Title: Bilevel Optimization for Adversarial Learning Problems: Sharpness, Generation, and Beyond
Venue: NeurIPS 2025
Accepted: yes
Keywords: Bilevel optimization

Sharpness-Aware Minimization

Generative Adversarial Learning

Accuracy-efficiency Trade-off
Abstract: Adversarial learning is a widely used paradigm in machine learning, often formulated as a min-max optimization problem where the inner maximization imposes adversarial constraints to guide the outer learner toward more robust solutions. This framework underlies methods such as Sharpness-Aware Minimization (SAM) and Generative Adversarial Networks (GANs). However, traditional gradient-based approaches to such problems often face challenges in balancing accuracy and efficiency due to second-order complexities. In this paper, we propose a bilevel optimization framework that reformulates these adversarial learning problems by leveraging the tractability of the lower-level problem. The bilevel framework introduces no additional complexity and 
enables the use of advanced bilevel tools. We further develop a provably convergent single-loop stochastic algorithm that effectively balances learning accuracy and computational cost.
 Extensive experiments show that our method improves generation quality in terms of FID and JS scores for GANs, and consistently achieves higher accuracy for SAM under label noise and across various backbones, while promoting flatter loss landscapes. 
Overall, this work provides a practical and theoretically grounded framework for solving adversarial learning tasks through bilevel optimization.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a unified bilevel optimization framework designed to improve computational efficiency and learning accuracy in adversarial learning tasks, particularly addressing Sharpness-Aware Minimization (SAM) and generative adversarial tasks. Extensive experiments demonstrate its effectiveness in improving FID and JS scores, achieving higher accuracy under label noise, and providing a more interpretable solution with flatter loss landscapes, making it a promising approach for adversarial learning.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The research addresses a significant and timely problem in adversarial learning, aiming to balance computational efficiency and learning accuracy, which is crucial for practical applications.\n2. The proposed bilevel optimization framework is well-motivated and offers a theoretically sound solution that improves Sharpness-Aware Minimization (SAM) and generative adversarial learning tasks, demonstrating potential for real-world use.\n3. The method shows promising results, particularly in terms of improving FID and JS scores, as well as achieving higher accuracy under label noise and across different backbones, which is a noteworthy contribution to the field.\n\nWeaknesses:\n1. The methods proposed in the paper lack significant novelty, as the approach seems to build upon existing techniques in optimization without introducing fundamentally new ideas or mechanisms.\n2. The comparative experiments are limited and do not provide a broad enough evaluation against other state-of-the-art methods to firmly support the claims of superiority or generalizability of the approach.\n3. The paper does not include comparisons with the latest advancements in the field, which would be crucial to demonstrate the unique advantages and relevance of the proposed framework in relation to current research trends.\n\nQUESTIONS:\n1. How does the proposed bilevel optimization framework compare to more recent state-of-the-art methods in terms of both computational efficiency and learning accuracy? Could you include a broader range of comparisons to validate the effectiveness of your approach?\n2. While the experiments show improvements in FID and JS scores, could you provide more detailed analysis or ablation studies to demonstrate the specific impact of the bilevel optimization process on model performance?\n3. The paper mentions the method’s robustness under label noise, but how does it perform when faced with other types of adversarial conditions, such as domain shifts or noisy inputs in real-world scenarios?\n4. Can the framework be easily extended to other adversarial learning settings, or is it tailored specifically for SAM and generative adversarial tasks? How adaptable is it to other areas of machine learning? \n5. Since the approach appears to rely on existing optimization techniques, could you clarify what exactly differentiates it from prior works, and why it is expected to outperform them in terms of both theory and practice?\n\nLIMITATIONS:\nThe method of comparison is too outdated, and the method proposed in this article also lacks novelty.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors study bilevel optimization problems. They propose a single-loop stochastic algorithm for such problems and provide convergence guarantees when the inner problem is convex.  The core advantage of the proposed optimization algorithm is that it incurs no additional computational cost. The authors validate the effectiveness of their proposed method on two common bilevel optimization problems: GAN training and sharpness-aware problem.\n\nSTRENGTHS AND WEAKNESSES:\nPros:\n\n+ Bilevel optimization problems are of significant theoretical and practical importance.\n\n+ The proposed algorithm requires no extra computational cost.\n\n+ The authors provide a convergence proof and empirically demonstrate the proposed algorithm's performance.\n\nCons:\n\n- The proposed method only guarantees convergence when the inner problem is convex. However, many real-world problems, particularly those involving neural networks, are non-convex. Furthermore, the empirical validation has been limited to toy and simple datasets. Therefore, it remains unclear whether the proposed optimization algorithm can scale to more complex datasets.\n\n- The authors mention that discarding the second term in SAM (Eq. 7) sacrifices accuracy. It would be beneficial if the authors could quantify the impact of this term on SAM's performance.\n\n- Could the authors provide a more intuitive explanation for why their proposed optimization algorithm is effective? How should we understand Equation 15, and how does it overcome the limitations of SAM?\n\n- Several parts directly cite existing literature (e.g., Line 166, Line 202-203), which can be challenging for readers unfamiliar with the background. I suggest the authors incorporate more intuitive explanations or provide brief proof in appendix.\n\n- Are there any techniques that could transform the inner problem into a convex one (maybe reparameterization), potentially expanding the applicability of the proposed method? I recommend the authors discuss this.\n\n- The authors could further demonstrate the superiority of their proposed method by including experimental results on adversarial training.\n\nQUESTIONS:\nSee above.\n\nLIMITATIONS:\nyes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a bi-level optimization technique as an alternative to the usual min-max optimization algorithms. The authors study the convergence of the proposed algorithm and perform numerical experiments.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n\n- The problem is interesting and well motivated.\n- The paper has both theoretical convergence results, and numerical experiments.\n\n\nWeaknesses:\n\n- The paper claims that the proposed method is better than the existing ones, but this claim is not supported by the experiments. The experiments on GANs are only done on the usual mixture of 8 Gaussians on a ring. It is known that the vanilla GAN can learn this distribution perfectly given the right hyperparameters. Moreover, it is very surprising for a  WGAN to have such poor performance on this dataset. This makes it hard to trust the results of Figure 2, since it is very easy to train a WGAN to learn this distribution. In the appendix, it is stated that the GANs were trained on 500 datapoints, which is extremely low for this dataset and neural networks.\n\n- With this, it is not clear what improvements the proposed algorithm brings compared to existing min-max optimization techniques. \n\n- Also, the use of the FID score on synthetic 2d datasets is not really meaningful, since FID is by definition tied to image datasets.\n\n- I think the writing of Section 4 could be improved, it is a bit dense and hard to follow.\n\n- Minor: typo on line 61 in the word \"Learning\"\n\nQUESTIONS:\nCan we have more empirical evidence of the performance of the method? Also, how does the proposed method compare to, say, training a standard GAN in terms of computational cost?\n\nLIMITATIONS:\nThe results in the paper are limited in significance. The claims of extensive experiments and improvements over existing methods are not justified properly.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a bilevel reformulation of a broad class of non-convex min-max optimization problems by leveraging the Moreau envelope and efficient bilevel solvers. The goal is to transform unstable min-max problems into structured bilevel formulations that can be optimized more reliably. The authors argue that many min-max settings, such as those found in adversarial learning and sharpness-aware minimization (SAM) training, suffer from instability and convergence difficulties. Their proposed framework smooths the inner maximization, enabling the problem to be reformulated as two min-max problems, thereby facilitating faster optimization and providing theoretical convergence guarantees under appropriate conditions.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper is well-written and elegant in its mathematical presentation. It communicates complex optimization insights in an accessible and often tutorial style, which is valuable for readers looking to understand the deeper structure of bilevel optimization. In this sense, the paper is intellectually stimulating and has educational value. While some definitions and derivations (e.g, derivation of Table 1 or the definition of the Moreau envelope) could be made more explicit (or more directly linked to earlier assumptions, overall the exposition is smooth. The choice to apply the method to two different problems helps demonstrate the potential generality of the framework, even though, as discussed below, the scope of the experiments remains limited.\n\nThe main limitations I see relate to the scope of the experimental validation and the clarity of the practical motivation and applicability of the proposed framework.\n\nFirst, the empirical section on generative adversarial learning (Section 5.1) is limited to a two-dimensional toy example, despite being presented under the heading of \"Real-world applications\". A low-dimensional GAN example is not sufficient to demonstrate practical utility or scalability. Generative models, especially adversarial ones, typically operate in high-dimensional spaces (e.g., image generation), where both the generator and discriminator are deep networks with thousands or millions of parameters. It thus remains unclear whether the proposed bilevel reformulation can offer tangible advantages (computational or robustness-related) in these more practical settings. How does the approach scale? Is the inner problem still tractable when dealing with large-scale models and complex data distributions? Can the framework, in practice, compete with existing heuristics used in adversarial learning in terms of speed and quality of the results?\n\nSecond, while the goal of the paper is to reframe min-max problems as bilevel problems, it is not sufficiently clear **why** this is beneficial beyond the ability to apply specific solvers. The authors mention robustness benefits (e.g., line 84), but they do not demonstrate whether these benefits stem from the reformulation itself or the improved optimization dynamics afforded by better-behaved algorithms. Is the observed robustness in classification simply a result of smoother convergence, or is there a deeper benefit to recasting the problem as bilevel in structure beyond its theoretical framework? \n\nMoreover, the paper lacks a general guideline or procedure for reformulating generic min-max problems into bilevel ones. While the two case studies help illustrate the method, they do not offer a systematic view. Readers unfamiliar with the particular structure of the loss functions involved may struggle to apply this technique to other use cases. It would strengthen the work significantly to provide a more general prescription for when and how this reformulation applies, along with its assumptions and limitations. At the very least, this limitation should be explicitly acknowledged in the paper.\n\nLastly, the paper does not engage meaningfully with related work that attempts to solve min-max problems via alternative structure-aware methods. In particular, the recent work by Vlatakis et al. (2023) proposes gradient descent-ascent methods tailored for min-max problems with hidden structure. Given the similarity in motivation and objectives, a more thorough discussion comparing these two perspectives would be highly valuable. At the very least, the paper should provide a conceptual framework for its bilevel reformulation of existing methods. It would also be important to clarify whether bilevel approaches offer distinct computational or theoretical advantages over the work by Vlatakis et al. (2023), and under what specific conditions these advantages hold. \n\n[Vlatakis et al.] Solving min-max optimization with hidden structure via gradient descent ascent. NeurIPS 2023. \n\n*Minor Observations:* The derivation of Table 1 is not comprehensively explained, and the Moreau envelope definition appears somewhat unexpectedly, without strong contextual framing. \n\n\n**Conclusion.** The current experimental evidence is not sufficient to validate its utility in real-world, high-dimensional applications, particularly in the context of generative modeling. The paper would benefit from a more convincing empirical demonstration, stronger motivation for the reformulation in practical terms, and a more precise comparison with other recent advances in min-max optimization.\n\nQUESTIONS:\nCan the proposed bilevel reformulation be systematically applied to a broader class of min-max problems beyond the two case studies, and if so, what are the key structural requirements for reframing them as bi-level?\n\nHow does the proposed approach compare with those in Vlatakis et al. (2023)?\n\nWhat challenges or limitations arise when scaling the bilevel reformulation to high-dimensional settings (e.g., deep generative models for vision tasks)?\n\nLIMITATIONS:\nLimitations are not explicitly discussed either in the main paper or in the checklist.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-02"}