Paper: A Novel Approach For Adversarial Robustness (ICLR-2024)

Reviewer comment (Experiments):
The authors do not compare any SNN baselines, which causes unfairness in the experiments. For example, I can simply find a paper [1] from Google Scholar, which discusses SNN in adversarial defense. In experiments, they compared various stochastic methods, which I cannot find in this paper. This unfair comparison causes a false contribution.

Author response:
Thank you for pointing out some SNN works. Actually, we only look for and compare with the top-ranking methods in the robustbench leaderboard https://robustbench.github.io/, where there are no SNNs. It appears that SNN is far behind the mainstream performance of adversarial defense. Of course, we will add more related work of SNN.

Our approaches are very different from all SNN works, as we essentially do the random feature squeezing. 

Just for a quick reference, here we make some comparisons with [1,2], where, unfortunately, there is no AA evaluation and moreover no experiment with ImageNet.

So we only compare with square for cifar10, In table 5 of [1], the square at 16/255 is 55.2 and 48.8 in table 4 of [2], far below ours  78.31.

[1] Yang, H., Wang, M., Yu, Z., & Zhou, Y. (2022). Rethinking feature uncertainty in stochastic neural networks for adversarial robustness. arXiv preprint arXiv:2201.00148.

[2] Weight-covariance alignment for adversarially robust neural networks Panagiotis Eustratiadis and Henry Gouk and Da Li and Timothy M. Hospedales ICML 2021

Reviewer comment (Novelty):
Trivial technical contribution: The manipulation of early or other intermediate features has been proposed various times in the literature. Most of these defenses have also been defeated.

Author response:
We don’t agree. Ours is based on random feature squeezing, which is novel and different from all other approaches.

Reviewer comment (Experiments):
The authors do not provide any ablation studies to justify their design choices.

Author response:
Essentially, our specially designed input layer is coupled with loss functions. In other words, they should be treated as a whole. So ablation studies are not applicable here.

Reviewer comment (Writing):
The title is chosen too general and is vague.

Author response:
True. At this moment, we are considering changing it to Adversarial Robustness through Random Feature Squeezing

Reviewer comment (Writing):
The writing is poor: Some parts of the paper are incomprehensible.

Author response:
We will correct it. Thanks.

Reviewer comment (Presentation):
The writing is poor: The introduction is written like a related work section.

Author response:
We will correct it. Thanks.

Reviewer comment (Writing):
The writing is poor: The contributions are not clearly explained and distinguished to previous works.

Author response:
We will correct it. Thanks.

Reviewer comment (Writing):
The writing is poor: A proper explanation of the proposed approach is missing.

Author response:
We will correct it. Thanks.

Reviewer comment (Presentation):
I can't grasp what Figure 2 is supposed to show.

Author response:
We are trying to show how each channel of input images is processed in our specially designed input layer.

Reviewer comment (Evaluation):
The authors might encounter obfuscated gradients here. Hence the authors should follow the guidelines in [1] and [2] and evaluate with BPDA.

Author response:
Every unit in our specially designed input layer is differentiable, so BPDA is not applicable. We do evaluate EOT.

Reviewer comment (Writing):
P3: Step 1: What is mean, std?

Author response:
Mean and std are the mean and standard deviation of the training set, the parameters needed for input normalization. We just want to make everything clear, so delve into such detail which is usually ignored by many other papers.

Reviewer comment (Experiments):
Sec 4.3: It seems that the adversarial examples are generated for one realization of the network, and tested on another. This is not standard practice.

Author response:
As our approach is random, the same sample could be classified with different logits when executed multiple times. Actually, for any input clean sample, a very simple approach to defeat ours is just feeding this perhaps thousands of times, and it is highly possible one of them will fool our net. Of course, one cannot conclude that ours is useless at all. So there is nothing wrong with the last move. In fact,  other works, for example[1], also adopt this under different contexts.

[1] Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks Dequan Wang and An Ju and Evan Shelhamer and David A. Wagner and Trevor Darrell

Reviewer comment (Reproducibility):
P5: EOT — it would be useful to mention the exact parameters over EOT is performed, and how those parameters were chosen.

Author response:
EOT is provided by the AutoAttack toolbox, with default iterations of 20.

Reviewer comment (Evaluation):
What is the robustness vs accuracy curve? When does it dip below the benign performance, for each of the attacks tested? At what perturbation does it go to zero? At this perturbation, how does a human perform?

Author response:
This is an interesting question. We will take it as our future work. In fact, EOT appears to be 
the only effective attack although at a high computation cost.

Reviewer comment (Experiments):
What is the role of each of the components of the preprocessor towards the final robustness, in that what happens when each of them are replaced by an identity transformation? (1) Sigmoid, (2) Random scaling, (3) Random Shift

Author response:
When any component is missing, the method can not work. Our specially designed input layer is also coupled with loss functions.  The sampling matrix should be small such that the response of Sigmoid will be mostly on the saturated region, namely “random feature squeezing”. In other words, this is the key to the robustness.