Paper:
Large-scale datasets may contain significant proportions of noisy (incorrect) class labels, and it is well-known that modern deep neural networks poorly generalize from such noisy training datasets. In this paper, we propose a novel inference method, Deep Determinantal Generative Classifier (DDGC), which can obtain a more robust decision boundary under any softmax neural classifier pre-trained on noisy datasets. Our main idea is inducing a generative classifier on top of hidden feature spaces of the discriminative deep model. By estimating the parameters of generative classifier using the minimum covariance determinant estimator, we significantly improve the classification accuracy, with neither re-training of the deep model nor changing its architectures. In particular, we show that DDGC not only generalizes well from noisy labels, but also is robust against adversarial perturbations due to its large margin property. Finally, we propose the ensemble version of DDGC to improve its performance, by investigating the layer-wise characteristics of generative classifier. Our extensive experimental results demonstrate the superiority of DDGC given different learning models optimized by various training techniques to handle noisy labels or adversarial samples. For instance, on CIFAR-10 dataset containing 45% noisy training labels, we improve the test accuracy of a deep model optimized by the state-of-the-art noise-handling training method from 33.34% to 43.02%.

Review:
The paper proposes a new method for robustifying a pre-trained model improving its decision boundaries. The goal is to defend the model from mistakes in training labels and to be more robust to adversarial examples at test time. The main idea is to train a LDA on top of the last-layer, or many layers in its ensemble version, making use of a small set of clean labels after training the main model. Additionally, robustness to outliers is achieved by the minimum covariance determinant estimator for the LDA covariance matrix.
While I find this idea interesting and of potential practical use, I have concerns about novelty and the experimental results and overall I recommend rejection.
== Method
At a high level, the idea of imposing a mixture of gaussian structure in the feature space of a deep neural network classifier is not new. See for example [A, B]. In particular, [B] performs experiments on adversarial examples. Moreover, in spite of the authors writing that their goal is “completely different” from [Lee at al 18a, Ma et al 18a], I found the two cited papers having a similar intent and approach to the problem, but a comparison is completely missing. Without a proper comparison (formal and experimental) with these lines of work, the paper is incomplete.
Theorem 1 well supports the proposed method and it is well explained. I did not check the proofs in appendix.
Regarding the presentation, I found odd having some experimental results (page 5) before the Section on experience even have started.
== Experiments
The authors did not comment on the computational overhead of training their LDA. But I assume it is very cheap compared to training e.g. the ResNet, correct?
I also did not find an explanation of which version backward/forward losses [Patrini et al. 17] is used in the experiments: are the noise transition matrices estimated on the data or assumed to be known (for fair comparison, I would do the former).
I disagree on the importance of the numbers reported on the abstract: DenseNet on Cifar10 with 60% goes from 53.34 to 74.72. This is the improvement with the weakest possible baseline, i.e. no method to defend for noise! Looking at Table 3, which is on ResNets, I will make this point clear. Noise 60% on CIFAR10, DDGC improves 60.05-> 71.38, while (hard) bootstrap and forward do better. Even more, it seems that forward does always better than DDGC with noise 60% on every dataset. Therefore, I don’t find interesting to report how DDGC improve upon “no baseline”, because known methods do even better. Yet, it is interesting --- and I find this to be a contribution of the paper --- that DDGC can be used in combination with prior work to boost performance even further.
A missing empirical analysis is on class-conditional noise (see for example Patrini et al. 17 for a definition). An additional column on the table showing that the algorithm can also work in this case would improve the confidence that the proposed method is useful in practice. Uniform noise is the least realistic assumption for label noise.
Regarding the experiments on adversarial examples, I am not convinced of their relevance at all. There are now dozens of defence methods that work (partially) for improving robustness. I don’t think it is of any practical use to show that a new algorithm (such at DDGD) provide some defence compared to no defence. A proper baseline should have been compared.
One more unclear but important point: is Table 3 obtained by white-box attacks on the Resnet/Denset but oblivious of the MCD? Is so, I don’t think such an experiment tells the whole story: as the the MCD would arguably also be deployed for classification, the attacker would also target it.
Additionally, the authors state “we remark that accessing the parameters of the generative classifiers […] is not a mild assumption since the information about training data is required to compute them”. I don’t follow this argument: this is just part of the classifier. White box attacks are by definition performed with the knowledge of the model, what is the difference here?
Table 8 rises some concerns. I appreciate the idea of testing full white-box adversarial attacks here. But I don’t understand how it is possible that DDGC is more robust, with higher adversarial test accuracy, than in Table 3.
[A] Wen, Yandong, et al. "A discriminative feature learning approach for deep face recognition." European Conference on Computer Vision. Springer, Cham, 2016.
[B] Wan, Weitao, et al. "Rethinking feature distribution for loss functions in image classification." Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2018.