Paper: Two Heads are Better than One: Towards Better Adversarial Robustness by Combining Transduction and Rejection (ICLR-2024)

Reviewer comment (Novelty):
One main concern is that it is possible that proposing learning methods for a robust classifier in the transductive setting with a rejection option is not novel (even though rigorously showing that this problem is easy as in Theorem 4.1 is very meaningful).

Author response:
We assume that the suggested approach is to generate certificates for each test point, and select a minimum certificate radius such that the rejection rate is some fixed value; do we understand the proposed approach correctly? While this can be used to bound rejection rate, it does not necessarily increase robust accuracy. Similarly, the $\sigma$ parameter for randomized smoothing can be selected to ensure some minimum degree of robustness for all points; however, this likewise has limitations. In particular, this trades off accuracy for robustness [1], and ensuring robustness beyond the rejection radius for all points eliminates any benefit from rejection.

[1] Jeremy M Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing, 2019.

Reviewer comment (Theory):
By exploiting certified robustness methods (e.g., randomized smoothing) in the inductive setting, it is possible to achieve 100% robustness in the transductive setting. In the transductive setting, it is acceptable to achieve robustness on a given test set. Thus, as long as we can find an upper bound of max in (2) (which can be done via known certified robustness methods), this can be leveraged to choose a threshold for the selective classifier, which provides 100% robustness accuracy.

Author response:
We assume that the suggested approach is to generate certificates for each test point, and select a minimum certificate radius such that the rejection rate is some fixed value; do we understand the proposed approach correctly? While this can be used to bound rejection rate, it does not necessarily increase robust accuracy. Similarly, the $\sigma$ parameter for randomized smoothing can be selected to ensure some minimum degree of robustness for all points; however, this likewise has limitations. In particular, this trades off accuracy for robustness [1], and ensuring robustness beyond the rejection radius for all points eliminates any benefit from rejection.

[1] Jeremy M Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing, 2019.

Reviewer comment (Novelty):
After achieving 100% robustness accuracy in the transductive setting using certified methods, the remaining issue becomes reducing the false rejection rate, which is equivalent to making the upper bound tighter. In this regard, proposing a method to learn a robust classifier in the transductive setting with a rejection option may not add any novelty to advance adversarial robustness research.

Author response:
We assume that the suggested approach is to generate certificates for each test point, and select a minimum certificate radius such that the rejection rate is some fixed value; do we understand the proposed approach correctly? While this can be used to bound rejection rate, it does not necessarily increase robust accuracy. Similarly, the $\sigma$ parameter for randomized smoothing can be selected to ensure some minimum degree of robustness for all points; however, this likewise has limitations. In particular, this trades off accuracy for robustness [1], and ensuring robustness beyond the rejection radius for all points eliminates any benefit from rejection.

[1] Jeremy M Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing, 2019.

Reviewer comment (Evaluation):
From the result in Peng et al. 2023, data (diffusion augmented approach) is an essential factor to provide genuine boost of adversarial performance (over 10 points improvement). Instead, introducing new training method (transduction) does not give good improvement, and may not contribute much to the ultimate solution of adversarial robustness. More importantly, it is hard to compare these results as the assumption of availability of test data is different and the robust accuracy has different meaning when using rejection operation.

Author response:
We agree that additional data is beneficial, but this is not mutually exclusive with our contributions. Without any additional generated data, we significantly exceed the results of Peng et al. on CIFAR-10 (81.6% robust accuracy compared to 71.1%, with a greater relative improvement when equalizing architectures); we have additionally conducted experiments on CIFAR-100, on which TLDR continues to significantly outperform their results (57.9% compared to 38.7%).

While these are indeed different notions of robust accuracy, it is necessary to compare between settings for our work, as our focus is on demonstrating the potential advantages of one setting (transduction+rejection) over others. While such comparisons are not direct, the definition of robust accuracy for each setting in all cases captures the same concept, the fraction of samples on which we are correct (including notions of error, such as rejecting clean samples, which capture the disadvantages of a setting). Hence, we demonstrate the potential increase in the fraction of samples on which correctness is possible when comparing between settings.

Reviewer comment (Theory):
Transduction requires training on test data (unlabeled), which is far from realistic. It is better and important to design the algorithm and develop the theory based on online assumption of test data, i.e., each test data point is arriving sequentially.

Author response:
By retraining periodically, once a sufficiently large batch of samples arrives, transductive defenses can be easily adapted to a batched online setting, in particular for applications with minimal latency requirements. The results for the single sample/unbalanced online setting are in Appendix A.5, and suggest that transductive learners in general are suited to the batched rather than single-sample online setting, and as such this is not a significant limitation of our work.

Reviewer comment (Evaluation):
In Table 6 (Ablation Study), introducing L_test does not provide much improvement. Thus, the transduction is mainly for theoretical improvement. Is this correct?

Author response:
Note that all defenses shown in Table 6 are transductive; transduction in TLDR has two components, $l_\text{test}$ and private randomness. Note that $l_\text{test}$ has the additional benefit of substantially increasing the difficulty of the optimization problem to be solved by the adversary (instead of a simple maximization, the adversary must solve a maximin problem in the presence of $l_\text{test}$). Without private randomness or $l_\text{test}$, we reduce to the inductive case.

Reviewer comment (Theory):
Is it necessary in the proof of Theorem 4.1 to consider z' as $1/3$ distance from the actual perturbation? Is it just an arbitrary constant or it is necessary to use exactly $\frac{1}{3}$?

Author response:
It is not necessary to use exactly $1\over 3$; the argument can be adapted to handle $\tilde{z}’$ of varying distances from the perturbation. however, this provides the strongest results. 

To see this, consider $\tilde{z}’ = \tilde{x} + (\tilde{z}’ - \tilde{x}) \cdot p$ for $p \in [0,1]$. For the argument to hold, we require at least $p\epsilon$ robustness about $\tilde{z}’$ and nonempty intersection between a $p \epsilon$ ball about $\tilde{z}’$ and a $r$ ball about $\tilde{z}’$ where $r$ is the rejection radius. So $r \ge (1 - 2p)\epsilon$. But to avoid rejection on clean samples, we require at least $r$ robustness about $\tilde{z}’$; hence we require $\max\{ p\epsilon, (1-2p)\epsilon\}$ robustness about $\tilde{z}’$. Hence, soundness demands $\text{OPT}_{\max\{2p\epsilon, (1-p)\epsilon \} }$, minimized at $p ={1\over 3}$.

Reviewer comment (Theory):
The proposed bound depends on the complexity of the hypothesis set $H$. Given the assumption that it should contain a classifier with zero error, how large such a value (VC(H)) will be in practice?

Author response:
This assumption is only necessary in the realizable case; we provide results for the agnostic case as well (see Appendix A.4). However, see [1] for results on VC-dimension for neural networks with ReLU activation; this suggests that the VC dimension of common models for image classification may be on the order of hundreds of millions.

[1] Peter L. Bartlett, Nick Harvey, Christopher Liaw, Abbas Mehrabian. Nearly-tight VC-dimension and pseudodimension bounds for piecewise linear neural networks, 2017.

Reviewer comment (Experiments):
To validate the proposed bound, it is necessary to show that by increasing the unlabeled test size, the error decreases with high probability (according to the given bound). It would be nice if an experiment on the same dataset with a different number of test samples is added (performance as the function of the number of test samples). It can be done on multiple datasets with different complexities (CIFAR10, Imagenet) to demonstrate the performance of the method better.

Author response:
We are running these experiments; we will update when results are available.

We have added results on the generalization of TLDR on MNIST which show that, as expected, the error decreases with high probability as the test set size increases. This holds both in the case of equal training and test set sizes and in the case where the test set size is held fixed. See Appendix C.8 of the revision for the full details.