., 2014; Wang et al., 2019; Zhang et al., 2020b). It is crucial to train a robust neural network to defend against such examples for security-critice computer vision systems, such as autonomous driving and medical diagnostics (Chen et al., 2015; Ma et al., 2021; Miyato et al., 2017; Nguyen et al., 2015; Szegedy et al., 2014). To mitigate this issue, adversarial training methods have been proposed in recent years (Balunovic& & Vechev, 2019; Goodfellow et al., 2015; Madry et al., 2018; Shafahi et al., 2020; Wang et al., 2020a; Wu et al., 2020). By injecting adversarial examples into training data, adversarial training methods seek to train an adversarial invariant in a small neighborhood of its inputs (Bai et al., 2019; He et al., 2018; Papernot et al., 2016; Raghunathan al., 2020; Tsipras al., 2019; Yang et al., 2020).
deep network whose predictions locally
Due to the diversity and complexity of adversarial data, over-parameterized deep networks have insufficient model capacity in adversarial training (AT) (Zhang et al., 2021). To obtain robust model given fixed model capacity, Zhang et al. (2021) suggest that we do not need to pay much attention to an instance that is already safe under the attack, and propose instance-reweightee adversarial training (IRAT), which performs global reweighting with a given attack. To identify instances, they propose: a geometric distance (GD) between natural data points and current class boundary. Instances being closer to/farther from the class boundary is more/less vulnerable to the given attack, and should be assigned larger/smaller weights during AT. This geometry-aware IRAT (GAIRAT) significantly boosts the robustness of the trained models when facing the given attack.
However, when tested on attacks that are different from the given attack simulated in IRAT, the robustness of IRAT drops significantly (e.g., even worse than no reweighting). First, we find that a large number of instances are actually overlooked during IRAT. Figure ((a) shows that, for approximately four-fifths of the instances, their corresponding adversarial variants assigned very low weights (less than 0.2). Second, we find that the robustness of the IRAT-trained classifier drops significantly when facing an unseen attack. Figures 1(b) and ((c) show that the classifier trained by

---

Under review as a conference paper at ICLR 2022
Number Insances (104)
08
200
2.4
894
Naural
Naual
FGD
PGD
10
Weight
Epech
(a) Weight distribution
(b) SAT Results
(c) GAIRAT Results
The extreme reweighting in GAIRAT results in significant decrease when facing an unseen attack. The subfigure (a) illustrates the frequency distribution of weights in the GAIRAT model on the CIFAR-I 1-10 training set, where approximately four-fifths of the instances subfigure (h) and (c) illustrate the performance on the GAIRAT trained model different attacks, which show that GAIRAT does improve the robustness when attacked by PGD (used during training), but reduces the robustness when attacked by CW (unseen during training).
Figure I:
assigned very low weights (less than 0.2). The
trained model under
GAIRAT (with projected gradient descent (PGD) attack (Madry et al., 2018)) has lower robustness when attacked by the unseen Carlini and Wagner attack (CW) (Carlini Wagner, 2017b) compared with the robustness of standard adversarial training (SAT) (Madry et al., 2018).
Since the robustness of a model is not determined by any single attack, the improved performance for kind of given attack is not sufficient to justify robustness. As shown Figure 2, ranking of attack intensity varies with different datasets, adver- sarial training methods and so on, which means there is not the strongest attack in all situations. For another, previous studies of the adversarial detection (Lee et al., 2018; Ma et al., 2018; Gao et al., 2021) show that the stronger adversarial examples for robust classifiers to predict, the easier for the adversarial detectors detect. This means improving performance not only on stronger attacks, but also on weaker ones, as some of attackers may choose to use weaker attacks to escape from the adversarial detection. Hence, robustness needs the network to consider a variety of potential attacks.
APGD
APGD-DLR
Ranking
CIFARIU
CIBAR-10 1OU Dilferest datasets
SVIEN
Thy Imagentt
APGD CE
APGD-DI
In this paper, we investigate the reasons behind the failure of IRAT on unseen attacks. Unlike the common scenario of the classification problem where the training and testing data are fixed, there are different adversarial variants for the same in- stance in AT, e.g., PGD-based based or CW-based adversarial variants. natural question comes with this whether there are incon- sistent vulnerabilities in the view of different attacks? The answer is affirmative. Figure visualizes this phenomenon using t-SNE (Van der Maaten & Hinton, 2008). The four sub- figures in Figure 3 visualize inconsistent vulnerable instances in different views using I-SNE. The red dots in all subfigures represent consistently vulnerable instances between different views, while the blue dots represent the inconsistent vulnerable instances. From the SAT-trained classifier (Figure 3(a)-((d)) we can clearly see that a large number of vulnerable instances inconsistent (the blue dots dominate in all the subfigures).
FAB
Ramking
A0
TSADES
TRADES
Different training types
Figure 2: The ranking of attack in- tensity on different datasets. AT (Madry et al., 201 1) and TRADES (Zhang al., 2019) are different ad- versarial trianing methods. AT-60 and TRADES -60 denote the early stop models at the epoch 60.
Given the above investigation, we argue that the safeness of instances is attack-dependentt, that is, for the same instance, its weight can change given different attacks based on the same model. Thus, the attack simulated in training is mis mis-specified, the weights of IRAT misleading, In order to ameliorate this pessimism of IRAT, we propose our solution lociiionnlcclllyy reweighted adversarial training (LRAT). As shown in Figure 4, LRAT pairs each instance with its adversarial variants and performs local reweighting
2

---

Under review as a conference paper at ICLR 2022
50
50
50
50
0
0
-50
50
-50
-50
500
50
50
50
50
-50
(a) V-Union
(b) you yow
(c) you yeGD
(d) yOG yow
Figure Visualization inconsistent vulnerable instances different views using t-SNE. The dots in subfigures are outputs of the last layers in SAT-trained classifier (subtigures (a)-(d)) Classifier inputs are natural data points in the CIFAR-10 10 training set. The dots represent the vulnerable instances (top-20%) The red dots represent consistently vulnerable instances. while the blue dots represent the inconsistent vulnerable instances in the view of you yPCD and pew ydb is the vulnerability w.r.t. geometry distance (GD) defined by Zhang et al. (2021). yPaD and yew are the vulnerability measurement function w.r.t. PGD and CW, respectively, which is defined in Eq. (5) and Eq. (6). We can clearly see that there exist abundant blue dots but only a few red dots, which means a large number of inconsistent vulnerable instances in different views.
inside each pair, while performing no global reweighting. The rationale of LRAT is to fit the instance itself if it is immune the attack, and in order to passively defend different attacks in future. LRAT does not skip the pair.
In terms of the common attribute of adversarial attacks that misleading the classifier with a low probability of predicting the correct label and a high probability of predicting the false label (Madry al., 2018; Carlini Wagner, 2017b), we propose a general reweighting strategy that applicable to various representatively attacks. Our experimental results show that compared with AT, LRAT can achieve better results on various simulated attacks. Other than previous global reweighting training that GAIRAT, LRAT can boost the performance of AT on PGD with no decline on other attacks.
ADVERSARIAL TRAINING
In this section, we briefly review existing adversarial training methods (Madry et al., 2018; Zhang et al., 2021). Let (X', doo) be the input feature space X with a metric (x, x²) = || - x' a'Iloc. and B, (x) = {a' do (x. xx) S c) be the closed ball of radius c > 0 centered at æ in X'. The dataset S {æx V4 1 where æ; E X, E y {0, 1,.... K - 1}. We use fo(æ) to denote deep neural network parameterized by 0. Specifically, fo (x: predicts the label an input instance æ via:
So (x) arg max Pa (x:; 0),
KEK
where P& (= 0) denotes the predicted probability (softmax on logits) of x belonging to class k.
2.1
STANDARD ADVERSARIAL TRAINING
The objective function of SAT (Madry et al., 2018) is
min Σ (()) JoEF n 1=1
(2)
where 2; = arg max [m] ((fo v1) and =
{f
V}. The selected è is the most
adversarial variant within the e-ball center æ. The loss function é: RRKK x y - IR is composition of a base loss fg A x y + R (e.g., the cross-entropy loss) and an inverse link function lz : RKK + R-i (e.g.. the soft-max activation). where A -1 is the corresponding probalility simplex. Namely, {(fe()) = l ( y). PGD (Madry et al., 2018) is the most common approximation method for searching the most adversarial variant. Starting from (0) E X, PGD (with step size a > 0) works follows:
x ((+1) = I1, [ml (x (x) + Vv. ()))))
(3)
3

---

Under review as a conference paper at ICLR 2022
Natural instance
Adversarial variant
Small-weight
Medium-weight
Largo-weight
Decision boundary
From the same instance
Figure 4: The illustration of LRAT. LRAT pairs each instance with its adversarial variants, and performs local reweighting inside each pair instead of global reweighting. For the same instance, there is inconsistent vulnerability in different views (the difference between red and blue). Thus, LRAT gives larger/smaller weights on the losses adversarial variants, respectively.
where N is the number of iterations; (x) refers to the starting point that natural instance (or natural instance perturbed by small Gaussian or uniformly random noise); y is the corresponding label for x (0); (+) is the adversarial variant step 11g, [m)(0] (-) is the projection function that projects the adversarial variant back into the e-ball centered at (0) if necessary.
2.2 GEOMETRY-AWARL INSTANCE-REWIIGHTER ADVERSARIAL TRAINING
GAIRAT a typical IRAT proposed by Zhang et al. (2021). GAIRAT argues that natural training data farther from//lose to the decision boundary safc/non-rrobustness, and should be assigned with smaller/larger weights. Let w(x y) be the geometry-aware weight assignment function on the loss of the adversarial variant Σ, where the generation of E follows SAT. GAIRAT aims to
min 1 JOEF
w (.o
(4)
T
Eq. (4) rescales the loss using function wax, y). This function is non-increasing w.r.t. GD, which defined as the least steps that the PGD method needs to successfully attack the natural instances.
The method then normalizes to ensure that w(x y) < 0 and > w(2,, M/) = 1. Finally
GAIRAT employs bootstrap period in the initial part of the training by setting w(x,, M) =
thereby performing regular training and ignoring the geometric-distance of input (I,,
3 THE LIMITATION OF IRAT: INCONSISTENT VULNERABILITY IN DIFFERENT VIEWS
The difference between Eq. (2) and Eq. (4) is the addition of the geometry- aware weight w(x v). According GAIRAT (Zhang et al., 2021), more vulnerable instances should be assigned larger weights. However, the relative vulnerability between instances may vary in different situations, such for different adversarial variants. V represents the selected variable measure the vulnerability between the classifier and adversarial variants, and the smaller V, the more vulnerable is the instance.
For the PGD-based adversarial variant, the lower predicted probability has on true class, the smaller V. Here, we give the definition of PPDD
Definition (Vulnerability in the view of PGD). In the view of PGD, the vulnerability PGD regarding (generated by PGD) defined as
DPED :- (T))
(5)
where Py denotes the predicted probability (softmax on logits) of ã belonging to the true class y.
For the CW-based adversarial variant, the relatively higher predicted probability has on the false class, the larger yow Here, we give the definition of yow
4

---

Under review as a conference paper at ICLR 2022
1200
1200
1200
The number of incaacees
1000
The number of instunces
1000
The mumber of instanees
1000
600
800
600
400
400
400
1.0
under PGD
PGD asack
PGD
(a) All PGD
(b) Vulnerable PGD under all PGD
(c) Vulnerable CW under all PGD
2500
2300
2500
mhnber of listances
nunber of Iestanzes
The nomber of insincves
2000
2000
2000
1500
1500
1500
1000
1000
0000
300
300
500
0.0.5
0.6.5
0.0.
under
under CW
under
(d) All CW
(e) Vulnerable CW under all CW
(l) Vulnerable PGD under all CW
Figure 5: The inconsistent vulnerability between instances about different variants. subfigures illustrate the frequency distribution of adversarial variants in the GAIRAT trained model on the CIFAR- training set (50,000). The x-coordinate in subfigures (a)-(c) is V in the view of PGD. The x-coordinate in subfigures (d)-(f) V in the view of CW. Light yellow and light blue all instances (50,000) in the view of PGD and CW, while dark yellow and dark blue are top-20% vulnerable instances (10,000) respectively in view PGD and CW: Different distributions of dark yellow and dark blue between subfigure (b) and (c) (or between subfigure (e) and (f)) show that, the vulnerable instances in the view of different attacks are not the same.
Definition (Vulnerability in the view of CW). the view of CW, the vulnerability VOW regarding i (generated by CW) is defined as
CW (a. Zy (ū)
m igg
where Zy denotes the predicted logits of o (CW) belonging to the true class y. The max Z (z) denotes the maximum predicted logits of ā (CW) belonging to the false class (i # y).
As shown in Figure 5, the dark yellow and dark blue are top-20% vulnerable instances in the view of PGD and CW, respectively. The frequency distribution of dark yellow in Figure 5(b) and dark blue in Figure 5(c) is clearly different, and the frequency distribution of dark blue in Figure 5(e) and dark yellow in Figure 5(f) is also different. This phenomenon means that the most vulnerable 10, 000 PGD adversarial variants and the most vulnerable 10, 000 CW adversarial variants are not from the same 10, 000 instances. As consequence of this inconsistency, if the attack simulated in training is mis-specified, the weights of IRAT will be misleading.
LOCALLY REWEIGHTED ADVERSARIAL TRAINING
To break the limitation of IRAT and train robust classifier against various attacks, we propose LRAT in this section, for which we perform local reweighting instead of global/no reweighting.
4.1 MOTIVATION OF LRAT
The Reweighting is Beneficial on the Given Attack. As suggested by GAIRAT (Zhang et al., 2021), the global reweighting indeed improves the robustness when tested on the given attack (PGD) simulated in training. Figures 1(b) and ((c) also show that, as a global reweighting, GAIRAT improves the robustness against PGD (when PGD is simulated in training). Thus, when training and testing on the same attack, the rationale that we do not need to pay much attention to an already-safe instance under the attack is significant.
5

---

Under review as a conference paper at ICLR 2022
Local Reweighting Can Be Used to Take Care of Various Attacks. As introduced in Section 3, there is inconsistent vulnerability between instances in different views. Thus, to defend against various attacks, we should perform local reweighting inside each pair, while performing global reweighting- the rationale to fit the instance itself it is immune to the attack, but not to skip the pair, in order to passively defend different attacks in future.
4.2 LEARNING OBJECTIVE OF LRAT
Let ((t y) be the weight assignment function on the loss of adversarial variant ă. The inner optimization for generating á depends on attacks, such PGD (Eq. (2)). The outer minimization is:
min JoEJ
c c-
- ( vi) {(f((E)),)) + Σ w Bl(
(7)
where n is the number of instances in one mini-batch; m is the number of used attacks; C is constant representing the minimum weight sum of each instance; the notation [a]+ stands for max (a, 03. We
impose two constraints on our objective Eq. (7): the first constraint ensures that w y) > 0 and the
second constraint ensures that C > 0. The non-negative coefficient - - w (ā.jj. s. 3/ ]]+ assigns some weight the adversarial data term ã", which serves a gentle lower bound avoid discarding instances during training. It can also be seen that different weights are assigned to different adversarial variants, respectively. LRAT pairs each instance with its adversarial variants and performs local reweighting inside each pair. Figure 4 provides an illustrative schematic of the learning objective of LRAT. We also consider a simple version of LRAT, i.e., locally simulated adversarial training (LSAT) that simulating attacks with no reweighting in training that w(E y) C,C < 1, = 1 and T is generated by any simulated attack, if ã is generated by PGD, LRAT recovers the SAT (Madry et al., 2018), which assigns equal weights to the losses of PGD adversarial variant.
4.3 REALIZATION OF LRAT
The realization of LRAT consists of the locally simulated and locally reweighted.
Locally Simulated. Previous adversarial training methods (Madry et al., 2018; Zhang et al., 2021) only simulated PGD attack in training. As analysed in Section 3, there are inconsistent vulnerablility in different views. Different adversarial attacks simulated in training can also behave differently. For defend against diverse attacks, we should consider simulating diverse attacks in training before reweighting. According to the difference objective function, simulate two kind of representative attacks that CW attack and simplified targetted APGD-DLE attack (SAA).
The loss function in CW is:
(W(,æ,1)) := -zy( + max Zi (z) Kis
(
where Zy is the predicted logit of ã belonging to the true class y; Ke denote the confidence (following (Cai et al., 2018; Zhang et al., 2020a)).
50 is hyper- to
The loss function in targeted APGD-DLR is:
By (x') - Zz (x')
Targeted-DLR(JJ x.
Za. (x') 1 (Zn, (xx) Znn, (x¹)))
where π is the ordering of the components of x in decreasing order.
Locally Reweighted. The objective in Eq. (7) implies the optimization process of adversarially robust network, with one step generating adversarial variants from natural counterparts and then reweighting loss on them, and one step minimizing the reweighted loss w.r.t. the model parameters 0. For each variant, the definition of the w in Eq. (7) also means lot. Zhang et al. (2021) heuristically design non- non-increasing function w:
w(x v) (1 tanh (A + 5 x (1 - 2 x x(x, (((x,))/Kmxxx]]
(10)
2
where R//mmax E [0, 1}, Kmax E N+, and À E R. <(æ y) is the GD defined as the least steps that the PGD method needs to successfully attack the natural instance. Kmax is the maximally allowed steps.

---

Under review as a conference paper at ICLR 2022
Algorithm Locally Reweighted Adversarial Training (LRAT)
Input: network architecture parametrized by training dataset S, learning rate n, number of epochs T, batch size n, number of batches N, number of attacks m.;
Output: Adversarial robust network fo:
for epoch =
.T .. do
for mini-batch ..2.....N do
Sample mini-batch {(.:. 1/) 1h) ) from S; n2 for = . do
for = 1........... ..... do
Obtain adversarial data Tij of as by the attack j; Calculate Wij according ((ag)))) by Eq. (12);
end for end for
0 0 1 E
Vo
wij
(foo (#)) .1) +Σn waye e (So (Z .1) /n:
end for end for
However, the efficacy of this heuristic reweighting function is limited. As mentioned in Figure (c), when PGD is simulated in training, the robustness on CW attack decreases. For another, as shown in Figure 6, when CW is simulated in training, this reweighting function shows the same decrease when tested on CW.
1.0
0.8
Accuracy
0.6
0.4
Hence, rational and effective reweighting function necessary. The generations of adversarial variants follow different rules under different attacks, whereas their common attribute is to mislead the classifier with low probability of predicting the correct label and a high probability of predicting the false label (Madry et al., 2018; Carlini & Wagner, 2017b). reasonable to consider the margin of predicted prob- ability between the correct label and the false label variable that affects the reweighting function. Definition (The variable factor). The variable fac- tor regarding adversarial variant z is defined as
Natural
0.2
PGD
CW
0.0
25
50
100
Epoch
Figure 6: The limitation of Eq. (10). The figure illustrates the performance on the GAIRAT trained model when the CW is sim- ulated in training.
t(a.w) (v( max (ō),
(11)
where Py denotes the softmax on logit of i belonging to the true class y.
Given the variable factor I, we also need to consider how to define the reweighting function of L. As known, the reason why adversarial training improves adversarial robustness that adversarial data with a low are used instead of natural data with a high f. It implies the adversarial variant with an high should be assigned a low weight. Motivated by this thinking, we propose a general reweighting function of t to obtain the weights of the corresponding variants, where the higher variable factor t, the lower weights w.
Definition 4 (The reweighting function). The reweighting function regarding the variable factor t defined as
wlt == -)
(12)
where a > 0 and 3 > are hyper-parameterss of each attack.
We present our LRAT in Algorithm 1. LRAT uses different given attacks (e.g., PGD, Algorithm 2 in Appendix A) to obtain different adversarial variants, and leverages the attack- deeenddd reweighting strategy for obtaining their corresponding weights. For each mini-batch, LRAT reweights the loss of different adversarial variants according to our reweighting function, and then updates the model parameters by minimizing the sum of the reweighted loss each instance.
7

---

Under review as a conference paper at ICLR 2022
5 EXPERIMENTS
In this section, we justify the efficacy of LRAT. We consider Lo -norm bounded perturbation that || -- = I c in both training and evaluations in all experiments. All images of the CIFAR-10 are normalized into [0,1].
5.1 EXPERIMENTAL SETUP
We compare our proposed LSAT and LRAT with the no-reweighting strategy (i.e., SAT (Madry al., 2018)) and previous global-rewiighting strategy (i.e., GAIRAT (Zhang al., 2021)). Rice et al. (2020) show that, unlike standard training, overfitting in robust adversarial training decays test set performance during training. Thus, as suggested by Rice et al. (2020), we compare different methods on the performance of the best checkpoint model (the early stopping model at epoch 60). We employ ResNet (ResNet-18) (He et al., 2016) the targeted classifier. Our experimental setup follows previous works (Madry et al., 2018; Wang et al., 2020b; Zhang et al., 2021). All networks are trained for 100 epochs using SGD with 0.9 momentum. The initial learning rate 0.1, divided by 10 at epoch 60 and 90, respectively. The weight decay is 0.0002.
For generating the PGD adversarial data for updating the network, Lo -nrm bounded perturbation Etrain 8/255; the maximum PGD step Kmax = 10; step size Étrain/ momiinn100 /10. For generating the CW adversarial data (Carlini & Wagner, 2017b), we follow the setup in (Cai et al., 2018; Zhang et al., 2020a), where the confidence K. = 50, and other syper-parameten are the same as that of PGD above. For generating SAA adversarial data, we follow the adaptive step and DLR loss in (Croce & Hein, 2020), but only choose 3 targeted classes. Those attaining 3 highest scores the original point æ (excluding the correct one), and 20 steps for computational efficiency.
Robustness to adversarial data is the main evaluation indicator in adversarial training (Carlini et al., 2019; Chen et al., 2020; Cohen et al., 2019; Du et al., 2021; Pang et al., 2019; Yang et al., 2021; Zhu et al., 2021). Thus, we evaluate the robust models based on four evaluation metries, i.e., standard test accuracy on natural data (Natural), robust test accuracy on adversarial data generated by projected gradient descent attack (PGD) (Madry et al., 2018), (0. Carlini and Wagner attack (CW) (Carlini & Wagner, 2017b) and AutoAttack (AA) (Croce & Hein, 2020). In testing, L.x. -nom bounded perturbation Etest = 8/255, the maximum PGD step K 20, and step size a = e/4. There is a random start in training and testing, i.e., uniformly random perturbations ([-Etrain: +erain)] and [-Etest: + added to natural instances. Note that, the extended version of GAIRAT that GAIRAT- RST uses additional 500K unlabeled data CIFAR-10 dataset, and to make fair comparison, adversarial training methods in our experiments only use original data and do not use additional data.
5.2 PERFORMANCE EVALUATION
In experiments of LRAT, simulate three representative attacks that PGD, CW and SAA. For adversarial variants CW and SAA, we use our reweighting function (Eq. (12)) to obtain their corresponding weights, where / follows Eq. (11). We choose the three hyper-parameters (C in Eq. (7), a,3 in Eq. (12)) that a = 2, 8 = 0.5, and C = 0.1, and we analyze it in Appendix B.
We evaluate the performance of LSAT first. As shown in Table compared with SAT, by locally simulated on given attack CW and SAA, LSAT performs better when tested on the simulated attack. The results indicate that practitioners should choose simulate the corresponding attack when there is only one type of attack need to defend against. For adaptive and unseen attacks, the adversarial defense could be described as a barrel effect: if there a short slab, the barrel would leak. Similarly, if there is weakness in defending against some attacks, the classifier would fail to predict. In this case, practitioners should choose to simulate the attack with higher intensity (e.g, AA in Table 2). For another, compared to AT, LRAT-SAA performs better all attacks in testing (PGD, CW and AA), which also indicates that the simulated PGD attack in previous studies can be replaced with SAA to achieve better adversarial robustness.
Then we evaluate the performance of LRAT. As shown in Table 1, compared with LSAT, LRAT can boosts adversarial robustness the simulated attack even further, which is an evidence that reweighting function (Eq. (12)) works well. The results show that our locally reweighting strategy is superior to the no-reweighting strategy and can achieve better adversarial robustness on the simulated
8

---

Under review as a conference paper at ICLR 2022
Table 1: Test accuracy (%) of LRAT and other methods.
Methods
Natural
PGD
CW
AA
Baselines
SAT
83.17
51.14
49.95
46. 12
GAIRAT
79.69
60.82
38.69
32.14
L.ATT
LSAT-CW 80.40
50.49
52.03
45.26
LSAT-SAA
81.58
55,04
51.84
46.95
LRAT
LRAT-CW
79.65
50.01
54.27
45.09
SAA
81.02
54.49
51.05
47.34
LRAT-SA+CW
80.69
53.56
52.02
46.67
Table 2: Ablation study.
Natural
PGD
CW
AA
GD+CW
79.40
58.12
42.95
36.09
GD+SAA
80.47
58.55
41.05
40.71
SAA+CW
80.69
53.56
52.02
46.67
SAA+CW+GD
80.13
57.28
45.15
38.47
attack. It means a lot for the defense on the attack with higher intensity, e.g., LRAT-SAA can perform best on AA. defending against unseen attacks, we recommend that practitioners simulate multiple attacks and assign some weight to the SAA adversarial data term for each instance during training.
Compared with GAIRAT, LRAT has a great improvement under CW and Although GAIRAT improves the performance under PGD and can be good targeted defense against PGD, its poor performance on CW and AA makes AT not enough to be an effective adversarial defense in most scenarios. Mcanwhile, the ablation study in Table 2 also shows involving geometric distance (GD) as a component leads to the decreased robustness when attacked by CW and AA. In contrast, LRAT reduces the threat of any potential attacks also show that our local-reweighting strategy is superior to previous global-reweighting strategy. In general, the results affirmatively confirm the efficacy of LRAT.
a decline on PGD.
effective defense. Thus, the results
CONCLUSION
It has been showing great potential improve adversarial robustness by reweighting adversarial variants during AT. This paper provides a new perspective to this promising direction and aims to train robust classifier to defend against various attacks, Our proposal, locally reweighted adversarial training (LRAT). pairs each instance with its adversarial variants and performs local reweighting inside each pair. LRAT will not skip any pairs during adversarial training such that can passively defend against different attacks in future. Experiments show that LRAT works better than both IRAT (i.e., no reweighting) when trained with an attack
(i.e., global reweighting) and the standard and tested on different attacks. As general framework, LRAT provides insights on how to design powerful reweighted adversarial training under any potentially adversarial attacks.

---

Under review as a conference paper at ICLR 2022
ETHICS STATEMENT
This paper does not raise any ethics concerns. This study does not involve any human subjects, practices to data set releases, potentially harmful insights, methodologies and applications, potential conflicts of interest and sponsorship, discrimination//iaa/aiinn concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILIITY STATEMENT
To ensure the reproducibility of experimental results, we will provide a link for anonymous repository about the source codes of this paper in the discussion phase.
REFERENCES
Yang Bai, Yan Feng, Yisen Wang, Tao Dai, Shu-Tao Xia, and Yong Jiang. Hilbert-based generative defense for adversarial examples. In ICCV, 2019.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In ICLR, 2019.
Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. IJCAI, 2018.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In CVPR, 2017b.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv: /9Xvv:9902006703 2019.
Chenyi Chen, Ari Seff, Alain Kornauser, and Jianxiong Xiao. Deepdriving: Learning affordance for direct perception in autonomous driving. ICCV, 2015.
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From sulf-supervised pre-training to fine-tuning. In CVPR, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. ICML, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In ICML, 2020.
Xuefeng Du, Jingfeng Zhang, Bo Han, Tongliang Liu, Yu Rong, Gang Niu, Junzhou Huang, and Masashi Sugiyama. Learning diverse-structured networks for adversarial robustness. In ICML, 2021.
Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac Kohane. Adversarial attacks on medical machine learning. Science, 2019.
Ruize Gao, Feng Liu, Jingfeng Zhang, Bo Han, Tongliang Liu, Gang Niu, and Masashi Sugiyama. Maximum mean discrepancy is aware of adversarial attacks. In ICML, 2021.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Warren He, Bo Li, and Dawn Song. Decision boundary analysis of adversarial examples. In ICLR, 2018.
10

---

Under review as a conference paper at ICLR 2022
Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. Adversarial examples in the physical world. In ICLR, 2017.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurIPS, 2018.
Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck,
Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In ICLR, 2018
Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Takeru Miyato, Andrew M Dai, and Ian Goodfellow. Adversarial training methods for semi sumi-super text classification. In ICLR, 2017.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In CVPR, 2015.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu, Improving adversarial robustness via promoting ensemble diversity. In ICML, 2019.
Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael Wellman. Towards the science of security and privacy machine learning. arXiv: 161 1.03814, 14,, 2016.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang. John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. In ICML, 2020.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In ICML, 2020.
Ali Shafahi, Mahyar Najibi, Zheng Xu, John Dickerson, Larry S Davis, and Tom Goldstein. Universal adversarial training. In AAAI, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. In ICLR, 2019.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 2008
Haotao Wang, Tianlong Chen, Shupeng Gui, Ting- Kuei Hu, Ji Liu, and Zhangyang Wang. Once- for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. In NeurIPS, 2020a.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In ICML, 2019.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020b.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In NewrlPS, 2020.
Shuo Yang, Tianyu Guo, Yunhe Wang, and Chang Xu. Adversarial robustness through disentangled representations. AAAI, 2021.
Yao- Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. In NeurlPS, 2020.
11

---

Under review as a conference paper at ICLR 2022
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In ICML, 2020a.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.
Yonggang Zhang, Ya Li, Tongliang Liu, and Xinmei Tian. Dual-path distillation: A unified framework to improve Blcck-box attacks. In ICML, 2020b.
Jianing Zhu, Jingfeng Zhang, Bo Han, Tongliang Liu, Gang Niu, Hongxia Yang. Mohan Kankanhalli, and Masashi Sugiyama. Understanding the interaction of adversarial training with noisy labels. arXiv preprint arXiv:2102.03482, 2021.
12

---

Under review as a conference paper at ICLR 2022
A ADVERSARIAL ATTACK
Algorithm 2 and Algorithm 3 are the adversarial data generation of PGD and CW, respectively. The loss function in PGD is:
Ice == log Py (
(13)
where Py denotes the predicted probability (softmax on logits) of æ belonging to the true class The loss function in CW is:
low =zy + max ( Kie
(14)
if
where denotes the logits of ø belonging to the true class yi K = 50 (following the setup in (Cai al., 2018; Zhang al., 2020a)) is hyper-parameter denote the confidence.
B EXPERIMENTAL DETAILS
Weighting Normalization. In experiments, impose another constraint on our objective Eq. (7):
C - Σ wa wil j=1
+
Σ w (Txj, mi) =
(15)
implement& a fair comparison with baselines.
Selection of flyper-paramede
It is an open question how to define the decreasing function w of under
t in Eq. (12). (or given the definition of in Eq. (12), how select the different situations.) In our experiments, given an alternative value set {0.25, 0.5, 1.5, 2, 4), we choose a, in Eq. (12) that a = 2, 3 0.5, and given an alternative value set {0.1, 0.2, 0.4, 0.6), we choose C in Eq. (7) that C 0.1. Our experiments show that the performance has a minor variation between different apper-parameter, and we choose the optimal hyper parameters depending on whose robustness attacked by PGD is the best.
hyper-parameters
Adversarial Data Term. To avoid discarding instances during training, we impose the non-negative coefficient [C Σラ= (( [+]]+ in Eq. (7) to assign some weight the adversarial data term. The definition of the adversarial data term can vary required by different tasks. When practitioners only focus on the robustness under attacks simulated in training, this term can be eliminated. When practitioners focus the robustness under attacks simulated in training and the accuracy natural data, this term can be defined as the loss of the natural instance. When practitioners focus on the robustness under attacks both simulated and unseen in training, this term can be defined the loss of the adversarial variant, and we recommend to use SAA adversarial variant.
C EXPERIMENTAL RESOURCES
We implement all methods on Python 3.7 (Pytorch 1.7.1) with an NVIDIA GeForce RTX 3090 GPU with AMD Ryzen Threadripper 3960X 24 Core Processor. The CIFAR-10 dataset can be downloaded via Pytorch. Given the 50, 000 images from the CIFAR-10 training set, we conduct the adversarial training on ResNet-18 for classification. DNNS are trained using SGD with 0.9 momentum, the initial learning rate of 0.1 and the batch size of 128.
D DISCUSSIONS ON THE DEFENSE AGAINST UNSEEN ATTACKS
As general framework, LRAT provides insights on how to design powerful reweighting adversarial training under different adversarial attacks. Due to the inconsistent vulnerability different views, reweighting adversarial training has the risk of weakening the ability to defend against unseen attacks. Thus, we recommend that practitioners simulate diverse attacks during training. Note that it does not
13

---

Under review as a conference paper at ICLR 2022
mean that practitioners should use different attacks indiscriminatelyy for instance, during standard adversarial training, mixing some weak adversarial data into PGD adversarial data will weaken the robustness the contrary. The recommended diversity is diverse information focused on during adversarial data generation, such as SAA and CW.
Algorithm 2 Adversarial Data Generation in Projected Gradient Descent Attack (PGD)
Input: natural data x E X, label y V, model f, loss funciton ECE, maximum PGD step K, perturbation bound e, step size o;
Output: adversarial data 2; I
while K do
I +- [x] (ī + asigu(Vslcn(((()..)) K + K+ 1;
end while
Algorithm 3 Adversarial Data Generation in Carlini and Wagner Attack (CW)
Input: natural data x E X, label y V, model f, funciton fow, maximum PGD step K, perturbation bound e, step size o;;
Output: adversarial data æ;
I while K do
+ [m] (# +
K + K 1--1 1;
end while
14


Reviews:
[{"review_id": "wnVvke1ef6k", "reviewer": "Reviewer_AgZp", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros\n1. The analysis of GAIRAT is thorough and insightful. The paper perform various experiments showing that GAIRAT overfits to PGD and increases the robust accuracy of PGD. However, it is more vulnerable under other attacks like CW and AA.\n\n2. The motivation of using different attacks during training phase is reasonable. As the network overfits the attack in the training phase, diverse attacks make the network robust to wider range of attacks and reduce the overfitting.\n\nCons.\n1. The evaluation of LRAT is incomplete. The paper only evaluates LRAT on CIFAR10 with the ResNet-18. The paper should perform experiments on more datasets such as CIFAR10 or SVHN to demonstrate the effecitveness of LRAT. Besides, WideResnet-34-10 is the most commonly used network architecture for adversarial training, LRAT should also be tested on this network.\n\n2. The motivation of locally reweighting is unclear. It is also shown in the experiment that the performance of LSAT is close to LRAT.\n\n3. The paper is hard to follow as the authors come up with some notation with definition. For example, I cannot understand $\\tilde{x}_i^*$ in Eqn 7 and Alg 1.\n\nMinors\n1. In Section 4.3, the paper shows that when using GAIRAT with CW attack, the accuracy of CW attack is still lower than PGD. Is it contradictory with analysis in Section 1 and Section 3.\n", "summary_of_the_paper": "The paper studies the reweighting of adversarial training. It first points out the problem of GAIRAT: GAIRAT only improves the robust accuracy under PGD and lowers the accuracy of other attacks like AutoAttack. Based on the findings, the authors propose a new method: LRAT, which performs adversarial training using different attacks and gives different weights to the instances generated by different attacks.", "summary_of_the_review": "The analysis of GAIRAT is thorough and insightful and the motivation of using different attacks is clear. However, the evaluation of LRAT is incomplete and I cannot see the benefit of locally reweighting. Therefore, I tend to reject the paper at current phase.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "w3jy8pa9Lx", "reviewer": "Reviewer_kFgS", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n1. Weighting different adversarial examples for training is intuitive. And the proposed LRAT addresses some existing problems in IRAT.\n2. The proposed method is effective as demonstrated by the experimental results.\n\nWeaknesses\n1. The experiments are not convincing enough to demonstrate whether the proposed method is really better than SAT. In table 1, can SAT reach a similar level of robustness at the same (or at least close) performance drop? Namely, what if we slightly increase the PGD step in SAT in tab 1, and the performance on natural example is expected to degrade, while the robustness is expected to be increased. When both SAT and the proposed method degrades into the same (or close) natural example performance, e.g., 83.17 or 81.02, which method provides better robustness? ", "summary_of_the_paper": "This paper presents a new method named LART that assigns weights to adversarial examples during adversarial training for better robustness. Compared to the previous baseline work, i.e., IART, the proposed method has overcame several disadvantages.\nQuantitative results demonstrate the effectiveness of the proposed method.", "summary_of_the_review": "The proposed method is an intuitive improvement on the existing adversarial example weighting method.\nHowever, the experimental results are not convincing enough to reveal the true improvements.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ex7sU5AGKNG", "reviewer": "Reviewer_qiUn", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper studies the weight strategy of adversarial training. The instance weighting is very old, the readers can not see anything new insight from this paper.  The technique of this paper is very simple without theory analysis. And, the experiments seem that the proposed methods only obtain the marginal gains. The paper is not machine learning paper. I would like to recommend the authors to submit the paper to other application tracks. The details comments are:\n1, why instance reweighting is necesary for adversarial training? can you provide some theory insight for this? From the experiments, we can see that the instance reweighting obains some marginal improvements over SAT, but what is the time cost? why not report the time in experiments? If you cost much more time than SAT, but only obtains very little improve on the accuracy, then it is not a smart method.\n2, why \"the safeness should be attack-dependent\"?   can you provide some theory guarantee for this?  what kind of attack make the safeness change? Is there any possibility that different attackes do not change the safeness? how different attack change the safeness? what kind of attack change the safeness towars more safe or unsafe? The main claim of this paper is not rigious at all.\n3, Can you prove the proposed algorithm converge? and what is the time cost?\n4,Why only consider L_inifity attack? why not try L_1 and L_2 attack? why only ResNet (ResNet-18)? why not try ResNet-34 and ResNet-50 and some other networks? why only use CIFAR-10? why not try imagenet and some other datasets?", "summary_of_the_paper": "The paper studies the weight strategy of adversarial training. The technical contribution of this paper is too limited, and the experiments show very little improvements.", "summary_of_the_review": "1, why instance reweighting is necesary for adversarial training? can you provide some theory insight for this? From the experiments, we can see that the instance reweighting obains some marginal improvements over SAT, but what is the time cost? why not report the time in experiments? If you cost much more time than SAT, but only obtains very little improve on the accuracy, then it is not a smart method.\n2, why \"the safeness should be attack-dependent\"?   can you provide some theory guarantee for this?  what kind of attack make the safeness change? Is there any possibility that different attackes do not change the safeness? how different attack change the safeness? what kind of attack change the safeness towars more safe or unsafe? The main claim of this paper is not rigious at all.\n3, Can you prove the proposed algorithm converge? and what is the time cost?\n4,Why only consider L_inifity attack? why not try L_1 and L_2 attack? why only ResNet (ResNet-18)? why not try ResNet-34 and ResNet-50 and some other networks? why only use CIFAR-10? why not try imagenet and some other datasets?", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "VwnSixd0ViY", "reviewer": "Reviewer_vQ9i", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strong points**\n\n1. This paper points out the issue of IRAT, which is interesting.\n\n2. This paper is well written and easy to follow.\n\n**Weak points**\n\nThe paper claim that IRAT misleads the weights between adversarial variants. However, there is a limited explanation of why IRAT mislead the weights and how local reweighting can prevent those. \n\nThere are limited experimental results to verify the efficacy of LRAT.\n- [Model capacity] There have not been explored LRAT is effective in large parameter models such as WideResNet34-10.\n- [Dataset] There is only a single dataset (CIFAR10) result in the paper. Since the author has shown that there is an inconsistency of strong attacks on different datasets (figure 2), I'm curious how local weights can vary across datasets.\n- [Computational efficacy] How long do LRAT-SAA and LRAT-CW take to train compare to SAT?\n- [Generality] Does LRAT also can be applied to other adversarial training methods such as TRADES?\n- [Limited improvement] I would suggest the authors run the proposed method multiple times and report the variance. The comparison between the gap in average performance and the variance would convince the reader if it is a real improvement.\n**Minor points**\n- There is a missing explanation of how to rank the attack in Figure 2.", "summary_of_the_paper": "Authors pointed out that instances-reweighted adversarial training (IRAT) suffer from vulnerability against the unseen types of attacks. Authors claimed that a large number of instances are actually overlooked in IRAT which may cause that phenomenon. Therefore, the authors suggest locally reweighted adversarial training (LRAT) which performs local reweighting between the adversarial variants pair.", "summary_of_the_review": "Overall, I recommend reject to this paper. I think the contribution is not sufficient for ICLR.\n\nThe improvement is limited compared to SAT and LSAT which is train the model with previous attacks such as CW or APGD-DLR. Moreover, there are limited comparisons as I elaborated in the weak points.\n\nHowever, if all my concerns resolve properly, I will increase my score.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Meta-review: Reviewers raised various concerns and authors sent in no rebuttal. In view of the negative consensus, this paper then made a clear rejection case.
Decision: Reject