Probabilistic Margins for Instance Reweighting in Adversarial Training
Authors: Qizhou Wang
Feng Liu
Bo Han
Tongliang Liu
Chen Gong
Gang Niu
Mingyuan Zhou
Masashi Sugiyama
Venue: NeurIPS 2021 Poster (2021)
Keywords: Adversarial robustness

Abstract: Reweighting adversarial data during training has been recently shown to improve adversarial robustness, where data closer to the current decision boundaries are regarded as more critical and given larger weights. However, existing methods measuring the closeness are not very reliable: they are discrete and can take only a few values, and they are path-dependent, i.e., they may change given the same start and end points with different attack paths. In this paper, we propose three types of probabilistic margin (PM), which are continuous and path-independent, for measuring the aforementioned closeness and reweighing adversarial data. Specifically, a PM is defined as the difference between two estimated class-posterior probabilities, e.g., such a probability of the true label minus the probability of the most confusing label given some natural data. Though different PMs capture different geometric properties, all three PMs share a negative correlation with the vulnerability of data: data with larger/smaller PMs are safer/riskier and should have smaller/larger weights. Experiments demonstrated that PMs are reliable and PM-based reweighting methods outperformed state-of-the-art counterparts.

Probabilistic Margins for Instance Reweighting in Adversarial Training
Qizhou Wang 1. Feng Liu Bo Han Tongliang Liu?, Chen Gong Gang Niu Mingyuan Zhou?, Masashi Sugiyama Department of Computer Science, Hong Kong Baptist University DeST Lab, Australian Artificial Intelligence Institute, University of Technology Sydney
STLL Lab, School of Computer Science, Faculty of Engineering, The University of Sydney
'PCA Lab, Key Lab of Intelligent Perception and Systems for High-Dimensional Information of MoE "Jiangsu Key Lab of Image and Video Understanding for Social Security,
School of Computer Science and Engineering, Nanjing University of Science and Technology
RIKEN Center for Advanced Intelligence Project (AIP)
McCombs School of Business, The University of Texas at Austin
*Graduate School of Frontier Sciences, The University of Tokyo
(csqzwang, bhanml
[ @comp. hkbu. edu hk, feng. liuuuts...... .eatts.eddu.e. edu. au,
tongliang 1 liu@sydney..... edu. au, chen. gongenjust. must.edu.cem cn, gang niu. ml @gmail.coo mingyuan.
cat.yyaan..huummcoooiiii zhou@mccombs utexas. edu, sugiōk. u-tokyo.
Abstract
Reweighting adversarial data during training has been recently shown to improve adversarial robustness, where data closer to the current decision boundaries are regarded more critical and given larger weights. However, existing methods measuring the closeness are not very reliable: they are discrete and can take only a few values, and they are path-dependent i.e., they may change given the same start and end points with different attack paths. In this paper, we propose three types probabilistic margin (PM), which are continuous and puth-independent for measuring the aforementioned closeness and reweighting adversarial data. Specif- ically, PM defined as the difference between two extimated class-posterior probabilities, c.g., such probability of the true label minus the probability of the most confusing label given some natural data. Though different PMs capture different geometric properties, all three PMs share negative correlation with the vulnerability of data: data with larger/smaller PMs are safer/riskier and should have smaller/larger weights. Experiments demonstrated that PMs are reliable and PM--bsed reweighting methods outperformed state-of- oftt--o-thheassd f-tthee-rt art counterparts.
Introduction
Deep neural networks are susceptible to adversarial examples that are generated by changing natural inputs with malicious perturbation [17, 20, 37, 39]. Those examples imperceptible human eyes but can fool deep models to make wrong predictions with high confidence [3, 35). As deep learning has been deployed in many real-life scenarios and even safety-critical systems [15, 16, 28], it is crucial to make such deep models reliable and safe [19, 25, 30]. To obtain more reliable deep models, adversarial training (AT) [2, 10, 29] was proposed one of the most effective methodologies against adversary attacks (i.e., maliciously changing natural inputs). Specifically, during training, it simulates adversarial examples (e.g., via project gradient descent (PGD) [1, 29, 46, 41]) and train classifier
"Equal contribution.
t Corresponding author.
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

10a
success fail
0.85
accuracy (%)
# #example
1055
0.75
10
40
GAIRAT
0.70
IISTAAT
PGD LM-PCD
PGD GAIRAT
PGD (as
10
20
30
40
50
20
40
60
80
100
step
LPS
#epoch
(a) Loss Curve
(b)
Histogram
(c) Accuracy Curve
Figure 1: An illustration for the drawbacks of LPS. (a) suggested that LPS is path-dependent and the PGD method (PGD) may get stuck at sub-optimal points. Here, we proved the existence of better (not optimal) solution given by a LM-PGD method (Appendix A). LPSs are 50 and estimated by PGD and LM-PGD, respectively, which reveals that LPS depends the adopted attacks. (b) suggested that LPS can take only a few discrete values, and may have confusing meanings when LPS met its maximum. In this case, one can hardly distinguish non-robust data with LPS being 10 and safe data that are insensitive to be attacked. (c) showed that the accuracy of GAIRAT (on CIFAR-10 10) dropped when facing CW attacks. The main reason is that LPS is not reliable in measuring the distance, and thus it makes wrong judgments when assigning weights for non-robust instances.
with the simulated adversarial examples [29, 46]. Since such model has seen some adversarial examples during its training process, it can defend against certain adversarial attacks and is more adversarial robust than traditional classifiers trained with natural data [7, 14, 36, 49].
Recently, researchers have found that werrpaaameterized deep networks still have the insufficient model capacity, due to the overwhelming smoothing effect of AT 33J. As result, they proposed instince-reweighheed adversarial training, where adversarial data should have unequal importance given limited model capacity [47]. Concretely, they suggested that data closer to the decision boundaries are much more vulnerable to be attacked [45, 47] and should be assigned larger weights during training. To characterize these geometric properties of data (i.e., the closeness between the data and decision boundaries), Zhang et al. [47] suggested an estimation in the input space, i.c., the least PGD steps (LPS), to identify non-robust (i.e., easily-be-attacke
data. Specifically, LPS is the number of steps make the adversarial variant of such an instance cross the decision boundaries. starting from natural instance. Based on LPS, they achieved state-of late-of-ther of-the-art performance via general framework termed geomelry-awaee instance-rewed instacc--rewiihhted adversarial training (GAIRAT).
However, existing methods [1 [18, 22, 38] in measuring the ge- ometric properties of data are path-dependent, i.c., they may change even given the same start (a natural example) and end point (the adversarial variant); and they are discrete with only a few valid values (Figure 2). The path-dependency makes the computation unstable, where the results may change given different attack paths. The discreteness makes the measure- ment ambiguous since each value would have several (even contradictory) meanings. We take LPS as example to demon- strate a path-dependent (Figure la) and discrete measurement (Figure lb). As we can see in Figure Ic, the consequence is non-negligible: although adopting LPS (i.c., GAIRAT) reveals improvement for the PGD- 100 attack [29], its performance is well below AT regarding the CW attack [9].
Decision Boundary
Adversarial Variant
PGD Step
LPST
M
1 # PGD Step
Natural Example
Figure 2: LPS and the proposed PM in comparison. The PGD method takes 6 step to find instance to violate the decision boundary (i.e., LPS equals 6), while PM is contin- uous to represent this distance.
In this paper, we propose the probabilistic margin (PM), which for reweighting adversarial
continuous and data during AT. PM is geometric measurement from data point to the closest decision boundary, following the malti-class margin [23] in traditional geometry-aware machine learning. Note that, instead of choosing the input space as LPS, PM is defined by the estimated class class-posterior probabilities from the model outputs, c.g., such the
2

---

probability of the true label minus the probability of the most confusing label given some natural data. Therefore, PM computed in a diw-dmensional embedding space with normalization, alleviating the troubles in comparing data from different classes.
The definition of PM is general, where we consider three specifications, namely, PM PMidy and PMdif. Concretely, PM and PM are the PM scores regarding natural and adversarial data, respectively. They assume that the vulnerability of data is revealed by the closeness regarding either the natural data or the adversarial variants. However, the definition of PM is slightly different, which is the distance of natural data point to its adversarial variant. py is viewed as a conceptual counterpart of LPS, but is critically different since it is continuous and path-independent. In our paper, we verified the effectiveness of PM and PM and showed that they can represent the geometric properties of data well. Note that, though these types of PMs depict different geometric properties, they all share a negative correlation with the vulnerability of data larger/s//rr PMs indicate that the corresponding data are safer/riskier and thus should be assigned with smallen/larger weights.
Eventually, PM is employed for reweighting adversarial data during AT, where we propose the Margin- Aware Instance reweighting Learning (MAIL). With a non-increased weight assignment function in Eq. (8), MAIL pays much attention to those non-robust data. In experiments, MAIL was combined with various forms of commonly-used AT methods, including traditional AT [29], MART [40], and TRADES [45]. We demonstrated that PM is more reliable than previous works in geometric measurement, irrelevant to the forms of the adopted objectives. Moreover, in comparison with advanced methods, MAIL revealed its state-of sate-of-theeart performance against various attack methods, which benefits from our path-independent and continuous measurement.
2 Preliminary
2.1
Traditional Adversarial Training
For K-classification problem, consider training dataset S [xx, 81) independently drawn from a distribution DD and a deep neural network h(z;0) 0) parameterized by 0. This deep classifier ha:; 9) predicts the label of an input data via h(2; = arg max; Pa 0), with p& () being the predicted probability (softmax on logits) for the k-th class.
The goal of AT is to train model with low adversarial risk regarding the distribution D, i.e., R0) = E(r,y)> [maxses f(x + 6, y; 0)), where A is the threat model, defined by an Ly-norm bounded perturbation with the radius e: A = {& E Rd ||0|pp S S... Therein, AT computes the new perturbation to update the model parameters, where the PGD method [29] is commonly adopted: for a (natural) example Tú, it starts with random noise & and repeatedly computes
+ Proj ((1--1) + asign (Vol(z + +5 5((-1) .o."),;;))) ())
(1)
with Proj the clipping operation such that 8(t) is always in A and sign the signum function. Due to the non-convexity, we typically approximate the optimal solution by 5!T) with T being the maximally allowed iterations. Accordingly, 8!TT) is viewed as the perturbation for the most adversarial example [47], and the learning objective function is formulated by
arg min Σ f(x; + (T)) O):
Intuitively, AT corresponds to the worst-case robust optimization, continuously augmenting the training dataset with adversarial variants that highly confuse the current model. Therefore, it is practical learning framework to alleviate the impact of adversarial attacks. Unfortunately, it leads to insufficient network capacity, resulting in unsatisfactory model performance regarding adversarial robustness. The reason is that, AT has an overwhelming smoothing effect in fitting highly adversarial examples [45], and thus consumes large model capacity to learn from some individual data points.
2.2 Geometry-Aware Adversarial Training
Zhang al. [47] claimed that training examples should have unequal significance AT, and proposed the geometry-aware instance-reweiggtted adversarial training (GAIRAT). It is general framework
3

---

to reweight adversarial data during training, where Eq. (2) is modified as
arg min #
Σ aal + T ye 9) s.t. Wi 2 0 and Σw -w==1. =1
(3)
Note that, the constraints are required since the risk after weighting is consistent with the original one without weighting. Further, the generation of perturbation still follows Eq. (1). They revealed that data near decision boundary are much vulnerable to be attacked and require large weights.
LPS geometric measurement. In assigning weights, GAIRAT needs proper measurement for the distance to the decision boundaries. They suggested the estimation in high-dimensional input space via L.S (Fig. 2), which is the least PGD iterations for a perturbation that leads wrong prediction. Intuitively, a small LPS indicates that the data point can quickly cross the decision boundary and thus close it.
The drawbacks of LPS. Although promising results have been verified in experiments, LPS is path-dependent and limited by a few discrete values, where the consequence non non-negligible. In Figure (a), we showed that the PGD method will get stuck. Therefore, using LPS as geometric measurement, we might identify non-robust examples as robust ones. Here, we modified the vanilla PGD method with the line-searched learning rate [43] and Nesterov momentum [31] (see Appendix A), termed Line-search & Momentum-PGG that of LM-PGD on one example. The maximal iterations of PGD was 50. As can see, PGD almost converged at the 14-th step, and the loss value did not ascend anymore. As a result, LPS of this example was 50, and this example was taken
(LM-PGD), and we compared the loss curve of PGD with
robust one in the view of LPS. However, LM-PGD still ascended after the 14-th step and successfully attacked the instance at the 15-th step. This result means that such instance is not a robust one, but LPS made a wrong judgment in its robustness. The main reason is that, LPS is heavily dependent on attack paths, even though both paths are highly similar.
Now, we demonstrate that the limited range of LPS would cause problems as well. Figure 1b, we show the histogram of LPSs for data CIFAR-10 [24]. Higher LPS values mean that these examples were more robust and required smaller weights during AT. could be seen that LPS has a confusing meaning when it equaled the maximal value, which is 10 following [29]. For data whose LPSs were 10, they would be the most robust/safe ones. However, it could be seen that they still contained the critical data points (the blue part). Although the proportion of the critical data seems low, ignoring them during AT (i.c., assigning small weights for them) will cause problems. For example, the trained classifier's 's accuracy will drop significantly when facing the CW attack [9] (Figure Ic).
3 Probabilistic Margins for Instance Reweighting
The drawbacks of LPS motivate us to improve the measurement in discerning robust data and risky data, and we introduce our proposal in this section.
3.1 Geometry Information in view of Probabilistic Margin
Instead of using the input space as LPS, we suggest the measurement estimated probabilities, which are normalized embedding features (softmax on logits) in the range (0, 1] for each dimension. Note that, without normalization, average distances from different classes might be of diverse scales (c.g., the average distance is 10 for the i-th class and 100 for the j-th class), increasing the challenge in comparing data from different classes (see Appendix B).
Inspired by the multi-class margin in margin theory [23], we propose the probabilistic margin (PM) regarding model outputs, namely. PM(x, 0) = (x; 0) max P5 0),
(4)
J.
where the first term in the r.h.s. is the closeness of x to the "center" of the true label y and the second term is the closeness to the nearest class except y (i.e., the most confusing label). The difference between the two terms clearly a valid measurement, where the magnitude reflects the distance from the nearest boundary, and the signum indicates which side the data point belongs to. Figure 3

---

PM+0.2: close to class
For from bountaryy
0.75
0,4
0.50
PM-0: the boundary
center of class
center of class
Pi 0.5.
0.5
PM
0.00
Decision Boundary
-0.25
P.-0.4
fort from mommtouuudann
wooigg prsdittion
0.6
-0.75
-1.00
PM class
the least PGD steps
Figure 3: An illustration of PM, where ps is the probability that a data point belongs to the i-th class. As special example, here we assume PM Pi P/ with the target y and j the nearest class except y.
Figure Comparison of LPS and PM (PM"") An interquartile range box represents the middle 50% of the considered data with the inside line being the median; whisker is the range for the bottom/top 5% data, and points above/below whiskers are outliers.
summarizes the key concepts, with for the true label y and for the most confusing class. For example, when Py (2 0) = Py (ar; 0) 0.5, PM is and the data point x on the decision boundary between two classes; when (2; () 0.6 and p (2; 0) 0.4. PM is positive and the data point much closer to the true label; Py 0) 0.4 and рy (z; 0.6, PM is negative and the data point is much closer to the most confusing class.
The above discussion indicates that PM can point out which geometric area data point belongs to, where we discuss the following three scenarios: the safe area with large positive PMs, the class- boundary-arounl data with positive PMs close 0, and the wrong-pree noog-prediction area with negative PMs. The safe area contains guarded data that are insensitive to perturbation, which are safe and require low attention AT (i.e., small weights); for the coeisssbuuddry--rooune data, they are much vuinerable to be attacked [45, 47] and thus need larger weights than the safe data; for data in the wrong-prees gong-prediction area, they are the most critical since the attack method can successfully fool the current model, and thus they should be assigned the largest weights. For data point, this indicates negative correlation of its PM with the vulnerability, where a larger PM indicates a smaller weight is required for this data point. In realization, the measurement of PM can be employed for adversarial data or natural ones, which are of the forms:
PM
Pvs (I; o8 (0700 max Py (x: (T));
PMC = Ps. (r;;0)
max P (.;;; 0),
(6)
JJFy.
for data point respectively. They assume that the vulnerability of data is revealed by the closeness regarding either the natural data their adversarial variants. Besides these basic cases, can also consider the difference between the natural and adversarial predictions, namely,
PM Pv. (Ix 0) Ps. (z, + ((4) +,(0);
where 4; < T denotes LPS of æ4. Pydif is conceptual counterpart of LPS, while Eq. (7) is actually path-independent and continuous, which is more reliable than LPS. Note that, the valid range of PMdil (i.e., 00, 1)) is different from that of PM and PM (i.c., |-1, 1]), which may bring unnecessary troubles since the geometric meanings of PM and pydií are highly similar. Therefore, our experiments, mainly verify the effectiveness of PM and PM
Without direct involvement of the PGD method, PM is continuous and path- aath-independent, making more reliable than LPS. In Figure 4, we depicted the box plot regarding PM for training data with various LPSs. The instability of LPS evident: from the box centers, there a little differentiation for data with large LPSs (e.g., LPS 7 9) regarding PM; from the whiskers and outliers, the spreads of PMs are relatively scattered and the numbers of outliers are significant, confirming that the geometric messages characterized by LPS may not be very stable.
5

---

Algorithm MAIL:
The Overall Algorithm.
Input: network model with the parameters 0 and training dataset S of size
Output: a robust model with parameters 8".
I: for to num_ num_epoch do
2: for b = 1 to num ham_batch do
3:
sample mini-batch {(ri, y: J= from S; for i to batch_sizze do
mini-batch of size m.
4:
5!0) E. with & ~ (),
5:
6:
for to do
). Proj (((=1) + asign (Vollx; o6t 31: .n:0 "
7:
8:
end for w.a si siimoidd(--i) (-roid - -3));
9:
10:
end for
11:
w/ = M with E, ")m, Vi E [m]
b w., = during burn-in period.
12:
A f 0 Vo Ei W + 8, vs: 0) + R(x;,y:)));
end for
14: end for
3.2 Margin-Aware Instance Reweighting Learning (MAIL)
To benchmark our proposal against state-of-the-ar counterparts, we propose the margin-aware in- stance reweighting learning (MAIL). The overall algorithm is summarized Algorithm Generally, the objective is Σ, w,f((x + 5(T) . f) + Rx,, ys; 0), where R is an optional regularization term. This objective implies the optimization for the model, with one step (Step 5-8) generating the ad- versarial variants, one step (Step 9-11) calculating the importance weights, and one step (Step 12) minimizing the reweighted loss w.r.t. the model parameters.
Weight Assignment: We adopt the sigmoid function for weight assignment, which can viewed as softened sample selection operation of the form:
w. sigmoid(->(PM: B)),
where 3 indicates how many data should have relatively large weights and 2 0 controls the smoothness around 3. Note that, PM; denotes the PM score for the i-th data point, which could be any one of Pagdy, PM and PMÇlf. Eq. (8) is monotonic function that assigns large values for data with small PMs, paying attention to critical data as discussed in Section 2.2. Moreover, it should be further normalized by w; N w!!n /E; wit meet the constraint in Eq. (3).
During the initial training phase, the geometric information is less informative since the deep model is not adequately learned. Directly using the computed weights may mislead the training procedure and accumulate the bias in erroneous weight assignment. Therefore, we introduce fixed to regardless of the corresponding PM value. similar strategy has also been considered in Zhang et al. [47].
Burn-in Period:
a burn-in period at the beginning, where
Two Realizations:
The proposed MAIL is general for reweighting adversarial data, which can be combined with existing works. Here we give two representative examples: the first one is based on the vanilla AT [40], with the learning objective of the form (termed MAIL-AT):
Σ wi log Ps, (x: + + ;))
The second one based on TRADES [45], which adopts the Kullback-Leibler (KL) divergence regarding natural and adversarial prediction, and also requires the learning guarantee (taken as a regularization term here) on the natural prediction. Overall, the learning objective is (termed MAIL-TRADES)
B Σ WiL + :000p)p((2;00) - Σ log Pv. (z;;)),
(10)
where 8 > is the trade-off parameter and kL(pllg) En pk log ps/qx denotes the KL divergence.

---

Table I: Comparison of LPS and PM on CIFAR-10 dataset.
AT [29]
MART [40]
TRADES [45]
LPS
PM
PMadv
LPS
PM
PM
LPS
PMms
PMad
82.26
82.50
83.15
84.45
83.75
84.12
78,52
82.71
80.49
NAT
1: 0.60
1 0.20
+ 0.46
1 0.17
+: 0.09
+: 0.46
+. 0.20
+. 0.52
+. 0.18
54.14
55.00
55,25
53.16
53.63
53.65
51.67
52.37
53.67
PGD
+
+ 0.32
+ 0.23
+ 0.26
+ 0.21
+ 0.23
+ 0.54
+ 0.65
t 0.14
36.32
44.25
44.10
46.00
46.70
47.20
44.40
49.52
50.60
AA
+ 0.57
+ 0.45
+ 0.21
0.26
+ 0.10
+ 0.21
0.20
0.11
+ 0.22
Our proposal flexible and general enough in combining with many other advanced methods. For example, we can modify MART [40], which could discern correct/wrong prediction, to further utilize their geometric properties (termed MAIL-MART). Its formulation is similar to that MAIL- TRADES with slightly different learning objective, which is provided in Appendix C.
4 Experiments
We conducted extensive experiments on various datasets, including SVHN [32]. CIFAR-10 [24], and CIFAR-100 100 [24]. The adopted backbone models are ResNet (ResNet-18) [21] and wide ResNet (WRN-32- [44]. In Section 4.2, we verified the effectiveness of PM as a geometric measurement.
In Section 4.3, we benchmarked our MAIL. against advanced methods. The source code of our paper
can be found in gitub.com//Qrhooaaagg....
4.1 Experimental Setup
Training Parameters. For the considered methods, networks were trained using mini-batch gradient descent with momentum 0.9, weight decay 3.5 x 10 (for ResNet-18) 7 x 10-4 (for WRN-32- 10), batch size 128, and initial learning rate 0.01 (for ResNet-18) 0.1 (for WRN-32-10) which is divided by 10 at the 75-th and 90-th epoch. To some extent, this setup can alleviate the impact of adversarial over-fitting [33, 40]. Moreover, following Madry et al. [29], the perturbation bound is 8/255 and the (maximal) number of PGD steps & is 10 with step size a 2/255.
Hyperparameters. The slope and bias parameters 2 and 0 in both MAIL-TRADD TRADES,ADES, and to 6 MAIL-MART (Algorithm in Appendix C). For the training procedure, the weights started to update when the learning rate drop at the first time following Zhang et al. [47], i.e. the initial 74 epochs burn-in period, and then we employed the reweighted objective functions.
10 and -0.5 in MAIL-AT and to and MAIL-MART. The trade-off parameter 3 was set to 5 in
Robustness Evaluation. We evaluated our methods and baselines using the standard accuracy on natural test data (NAT) and the adversarial robustness based several attack methods, including the PGD method with 100 iterations [29], CW attack [8], APGD CE attack (APGD) [13], and auto attack (AA) [13]. All these methods have full access to the model parameters (i.e., white-box attacks) and are constrained by the same perturbation limit as above. Note that, here we do not focus on the
black-box attack methods [4, 12, 26, 27, 48], which relatively easy to be defensed [11].
4.2 Effectiveness of Probabilistic Margin
In this section, we verified the effectiveness of PM as a measurement comparison with LPS. Here, we adopted ResNet-18 as the backbone model and conducted experiments CIFAR-10 dataset.
Three basic methods were considered, including AT [29], MART [40], and TRADES [45], which were further assigned weights given by either PM or LPS [47]. For LPS, we adopted the assignment
function in GAIRAT with the suggested setup [47]. We remind that AT-LPS, MART-LPS, and TRADES-LPS represent GAIRAT, GAIR-MART, and GAIR-TRADES in [47]; and AT-PM, MART. PM, and TRADES-P represent MAIL-AT, MAIL-MART, and MAIL-TRADES. respectively. Note that, validated two types of PM, namely, Py and PMnat, which are very different from LPS.

---

Table 2: Average accuracy (%) and standard deviation on CIFAR-10 dataset with ResNet- 18.
NAT
PGD
APGD
CW
AA
84.86
48.91
47.70
51.61
44.90 + 0.53
AT [29]
+ 0.17
+ 0.14
0.06
+ 0.15
84.00
52.66
52.37
52.30
48. 10
TRADES [45]
+: 0.23
+: 0.16
0.24
0.06
1 0.26
82.28
53.50
52.73
51.59
48.40
MART [40]
+ 0.14
+ 0.46
= 0.57
0.16
+ 0.14
87.97
46.78
46.68
49.92
43.90
FAT [46]
+ 0.15
0.122
+ 0.16
+ 0.26
+ 0.82
85.17
52.63
50.40
51.39
47.00
AWP [42]
+ 0.40
0.17
0.26
0.18
0.25
83.22
54.81
50.95
39.86
33.35
GAIRAT [47]
+ 0.06
1..15
+ 0.49
0.08
0.57
84.52
55.25
53.20
48.88
44.22
MAIL-AT
+ 0.46
0.23
= 0.38
0.11
0.21
81.84
53.68
52.92
52.89
50.60
MAIL-TRADES
+ 0.18
0.14
+ 0.62
0.22
The experimental results with individual trials are summarized Table where we adopted three evaluations, including natural performance (NAT), the PGD method with 100 steps (PGD), and auto attack (AA). can be viewed as an ensemble several advanced attacks and thus reliably reflect the robustness. As we can see, the superiority of PM is apparent, regardless of the adopted learning objectives: the results of PM are 0.70-7.93% better than LPS regarding AA and 0. 0.14-2.00% better regarding PGD. Although LPS could achieve comparable results regarding PGD attacks, its adversarial robustness is quite low when facing AA attacks. indicates that the robustness improvement of GAIRAT might be partially. This is probably caused by obfuscated gradients [2], since stronger attack methods (e.g., AA) lead to poorer performance on adversarial robustness.
Comparing the results in using PM and PM both PMs can lead to promising robustness, while PMay is slightly better. The reason that PMadv can precisely describe the distance between adversarial variants and decision boundaries. As a result, it can help accurately assign high wights for those important instances during AT. Therefore, we adopt PM in the following experiments.
4.3 Performance Evaluation
We also benchmarked proposal against advanced methods. Here, we reported the results on the CIFAR-10 10 dataset due to the space limitation. Please refer to Appendix B for more results.
Compared Baselines. We compared the proposed method with the following baselines: (1) (tradi- tional) AT [29]: the cross-entropy loss for adversarial perturbation generated by the PGD method; (2) TRADES [45]: learning objective with explicit trade-off between the adversarial and natural
performance; (3) MART [40]: training strategy which treats wrongly/correetly predicted data sepa- rately: (4) FAT [46]: adversarial training with early-stopping in adversarial intensity: (5) AWP [42]:
a double perturbation mechanism that can flatten the loss landscape by weight perturbation; (6) GAIRAT [47]: gcometric-aware restance-reweighted adversarial training.
All the methods were for 5 individual trials with different random seeds, where reported their average accuracy and standard deviation. The results are summarized in Table 2 and Table 3 with the backbone models being ResNet-18 and WRN-32-10. respectively. Overall, our MAIL achieved the best or the second-Be best robustness against all four types of attacks, revealing the superiority of MAIL (i.e., MAIL-AT and MAIL-TRADES) in adversarial robustness. Specifically, AT and TRADES both treat training data equally, and thus their results were unsatisfactory compared with the best one (0.55% 6.34% decline with ResNet- and 0.02% -9.4% decline with WRN-32-100 implying the possibility for its further improvement. Though MART and FAT consider the impact

---

Table 3: Average accuracy (%) and standard deviation on CIFAR- 10 dataset with WRN-32-10.
NAT
PGD
APGD
CW
AA
87.80
49.43
49.12 + 0.26
53.38
48.46
AT
0.13
0.29
= 0.05
+ 0,46
86,36
54.88
55.02
56.18
53.40
TRADES
0.52
1 0.39
+: 0.27
+ 0.16
+: 0.37
84.76
55.61
55.40
54.72
51.40
MART
0.34
0.51
+ 0.37
= 0.20
0.05
89.70
48.79
48.72
52.39
47.48
FAT
0.17
+ 0.188
+ 0.36
0.89
0.30
57.55
54.17
54.20
55.18
53.08
AWP
0.23
+ 0.10
+ 0.16
0.30
0.17
86.30
58.74
55.64
45.57
40.30
GAIRAT
0.61
+ 0.46
+ 0.36
0.18
0.16
84.83
58.86
55.82
51.26
47.10
MAIL-AT
0.39
+ 0.25
+ 0.31
0.20
0.22
84.00
57.40
56.96
56.20
53.90
MAIL-TRADES
0.15
+ 0.96
+ 0.19
0.30
+ 0.22
of individuals on the final performance, they fail in paying attention to geometric properties of data during training. Concretely, MART mainly focuses the correctness regarding natural prediction, and FAT prevents the model learning from highly non-robust data in keeping its natural performance. Therefore, FAT achieved the best natural performance (3. 18.11% 6. 131% improvement with ResNet- 18 and 1.90% 5.70% improvement with WRN-32-10), while its robustness against adversaries seems inadequate (2.97% 8.45% decline with ResNet-18 and 3.81 %- 10.0%% decline with WRN-32-10), Moreover, in adopting LPS as the geometric measurement, GAIRAT performed well regarding PGD) and AGPD attacks, while the adversarial robustness on CW and AA attacks comparison, we retained the supremacy on PGD-based attacks (i.e., PGD and APGD) as in GAIRAT and revealed promising results regarding CW and AA attacks. For example, Table 0.44%-8.477 improvements on PGD attack, 0.47%-6.5224 on APGD attack, 0.59% 13.03% on CW attack, and (63%-16.68%9 on AA attack.
pretty low. In
achieved
MAIL-AT performed well on PGD-based methods, while MAIL-TRADES was good at CW and AA attacks. suggests that the robustness depends adopted learning objectives, coinciding with the previous conclusion [40]. In general, we suggest using MAIL-TRAI as a default choice, as reveals promising results regarding AA while keeping relatively high performance regarding PGD-based attacks. Besides, comparing the results in Table and Table 3, the overall accuracy had promising improvement in employing models with much large capacity (i.e., WRN-32-10), verifying the fact that deep models have insufficient network capacity in fitting adversaries [47].
5 Conclusion
In this paper, focus boosting adversarial robustness by reweighting adversarial data during training, where data closer to the current decision boundaries are more critical and thus require larger weights. To measure the closeness, relates to the multi-class margin in the probability space of model outputs (i.c., the estimated class- posterior probabilities). Without any involvement of the PGD iterations, PM is continuous and path-independent and thus overcomes the drawbacks of previous works (e.g., LPS) efficaciously. Moreover, we consider several types of PMs with different geometric properties, and propose general framework termed MAIL. Experiments demonstrated that PMs are more reliable measurements than previous works, and our MAIL revealed its superiority against state-of-the-an methods, independent of adopted (basic) learning objectives. In the future, we will delve deep into the mechanism in ristance-reweighhee adversarial learning, theoretically study the contribution individuals for the final performance, and improve the methodology in using geometric characteristies of data.
suggest the use of probabilistic margin (PM), which

---

Acknowledgments and Disclosure of Funding
QZW and BH were supported by the RGC Early Career Scheme No. 22200720, NSFC Young Scien- tists Fund No. 62006202 and HKBU CSD Departmental Incentive Grant. TLL was partially supported by Australian Research Council Projects DP- DP-180103424 and MS were supported by JST AIP Acceleration Research Grant Number JPMJCR20U3, Japan, and MS was also supported by Institute for Al and Beyond, UTokyo.
1901000,,,,,, and IC- IC-190100031. GN
References
[]] M. Andriushchenko and N. Flammarion. Understanding and improving fast adversarial training. In NeurlPS, 2020.
[2] A. Athalye, N. Carlini, and D. A. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
[3] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok. Synthesizing robust adversarial examples, In ICML, 2018.
[4] Y. Bai, Y. Zeng, Y. Jiang. Y. Wang, S. Xia, and W. Guo. Improving query efficiency of black-box adversarial attack. In ECCV, 2020.
[5] M. Balunovic and M. Vechev, Adversarial training and provable defenses: Bridging the gap. In ICLR, 2019.
[6] A. N. Bhagoji. W. He, B. Li, and Song. Practical black-box attacks on deep neural networks using efficient query mechanisms. In ECCV, 2018.
[7] S. Bubeck, Y. T. Lee, E. Price, and I. P. Razenshteyn. Adversarial examples from computational constraints. In ICML, 2019.
[8] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.00 962000000,6, 2019.
[9] N. Carlini and D. A. Wagner. Towards evaluating the robustness of neural networks. In Proceedings of the 2017 IEEE Symposium Security and Privacy, 2017.
[10] Y. Carmon, Raghunathan, L. Schmidt, P. Liang, and C. Duchi. Unlabeled data improves adversarial robustness. In NeurlPS, 2019.
[11] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay. A survey adversarial attacks and defences. CAAI Transactions on Intelligence Technology, 6:25-45, 2021.
[12] M. Cheng, T. Le, P. Chen, H. Zhang, J. Yi, and C. Hsieh. Query-efficient hard-label black-box attack: An optimization-bant approach. In ICLR, 2019.
[13] Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In /CML, 2020.
[14] D. Cullina, A. N. Bhagoji, and P. Mittal. Pac-learning in the presence of evasion adversaries. In NewrlPS, 2018.
[15] J. Dong, Y. Cong, G. Sun, and D. Hou. temseaic weakly-supervised endoscopic lesions segmentation. In ICCV, 2019.
[16] J. Dong, Y. Cong, G. Sun, B. Zhong, and X. Xu. What can be transferred: Unsupervised domain adaptation for endoscopic lesions segmentation. CVPR, 2020.
[17] X. Du, J. Zhang, B. Han, T. Liu, Y. Rong, G. Niu, J. Huang, and M. Sugiyama. Learning diverse-structured networks for adversarial robustness. In ICML, 2021.
[18] A. Fawzi, S. Moosavi-Dezfooli, Frossard, and Soatto. Empirical study of the topology and geometry of deep networks. In CVPR, 2018.
10

---

[19] S. G. Finlayson, J. D. Bowers. J. Ito, J. L. Zittrain, A. L. Beam, and I. S. Kohane. Adversarial attacks on medical machine learning. Science, 363(64333;1287-12288 2019.
[20] R. Gao, F. Liu, J. Zhang, B. Han, T. Liu, G. Niu, and M. Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. In ICML, 2021.
[21] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In CVPR, 2016.
[22] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry. Adversarial examples not bugs, they are features. In NeurlPS, 2019.
[23] V. Koltchinskii and D. Panchenko. Empirical margin distributions and bounding the generaliza- tion error of combined classifiers. Annals of Statistics, 30(1):1-50, 2002.
[24] A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, Toronto, 2009,
[25] A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial examples in the physical world. In ICLR, 2017.
[26] Li. Ji, H. Liu, J. Liu, B. Zhong, C. Deng, and Q Tian, Projection probability-drivenn black-bo box attack. In CVPR, 2020.
[27] Y. Li, L. Li, L. Wang, T. Zhang, and B. Gong. NATTACK: learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In ICML, 2019.
[28] G. Litjens, T. Kooi, B. E. Bejnordi, A. A. A. Setio, F. Ciompi, M. Ghafoorian, J. A. Van Der Laak, B. Van Ginneken, and Sánchez. survey on deep learning in medical image analysis. Medical Image Analysis, 42:60-88, 2017.
[29] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[30] S.-M. Moosavi-Dezfoolii A. Fawzi, J. Uesato, and P. Frossard. Robustness via curvature regularization, and vice versa. CVPR, 2019.
[31] Y. Nesterov. A method for solving the convex programming problem with convergence rate 0(1/k2), Proceedings of the USSR Academy of Sciences, 269:543-547, 1983.
[32] Y. Netzer, T. Wang. A. Coates, A. Bissacco, B. Wu, and A. Y. Ng. Reading digits in natural images with unsupervised feature learning. In NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
[33] T. Pang, X. Yang. Dong, H. Su, and J. Zhu. Bag of tricks for adversarial training. In ICLR. 2021.
[34] N. Papernot, P. McDaniel, A. Sinha, and M. Wellman. Towards the science of security and privacy in machine learning. In Proceedings of 3rd IEEE European Symposium on Security and Privacy, 2018
[35] Y. Qin, N. Carlini, G. W. Cottrell, J. Goodfellow, and C. Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In ICML, 2019.
[36] I. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry. Adversarially robust generaliza- tion requires more data. In NeurlPS, 2018.
[37] C. Szegedy, W. Zaremba, I. Sutskever, Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[38] D. Tsipras, S. Santurkar, I.. Engstrom, A. Turner, and A. Madry. Robustness may at odds with accuracy. In ICLR, 2019.
11

---

[39] H. Wang, T. Chen, S. Gui. T.-K. Hu, J. Liu, and Z. Wang. Once-for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. In NeurIPS, 2020.
[40] Y. Wang, D. Zou, Yi, J. Bailey, X. Ma, and Q. Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020.
[41] E. Wong, L. Rice, and J. Z. Kolter. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
[42] D. Wu, S.-T. Xia, and Y. Wang. Adversarial weight perturbation helps robust generalization. In NeurIPS, 2020.
[43] X. Yu, Chen, and S. Cheng. Dynamic learning rate optimization of the backpropagation algorithm. IEEE Transactions on Neural Networks, 6(3):669 677, 1995.
[44] S. Zagoruyko and N. Komodakis. Wide residual networks. In BMVC, 2016.
[45] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, and M. I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.
[46] J. Zhang, X. Xu, B. Han, G. Niu, L. Cui, M. Sugiyama, and M. S. Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In ICMI., 2020.
[47] Zhang. J. Zhu, G. Niu, B. Han, M. Sugiyama, and M. Kankanhalli. Geometry- aware instance- reweighted adversarial training. In ICLR, 2021.
[48] Y. Zhang, Y. Li, T. Liu, and X. Tian. Dual-path distillation: A unified framework to improve black-box attacks. In ICML, 2020.
[49] D. Zhou, T. Liu, B. Han, N. Wang, C. Peng, and X. Gao. Towards defending against adversarial examples via attack-invariee innariintt features. In /CML, 2021.
12


Reviews:
[{"review_id": "tCb2qcFU8-", "reviewer": "Reviewer_SNCE", "summary": "This paper focuses on reweighting adversarial data in adversarial training problems. Actually, how to determine the sensible weights for each adversarial example matters for the adversarial robustness of the trained model. In this way, this paper proposes a new measurement called probabilistic margin, and employs it into multiple baseline methods. The achieved results seem promising. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "By arguing that the current measurement of \"closeness to boundary\" is discrete and path-dependent, this paper borrows the tool in margin theory called probabilistic margin (PM) as a more accurate proxy. Then the PM is utilized in multiple baseline methods and achieves better performance. \n\nHowever, the utilization of PM seems sort of plain to me. Using PM seems a natural option for various proxies of measurement of \"closeness to boundary\". More theoretical insights are needed. \n\nAuthors should make further investigations of the formulation of weight assignment. Why do we choose sigmoid in Eq8? \n\nInstructions of empirical choice of PM_adv, PM_nat, PM_diff are still not clear. What can we draw from the analysis?\n\n-----------------------------------------------------\n\nThanks for the kind response. After the rebuttal, my concerns are well-addressed. Thus I am happy to raise my score.\n\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "1"}, "extra_text": {}}, {"review_id": "Y6e_2YhvCrY", "reviewer": "Reviewer_bxMc", "summary": "Reweighting adversarial data has been recently shown to be effective, with larger weights assigned for data closer to the boundaries. Previous work used the LPS to measure the closeness, but the authors suggested that the LPS might not be reliable since they are discrete and path-dependent. To this end, this paper proposed three types of probabilistic margin, which could overcome the drawbacks of the LPS. The probabilistic margins were used to measure the importance of adversarial data, which induced convincing results in experiments.", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Instance-reweighted adversarial training assigns unequal importance for adversarial examples, where data close to decision boundaries are vulnerable to be attacked and should be given with large weights. However, the authors stated that the existing methods measuring the closeness (i.e., LPS) are unreliable and experimentally verified their consequence is non-negligible. In my opinion, it might partially explain why GAIRAT cannot work well regarding advanced attack methods such as CW. \n\nThis paper proposed the probabilistic margin, which is the multi-class margin measured by the model outputs. The margin is a natural measurement of the closeness in SVM, and it is computed in an embedding space with normalization for the sake of the same scale. The modification is well-motivated and partly overcomes the drawbacks in GAIRAT. \n\nBased on the probabilistic margin, this paper proposed a general framework for instance reweighing learning. MAIL could boost the performance of previous methods (e.g., MART) and can adopt different kinds of probabilistic margins in weighting. \n\nThe authors conducted extensive experiments on various datasets and with different probabilistic margins. MAIL not only outperformed the GAIRAT by a large margin for many attacks (e.g., AA) but also achieved comparable results against many state-of-the-art methods (e.g., MART). ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "1.\tThe drawbacks of LPS stem from the use of the PGD method, but it seems that the proposed LM-PGD can alleviate some of these drawbacks. Therefore, I think LM-PGD would help calculate the LPS, and it would be great if the authors could clarify, i.e., why is the PM better than the LM-PGD?\n2.\tComputing the margin in the probabilistic space of the model outputs may look convincing. However, I am curious about the results without normalization, i.e., if the proposal only adopted the embedding features (without softmax as normalization) for weight assignment, how much will the model's performance degrade?\n3.\tAnother little question, I think the authors could describe why the constraint of the sum is required in Eq. 3.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "36"}, "extra_text": {}}, {"review_id": "XCR0Lk3nAIM", "reviewer": "Reviewer_k79K", "summary": "This paper propose  three types of probabilistic margin (PM) to improve the model robustness. The proposed method can measure the aforementioned closeness and reweight adversarial data. \nAnd some experiments were conducted to validate the effectiveness of the proposed method.  ", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": " This paper have following problems:\n\n1.  the paper lacks comparative experiments with the state-of-the-art methods [1]\n \n2.  The robustness improvement is very small. The proposed MAIL-AT achieves lower AA attack accuracy compared with AT [26] in table 2 (44.10% VS 44.90%) .\nand MAIL-TRADES only achieves a little higher AA attack accuracy compared with TRADES in Table 3 ( 53.90% VS 53.40%).\n\n3.  The certain baseline of FAT seem to deviate from values reported in prior works [2].\n\n4. The novelty of work is limited. This paper seem to  use multi-class margin in margin theory [20] to conduct adversarial training. \n\nTherefore, I think this work is not qualified enough for NIPS.\n\n[1] Adversarial Weight Perturbation Helps Robust Generalization, (NeurIPS 2020)\n[2] Bag of Tricks for Adversarial Training, Pang et al, (ICLR 2021)\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"ethical_concerns": "No", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "30 hours "}, "extra_text": {}}, {"review_id": "TPyePKCNyXm", "reviewer": "Reviewer_6oSF", "summary": "DNNs are susceptible to adversarial attacks, and AT is an efficacious method in combating this challenging issue. In general, AT creates adversarial examples on the fly, and the DNN is trained to overcome their impacts. \n\nThe paper mainly focuses on the drawbacks of the reweighted AT training. First, the authors state empirically that the LPSs used in previous works are discrete and path-dependent, unreliable for weight estimation. They then propose a novel metric (PM) that overcomes the drawbacks in LPSs and devise three specifications that capture different geometric properties of the data. Next, a weighting strategy uses PMs to develop a new kind of reweighted AT method called margin-aware instance reweighting learning (MAIL).\n", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Originality:\nAlthough the reweighted AT training has been explored in recent studies, the paper claims the drawbacks of their PGD-based metrics in weight assignment. Accordingly, the authors propose three types of PMs, which can be viewed as the multi-class margin in the probabilistic space of model output. There are some novelties as they address the drawbacks in previous works, and the experimental results look pretty convincing to me. \n\n### Quality:\nThe paper is motivated by the drawbacks of previous works, and the detailed realizations look technically sound. The experiments are shown on a host of datasets, which are well executed, reproducible, and competitive against state-of-the-arts. \n\n### Clarity:\nThe paper is well structured and clearly written. They provide the realization details and the adopted hyper-parameters in a clear way.\n\n### Significance:\nThey concentrate on the weighted AT training, which is a promising methodology that attracts increasing attention recently. The paper discusses the drawbacks of the PGD-based metrics used in previous works, which would make the training procedure unstable and inaccurate. Further, the proposed solution is relatively new and seems like an acceptable improvement over the previous works. \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The proposed AT method maybe not general to all attacking methods. The main reason is that there is only one attack method used for training. I would be happy to see training the network using other attack methods.\n\nIt seems that the GAIRAT, an advanced AT with weighting, does not perform well for the AA attacks in Table 1 and 2. I am curious to know the reason for its inferior results. \n", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper studied the reweighting strategy in adversarial training and got 8776 scores. Before rebuttal, only one reviewer had some concerns on the experiments, while the authors provided a successful rebuttal with additional experiments and addressed the reviewer's concerns. Thus, I recommend accepting the paper. 
Decision: Accept (Poster)