Paper:
We study covariate-shifted data augmentation where the augmented targets are drawn from the true predictive distribution but the inputs are shifted. Empirically, some forms of data augmentation such as adversarial training improve robustness, but increase test error. We provide precise conditions under which data augmentation can increase test error for minimum norm interpolation estimators in linear regression. As a fix, we propose X-regularization which uses unlabeled data to regularize the parameters towards the non-augmented estimate. We prove that augmentation with X-regularization never increases test error in linear regression. Empirically, X-regularization consistently improves both robustness and standard test error across different adversarial training algorithms and perturbations on CIFAR-10.

Review:
This paper studies data augmentation in the regime where labels for the augmented datapoints are known. Special emphasis is put on the study of overparametrised linear models with minimum Euclidean norm of the regression weights (a.k.a. ridgeless regression). The results of this study are then used to motivate their “X-regularization” method, a semi-supervised learning algorithm which they test on the task of improving accuracy of adversarially trained models. The authors report improvement in accuracy of adversarially trained classifiers on CIFAR-10 when X-regularization is applied.
While I think the paper could be potentially interesting to the ICLR community, I am currently leaning towards rejection for the following two reasons: (i) I am confused by significant chunks of the theoretical derivations;  (ii) the paper is hard  follow at several places, seems to be hastily written, and not well placed in the existing literature. Finally, I would like to state that since the paper is longer than 8 pages, I am holding it to a higher standard than an 8 page one as instructed by the guidelines.
Major comments:
- I am very confused by the way you compute the (uncentred) sample covariance for the augmented dataset. On the penultimate line before eq.5, you state that Sigma_data = 1 / n X^T X if I interpret n as the total number of rows of X (which is IMHO correct). But then a couple of lines below you say that Sigma_aug = 1 / n (X_std^T X_std + alpha X_ext^T X_ext) which by the above logic should have been Sigma_aug = 1 / ((1 + alpha) n) (X_std^T X_std + X_ext^T X_ext) which is different from your definition. Inspecting appendix A.1, you also use Sigma_data = Sigma_std + alpha Sigma_ext whereas the above would suggest Sigma_data = 1 / ((1 + alpha)n) (n Sigma_data + alpha n Sigma_ext) = 1 / (1 + alpha) (Sigma_data + alpha Sigma_ext)?! Can you please clarify? Note that I did not go through the rest of the proof in the appendix.
- On a related note, I am also rather confused by your example in sect.3.1.1. In particular, if you observe e_1, e_2, and e_3, and you are in the scenario where you can get the true labels for the X_ext data points + there is no noise on y (sigma = 0), then you will get theta_aug = (X^T X)^dagger X^T X theta* = Id^(-1) Id theta* = theta* (where Id stands for the identity matrix), i.e., theta_aug = theta* and so there will be zero generalisation error since y = x^T theta* is the correct data generating process in this scenario. However, in the first display on p.4, you claim the bias (and thus generalisation error) of theta_aug is non-zero. The rest of the section similarly seems to contradict the theta_aug = theta*. Can you please clarify?
- Since the rest of sect.3 also uses the Sigma_aug = Sigma_data + alpha Sigma_ext instead of scaling this expression by Sigma_aug = 1 / (1 + alpha) (Sigma_data + alpha Sigma_ext), I will withhold my judgement until you could please clarify this confusion.
- Can you please point me to where I can find more detail about fig.1? In particular, how was the right plot produced (incl. how many repetitions of the experiment were executed)? Also, is it true that the green points in the middle plot were not chosen at random? If so, this should be clarified in the caption and the text.
- Since all of your non-toy experiments are focused on adversarial learning, it might benefit the paper to advertise this focus more clearly from page one. Furthermore, have you tested X-regularization with non-adversarial data augmentation (on CIFAR-10 or other standard benchmark) please?
- While you briefly mention the existence of alternatives to your algorithm, you don’t include any of these in your experiments section. I would suggest including some benchmark results (even if this only means restating numbers from other papers with citation).
Minor comments:
- In the abstract, you claim about X-regularization: “We prove that our new estimator never increases test error.” while sect.4 you say that this guarantee only holds for linear models. I think this should be clarified in the abstract.
- p.1 in par.1, you say “but in practice, we often work with models which can fit the augmented training data perfectly” (similar statements also appear throughout the paper, e.g., the last sentence of par.3 on p.1). I am confused by this statement because many augmentation schemes have full support in the input space, i.e., you will eventually have to be able to classify correctly any point in the input space. Are you assuming that the conditional distribution of y given x is almost surely deterministic, and using some universal approximation theorem for neural networks (even those tend to have some restrictions on the y = f(x) function!)? Please clarify.
- p.1 in par.3, “... may increase increase error …” -> “may increase error”
- Second to last paragraph on p.2, “Y = X theta + sigma N(0, I)” is mixing random variables and distributions. Please consider replacing “N(0, I)” with “epsilon, epsilon ~ N(0, I)“. Also, comparing with eq.1, did you mean “sigma^2” in eq.1?
- Last paragraph on p.2, “compare the performance two estimators” -> “ compare the performance of two estimators”.
- Top of p.2 in eq.3: the definition of the augmented estimator is somewhat confusing. If the augmentation causes the total number of points (i.e., n + \alpha n) to be higher than d (the number of parameters), then the set on the right hand side can be empty (and will be unless there is some perfect multicollinearity). Can you please clarify how is the augmented estimator defined in that case?
- Please reconsider use of contractions (e.g., “doesn’t” -> “does not” in par.2 of sect.3) throughout the paper.
- In eq.5, in the expression for bias, I think you are missing star superscript for the 2nd theta.
- Under eq.5, “... we say that augmentation is safe if the predictive risk or bias does not increase, and hurtful if it does.” Can you please clarify whether the use of “or” is in the strictly logical sense, i.e., arbitrarily large increase in variance is fine as long as bias does not increase (in which case the second part of the statement and thus the full statement is still true)?
- Beginning of “Large Sample Regime” paragraph of sect.3, you claim  “Common intuition from a statistical standpoint would suggest that more data is always good.” I am not sure I agree: there is a plethora of literature on data poisoning, robustness, differential privacy, adversarial examples, etc., which shows that adding data can significantly worsen performance of models. Even without reading these papers, it seems quite natural that adding **arbitrary** data into the dataset may not be the best idea (even in the large sample regime).
- Unresolved equation reference on p.11, 2nd line. Also, in the very next sentence, “yields zero and variance …” -> “yields zero bias and variance ...“?! Broken references also on p.14 (twice).