Paper: CARSO: Blending Adversarial Training and Purification Improves Adversarial Robustness (ICLR-2024)

Reviewer comment (Experiments):
Author used a method of mixing purification and AT, but I don't think it is fair to only have an ablation study in AT. I wonder comparison between purification method vs CARSO + purification method.

Author response:
1.   **On ablation studies against AT- and purification-based methods**
     The Reviewer is correct in stating that our proposal is based on a mix of *adversarial training* and *adversarial purification*. However, comparisons contained in *Table 2* and commented in *Section 5* are not to be intended as proper ablation studies: they assess the clean and robust accuracy of CARSO against the **sole adversarially-trained classifier model** used as part of CARSO itself, as a baseline.
     In any case, they may also be conceptually seen as ablation studies where the purification part is removed, and we assume the reviewer refers to such fact. The purification part of CARSO – however – is by definition **conditional on the representation** of an existing adversarially-trained classifier. As a consequence, a proper ablation study requiring that only the purification portion of CARSO is used, would be ill-defined.
     In general, one may use known results from published literature to virtually *ablate away* the adversarial training contribution to CARSO, by comparing our method directly against purification-only adversarial defences such as [1] from 2015 (where, exactly as in CARSO, VAEs are used as purifiers) or [2] (which is the overall *state of the art* in such respect).
     In the first case, VAEs have even been shown to tragically **decrease** the robustness of the resulting system – requiring the use of much more modern and capable *diffusion-* or *score-*based models to obtain a self-standing purification-based defence. Such information is contained in the *Introduction* of the paper, and in *Section 2*, *Purification as a defence*.

     In the second case, such comparison is directly contained in *Table 2*, columns 7 and 8, and constitutes a main element of the experimental assessment of our method against existing, published ones.
     Finally, we were unfortunately unable to understand the suggestion of a *“purification method vs CARSO + purification method”* comparison, and would kindly ask the Reviewer to clarify.

Reviewer comment (Experiments):
It was said that the motivation for separating the scenarios was due to a lack of clean image accuracy, but as a result, the same difference is shown in (c) and (d). So, I don’t think that dividing the scenario and showing the experiment is an important part of the paper. Rather, the logic that it was used in the expect of obtaining an internal representation from a more refined classifier in order to perform SOTA on a robust image seems more appropriate.

Author response:
2.   **On the separation of scenarios and its consequences**
     The Reviewer states that *“the motivation for separating the scenarios was due to a lack of clean image accuracy”*. However, no such statement is contained in any part of the paper. The only principle followed in determining the different scenarios was the choice of **dataset and *classifier* model used** as a starting point for CARSO. For completeness, a recap of such differences is shown below:

     -   *Scenario (a)*: CIFAR-10 / ResNet-18 from [3];

     -   *Scenario (b)*: CIFAR-10 / PreAct ResNet-18 from [4];

     -   *Scenario (c)*: CIFAR-10 / Wide ResNet-28-10 from [5];

     -   *Scenario (d)*: CIFAR-100 / Wide ResNet-28-10 from [5];

Unfortunately, we were not able to understand the next part of the question, which in any case seems to follow logically from the initial statement, not contained in the paper. We would kindly ask the Reviewer a clarification in such regard.

Reviewer comment (Writing):
Author made an analogy about the method using terms (cued recall and recognition) from cognitive science, but it doesn't seem to be clear.

Author response:
3.   **On the neurocognitive inspiration of CARSO**

     In the *Introduction* of our paper, we state that our method has been inspired by the *neurocognitive processes underlying cued recall and recognition*. We would like to reiterate that such consideration was neither meant to be an analogical explanation, nor that our method is endowed by some kind of neurobiological plausibility: the works mentioned right after (*i.e.* [9], [10] and [11]) provided a suggestion towards the development of our main contribution: the *representation-conditional* generation of (purified, in our case) images.
     Similarly to how a biological stimulus (of same or different modality) can evoke a neuronal ensemble whose projection onto another ensemble may directly influence a collateral task – the whole process of image purification and subsequent classification (cued recognition) within CARSO is conditioned by the evoked internal representation within the classifier, when it is fed the original, potentially perturbed, input (cue). As part of such process, additionally, the actual classification does not occur directly on the original input (cue), but on a *version* of it that is *recalled* from the results of *experience* (the training of the VAE), idealised in its form (in our case: purified from perturbations) – *i.e.* constituting a *cued recall* of the original.

Reviewer comment (Experiments):
Too much limited and insufficient experiments: There are no state-of-the-art defense baselines such as AWP [1], SCORE [2], and ADML [3], and no larger-scale dataset such as ImageNet. In addition, based on ADML, not only CNN structure and Transformer structures seems needed to validate.

Author response:
4.    **On the the limits to our experimental assessment**

We do agree with the Reviewer that extending the experimental assessment of our method to other datasets beyond CIFAR-10/100 (*e.g.* scaling up to ImageNet) would constitute a valuable extension to out work – and we are actively working towards such end.
However, we would like to restate once more that our work is fundamentally concerned with whether it is possible to blend *adversarial training* and *adversarial purification* by conditioning the purification process on the internal representation of the classifier. With no prior work following such line of thought – before trying to *scale up* – we have been careful to ensure significant conclusions may be reached from a relatively simple, *proof-of-concept* set of experiments.
Indeed, we deliberately choose a VAE as a purification model – whose use as an adversarial purifier has been long abandoned due to its relatively scarce expressiveness in image reconstruction – to allow for exact differentiability of the sampling process, and to emphasise that it is the **interplay with the AT-trained classifier** that is able to strongly improve robustness; and not the exploitation of an already *SotA* purification approach. In such constrained setting, and with no significant risk of robustness overestimation (as would instead happen when gradient approximations are used [2]) we still manage to overcome both state-of-the-art *AT-based* models and diffusion-based *purification* methods.
A *scale-up* of our approach is indeed possible – both in terms of data size and task complexity. Reasonably doing so would require the use of a more modern and capable purification architecture (*e.g.* *score-*, *diffusion-* or *flow-* based), the complete rework of the experimental assessment (since adversarial attacks against such generative model are an active field of research – and doubts have been cast around the adequacy of AutoAttack in such sense), and significant engineering contributions. We defend that including such more complex scenario in our work, at this stage, would damage clarity of our contribution.

4 bis. **On comparison with additional *SotA* baselines**
With respect to explicit comparisons, within the main body of the paper, to existing adversarial defence methods, we limited ourselves to two categories of approaches: those (*AT-based*) used as *classifier*s as part of the CARSO architecture, and those (both *AT-* and *purification-*based, called by us *state of the art*, with this precise definition) able to obtain – for each dataset – the highest $\ell_{\infty}$ robust accuracy against AutoAttack at the moment of writing (for future reference: September 2023), according to the contents of the original paper. None of the methods mentioned by the Reviewer satisfied such criteria for inclusion.
In any case, a comparison can be made on the spot:

-   <u>AWP</u>: The best-performing method (RST-AWP WRN-28-10) against $\ell_{\infty}$ AutoAttack contained in Tables 1 and 2 of [6] for CIFAR-10 is able to reach $60.05\%$ robust accuracy. The best performing for CIFAR-100 (AT-AWP WRN-34-10) is able to reach $30.71\%$.
    This can be compared to the results of CARSO (using the WRN-28-10 classifier from [5]): $75.70\%$ for CIFAR-10 and $65.73\%$ for CIFAR-100, which constitute a very strong improvement. 
-   <u>SCORE</u>: Similarly, the best performing model ($\beta=4$ WRN-28-10) according to *Table 3* of [7], for CIFAR-10, reaches $61.66\%$ robust accuracy. The best for CIFAR-100 ($\beta=4$ WRN-28-10) reaches $ 31.21\%$. Results for CARSO (using the WRN-28-10 classifier from [5]) are: $75.70\%$ for CIFAR-10 and $65.73\%$ for CIFAR-100, which constitute again a very strong improvement.
-   <u>ADML:</u> According to *Table 1* and *Table 2* of the paper [8], regardless of the architecture used for the model, the best-performing model on CIFAR-10 (WRN-70-10, more than twice as deep *w.r.t.* our base *classifier*!) obtains $63.1\%$ robust accuracy. The same model, for CIFAR-100, reaches $37.6\%$. Again, compared to results for CARSO (using the WRN-28-10 classifier from [5]) – $75.70\%$ for CIFAR-10 and $65.73\%$ for CIFAR-100 – our method determines a very strong improvement.
    Additionally, we should remind the Reviewer that ADML is covered by the *concurrent work* clause for the ICLR conference (publishing date of the method: Jun 2023).

Significantly, for all methods mentioned above, not only CARSO – but even our baselines from [5] – were able to clearly improve upon respective best published results (nominally: $67.73\%$ for CIFAR-10 and $39.18\%$ for CIFAR-100 for the best of such baselines), by using equal or (much) smaller architectures. Direct comparisons of CARSO to such baselines are shown in *Table 2* of our work.

Reviewer comment (Theory):
It is not convincing that adversarial purification model can improve robustness in current version of this paper. For convincing argument, it is much greater to change the motivation of this paper to ***adversarial purification improves robustness*** in introduction, and prove it in the following sections with theoretical or empirical background. In other words, the authors should show that naively denoising images are significantly different than adversarial purification, and adversarial purification is really the most important part in general adversarial robustness.

Author response:
We thank the *Reviewer* for his/her *post-rebuttal* comment. We also apologise for the initial confusion caused by the lack of notification about the publishing of such comment – having it been written as an edit to an already-published review instead of a new comment, necessary to ensure a notification to the *Authors*.

As far as points of merit are concerned, we would start by clarifying once more that CARSO is **not *just* a purification model**  – at least not in the conventional sense. Indeed, CARSO is an adversarial defence composed of **two, different models** (the *classifier* and the *purifier*, the former of which can be obtained as a pre-trained model) operating in close synergy. Specifically, **the purifier performs purification from the *internal representation* of the input produced by the *classifier***, and not directly from the input. Afterwards, **the same *classifier* performs classification on many samples obtained from the *purifier***. This specific principle of operation allows to defend against the pitfalls of *naïve* adversarial purification outlined in [1], and allows to exploit the specific properties of gradient arising at the level of the neurons in the *classifier* during an adversarial attack – as outlined in *Subsection 4.2*.

We will address each of the points raised, more in detail, in the following.

1.   We understand that the *Reviewer* would prefer to see – instead of one we submitted – a paper showing clearly that adversarial purification alone is able to contribute significantly to the development of general adversarial robustness. Additionally, he/she would like evidence that adversarial purification is different from *naïve* denoising of the input.
     While we share the interest of the reviewer – we would like to point out that those two research questions have never been part of those we wanted to address with out manuscript. Specifically, as far as the first point is concerned (*i.e.*: that adversarial purification is a viable general recipe to obtain adversarial robustness), we would like to point out that [2] already provides very significant evidence in such sense. As far as the latter point is concerned (*i.e.*: that *naïve* image denoising is significantly different from adversarial purification), [1] already provides such results.
     In our work, we wanted to address a different question, *i.e.* whether it is possible to integrate adversarial training and adversarial purification in a mutually beneficial way, providing tangible benefits *w.r.t.* each of the separate methods alone. We would kindly ask our paper to be evaluated as such.

Reviewer comment (Experiments):
More importantly, this paper should make the reader think of its paper as expandable work to general adversarial robustness. For example, it is better to validate that the performance of "CARSO" + "MART" or "AWP" or "SCORE" or "ADML" is stronger than that of "CARSO" + "AT(baseline)". This is because CARSO is adversarial purification model.

Author response:
2.   As far as the scope of our paper is concerned, we would ask the reviewer – as well as any of its readers – to stick to the experimental setup we defined, and to the eventual future developments of our work we outlined – without unduly generalising our results.
     As far as a hypothetical comparison of `CARSO+AT(baseline)`  and `CARSO+MART/AWP/SCORE/ADML` is concerned, we believe it not to be an adequate test to verify our claims. Indeed, in the eventuality – as the reviewer suggests – that `CARSO+MART/AWP/SCORE/ADML` is in fact **stronger** than `CARSO+AT(baseline)`, no specific conclusions can be reached about the usefulness of having added CARSO to the mix. At best, the result could prove that – regardless of it being used alone, or as part of a CARSO-like defence scheme – `MART/AWP/SCORE/ADML` are better training protocols than `baseline`. Even though we are potentially interested in an investigation of such kind, such research question is orthogonal to that addressed by our paper.

Reviewer comment (Experiments):
There should exist an experiment of considering state-of-the-art image denoising model based on deep learning. Simply, the reviewer calls this model as "A". Here, the authors should validate that "CARSO" + "MART" or "AWP" or "SCORE" or "ADML" is much stronger than adversarially training "A" + "MART" or "AWP" or "SCORE" or "ADML", where "A" should be, of course, trained with same adversarial strategy with CARSO. This is because CARSO is, again, adversarial purification model.

Author response:
3.   With respect to suggestions of a comparison between `A+MART/AWP/SCORE/ADML` and `CARSO+MART/AWP/SCORE/ADML` (with `A` being a generic *state-of-the-art* adversarial purification model), similar considerations do apply. Additionally, a more technical reason should be also considered. In fact, CARSO is not a conventional adversarial purification model – *i.e.* one that directly maps a *perturbed* input to a *clean* one. We refer to the introduction part of this comment for a more thorough explanation of what CARSO *is* and *is not*.
     As a consequence, this would not allow for direct use of existing (*SotA* or otherwise) adversarial purification models to take the place of the *purifier* within CARSO, in an eventual comparison of the kind suggested by the reviewer. On the other hand, the surreptitious use of the architecture of an existing *input-to-input* conventional *purification-based* defence to be re-trained as the purifier of CARSO would defy the very meaning of *SotA* – such architecture being employed for a task it was never meant to solve.
     Our experiments, instead, show that the `B+CARSO` defence provides better robust accuracy as opposed to `B` alone, with `B` being a generic *state-of-the-art* AT-based defence. Moreover, the same `B+CARSO` defence is able to overcome also *state-of-the-art* adversarial purification models.

As a conclusive comment, we noticed that the *Reviewer* updated the evaluation of our work from 3 (*reject*) to 1 (strong reject) after our rebuttal – without providing a direct justification for such choice. We are left quite perplexed and dubious, and would like to ask the *Reviewer* for a more precise and detailed explanation.

Reviewer comment (Experiments):
Only evaluate the method on CIFAR-10 and 100, which are from the same image distribution. Should also evaluate other different datasets for comprehensiveness.

Author response:
**On scaling to more complex datasets**
We do agree with the Reviewer that extending the experimental assessment of our method to other datasets beyond CIFAR-10/100 (*e.g.* scaling up to ImageNet) would constitute a valuable extension to out work – and we are actively working towards such end.
However, we would like to restate once more that our work is fundamentally concerned with whether it is possible to blend *adversarial training* and *adversarial purification* by conditioning the purification process on the internal representation of the classifier. With no prior work following such line of thought – before trying to *scale up* – we have been careful to ensure significant conclusions may be reached from a relatively simple, *proof-of-concept* set of experiments.
Indeed, we deliberately choose a VAE as a purification model – whose use as an adversarial purifier has been long abandoned due to its relatively scarce expressiveness in image reconstruction – to allow for exact differentiability of the sampling process, and to emphasise that it is the **interplay with the AT-trained classifier** that is able to strongly improve robustness; and not the exploitation of an already *SotA* purification approach. In such constrained setting, and with no significant risk of robustness overestimation (as would instead happen when gradient approximations are used [6]) we still manage to overcome both state-of-the-art *AT-based* models and diffusion-based *purification* methods.
A *scale-up* of our approach is indeed possible – both in terms of data size and task complexity. Reasonably doing so would require the use of a more modern and capable purification architecture (*e.g.* *score-*, *diffusion-* or *flow-* based), the complete rework of the experimental assessment (since adversarial attacks against such generative model are an active field of research – and doubts have been cast around the adequacy of AutoAttack in such sense), and significant engineering contributions. We defend that including such more complex scenario in our work, at this stage, would damage clarity of our contribution.

Reviewer comment (Experiments):
Adversarially pre-trained models are used as the classifier in the proposed method. Should also compare with those methods following the same setting for fairness.

Author response:
**On comparison to adversarially pre-trained classifier models**
The reviewer is correct in noticing that adversarially pre-trained models are used as part of the proposed method (CARSO). The comparison of CARSO with those models in terms of both clean and AutoAttack $\ell_{\infty}$ adversarial accuracy is already contained in *Table 2* (columns 4 and 5 for clean accuracy; columns 6 and 7 for robust accuracy).
Following the evaluation guidelines of RobustBench [2] – *i.e.* considering AutoAttack as a standardised proxy for worst-case adversarial robustness against unforeseen attacks – models not endowed with stochastic components or non-deterministic forward passes (*i.e.* the original models) have been tested with the deterministic version of AutoAttack. The derived CARSO counterpart – being stochastic in its forward pass – has been tested against the stochasticity-aware version of AutoAttack, the rest of the setup being the same. Testing of CARSO against the standard version of AutoAttack always results in a much overestimated robustness, whereas testing the original models with its stochasticity-aware version is both unnecessary and still results in overestimated robustness.

Overall, we do believe that the choices operated as part of our comparison allow to reflect best the assessment goals for which AutoAttack has been originally devised, and is used by the robust DL community.

Reviewer comment (Experiments):
The authors showed training times for different scenarios. It should be compared with other methods. Also, the comparison on inference time should also be given to evaluate the efficiency.

Author response:
**On the comparison of training and inference times**
We totally agree with the Reviewer that a fair comparison with training and inference times of other methods would improve the strength and presentation of the efficiency of our proposal (which is, however, a marginal aspect of the whole contribution).

In any case, a fair comparison would require strong homogeneity in the hardware setup – almost always preventing reliance on the times shown in the respective papers, for such purpose. Given also the large computational budget required to re-train models for the sake of such comparison, and the relatively marginal role of such precise efficiency measurements in the context of safe and adversarially-robust DL, the large majority of similar published papers in the field only report elapsed training time, and a precise description of the underlying hardware. We uniformed our contribution to such common practice.

Reviewer comment (Novelty):
Are there any other previous papers that have considered incorporating adversarial training and adversarial purification in a unified framework? If yes, please list them.

Author response:
**On prior art related to the blending of adversarial training and purification**
As stated in the 5th paragraph of the *Introduction*, we are genuinely not aware of any previous work that integrates *adversarial training* and *adversarial purification* in an organic, mutually-beneficial way.

Of course, one may think of the stacking of a *purifier* and an *adversarially-trained* classifier as a simple technique to leverage both kinds of adversarial defences. However, such setup would expose itself to known vulnerabilities [1] resulting in generally worst robustness compared to the adversarially-trained classifier alone.

Reviewer comment (Writing):
The authors mentioned they draw inspiration from neurocognitive processes underlying cued recall and recognition. Please elaborate a little bit more details about this neurocognitive process and why it inspires the proposed method.

Author response:
**On the neurocognitive inspiration of CARSO**
In the *Introduction* of our paper, we state that our method has been inspired by the *neurocognitive processes underlying cued recall and recognition*. We would like to reiterate that such consideration was neither meant to be an analogical explanation, nor that our method is endowed by some kind of neurobiological plausibility: the works mentioned right after (*i.e.* [3], [4] and [5]) provided a suggestion towards the development of our main contribution: the *representation-conditional* generation of (purified, in our case) images.
Similarly to how a biological stimulus (of same or different modality) can evoke a neuronal ensemble whose projection onto another ensemble may directly influence a collateral task – the whole process of image purification and subsequent classification (cued recognition) within CARSO is conditioned by the evoked internal representation within the classifier, when it is fed the original, potentially perturbed, input (cue). As part of such process, additionally, the actual classification does not occur directly on the original input (cue), but on a *version* of it that is *recalled* from the results of *experience* (the training of the VAE), idealised in its form (in our case: purified from perturbations) – *i.e.* constituting a *cued recall* of the original.

Reviewer comment (Experiments):
I'm not sure whether the defensive effectiveness comes from the combination of adversarial purification and adversarial training or the bags of tricks utilized in this work.

Author response:
**On the *bag of tricks* used in this work**
We would like to start by pointing out that the *bag of tricks* used in our proposal was **not** motivated by the goal of improving the defensive capability of the resulting model, as the reviewer seems to assume – and was never described as such in any passage of the paper.  Such tricks (see *e.g.* the bullet list part of the *Introduction*) have been devised to **allow** the actual training of the model (which would have been impossible otherwise, *e.g.* for computational reasons), to **accelerate** it, and to **stabilise** it – sometimes even sacrificing robust accuracy.

More in detail:

-   The *example and internal representation pre-encoding* trick was motivated by the need to tailor the compressive process (of *examples* and *internal representations* respectively) to the specific structure of respective data types, while also avoiding the use of a very large and deep, indiscriminately fully-connected encoder. Since such requirements had to be matched to the principles of operation of a VAE, a stacked encoders structure was finally adopted. *Section 4.3* describes such reasoning in much richer detail, and never mentions defensive capabilities.

-   The *instance specific tuning* trick(s) can be further subdivided into two:

    -   The choice of decoder architecture was again justified by the type of data (natural images) to be generated, and to the need not to introduce gratuitous lossy artifacts in the reconstructions. This practice can be assumed to be quintessential to any reasonable use of deep learning, and not specific to adversarial defences.
    -   The use of *internal representation* subsets, instead, actually **decreases** defensive capabilities of the method (as we observed, in the incipient phases of our work, from experiments with smaller networks), but was necessary to ensure scalability regardless of the size of the (representation of the) *classifier*.

    Details on both such sets of tricks are contained in *Section 4.5*, with no mention of an increase in defensive effectiveness.

- As far as the *adversarially balanced batches* trick is concerned – even though its net result is an increase in the resulting robust accuracy (relatively limited, though necessary to reliably overcome the state of the art) – it was developed as a way to stabilise the later phases of training. Specifically, given the need to train the purifier on both *corrupt-to-clean* and *clean-to-clean* mapping, some different example ordering schemes were explored: sequentially in homogeneous batches, determining uniformly at random whether each point had to be perturbed or not, and detailedly balancing each batch. Since the final (both clean and robust) accuracy of the resulting model depended significantly on the composition of the last training batches – in the first two cases – either an approach based on validation-driven early stopping, or based on detailed batch composition was needed. Validation of adversarial robustness would have in turn depended on the specific composition of the validation set; as a consequence, the *trick* in its final form was employed – removing the problem at its roots.

**On the origin of defensive effectiveness**
Given the explanation contained in the previous paragraph, we defend that it is indeed the blending of *adversarial training* and *representation-conditional adversarial purification* the reason for the observed increase in robust accuracy. The overall effect of the *bag of tricks* could instead be estimated from slightly positive at best (due to *adversarially balanced batches*) to significantly negative at worst (due to *internal representation subsetting*).

Reviewer comment (Experiments):
In Table 2, please explicitly mention the state-of-the-art method and its reference rather than vaguely refer to sota in RobustBench as the sota can change with time, and it's unclear whether it's fair to compare with sota as the experimental settings (architecture, training setups) may vary.

Author response:
**On the *SotA* results referred to**
We apologize for the lack of clarity *w.r.t.* the exact sources of *SotA* results referred to both in *Table 2* and *Section 5.2*. It was the furthest to our intention to *conceal* such sources by referring to positions of the *RobustBench* leaderbord – which, alone, we understand may be source of confusion.

While the CIFAR-10 *purification-based* *SotA* source is mentioned right underneath *Table 2* (*i.e.* [1]), the remaining AT-based *SotA* results for CIFAR-10 ([2]) and CIFAR-100 ([3]) were only mentioned as such across the *Introduction* and *Related Work* sections.

We will surely update the section and the table to make more explicit and clear references.

For the sake of completeness, and future reference, they are once more reported below in bullet-list form:

-   CIFAR-10, AT-based *SotA*, refers to [2];
-   CIFAR-10, purification-based *SotA*, refers to [1];
-   CIFAR-100, AT-based *SotA*, refers to [3].

Reviewer comment (Experiments):
Besides robust accuracy, why not compare with sota regarding clean accuracy, while in the present form, it seems the authors only reported comparisons with standard adversarial training (2018).

Author response:
**On the *SotA* for clean accuracy**
To better pinpoint the observation, we would kindly ask the Reviewer to clarify whether the *SotA* clean accuracy referred to was intended to mean the *clean* accuracy of the best (*SotA*) **robust** models – or the general *SotA* clean *accuracy* on the respective dataset, regardless of robustness constraints.

Assuming that the reviewer refers to the former interpretation – we could easily add a further column in *Table 2* conveying such information. In any case, we would point out that, at the moment of the writing, clean accuracy of robust *SotA* models (see previous answer for precise references) are within 0.5% accuracy *w.r.t.* the best baselines in *Table 2*.

Reviewer comment (Presentation):
I have carefully checked the rebuttal and comments from the other reviewers, and I still believe this paper can be much further improved particularly in terms of the presentation (as the readers might be confused by some presented results, contributions, or tricks).

Author response:
We thank the *Reviewer* for his/her *post-rebuttal* comment. We also apologise for the initial confusion caused by the lack of notification about the publishing of such comment – having it been written as an edit to an already-published review instead of a new comment, necessary to ensure a notification to the *Authors*.

As far as specific points of merit are concerned, we have slightly updated our manuscript – to integrate some clarifying details as suggested by the original reviews. With respect to all other issues identified, we believe our work, especially in its *post-rebuttal* form – not to be misleading to the readers – in any of the specific aspects mentioned (*i.e.* results, contributions, tricks). We refer to the specific rebuttals for an in-depth discussion on the merits of the matter.

Reviewer comment (Experiments):
Generative model-driven purification as a defense against adversarial attacks has been established to a reasonable extent. Existing works demonstrated the effectiveness of this framework using denoising autoencoders (DAE), UNet-based DAE, GAN, VAE, etc. (section 2 of the draft provides references). However, scaling to complex datasets such as ImageNet has been challenging in this context. This draft restricts the experimental analysis only to simpler datasets (CIFAR). Since sophisticated models that are adversarially trained on ImageNet dataset are available easily, readers would expect the draft to experiment with them too.

Author response:
**On scaling to more complex datasets**
We do agree with the Reviewer that extending the experimental assessment of our method to other datasets beyond CIFAR-10/100 (*e.g.* scaling up to ImageNet) would constitute a valuable extension to out work – and we are actively working towards such end.
However, we would like to restate once more that our work is fundamentally concerned with whether it is possible to blend *adversarial training* and *adversarial purification* by conditioning the purification process on the internal representation of the classifier. With no prior work following such line of thought – before trying to *scale up* – we have been careful to ensure significant conclusions may be reached from a relatively simple, *proof-of-concept* set of experiments.
Indeed, we deliberately choose a VAE as a purification model – whose use as an adversarial purifier has been long abandoned due to its relatively scarce expressiveness in image reconstruction – to allow for exact differentiability of the sampling process, and to emphasise that it is the **interplay with the AT-trained classifier** that is able to strongly improve robustness; and not the exploitation of an already *SotA* purification approach. In such constrained setting, and with no significant risk of robustness overestimation (as would instead happen when gradient approximations are used [2]) we still manage to overcome both state-of-the-art *AT-based* models and diffusion-based *purification* methods.
A *scale-up* of our approach is indeed possible – both in terms of data size and task complexity. Reasonably doing so would require the use of a more modern and capable purification architecture (*e.g.* *score-*, *diffusion-* or *flow-* based), the complete rework of the experimental assessment (since adversarial attacks against such generative model are an active field of research – and doubts have been cast around the adequacy of AutoAttack in such sense), and significant engineering contributions. We defend that including such more complex scenario in our work, at this stage, would damage clarity of our contribution.

Reviewer comment (Experiments):
The reviewer strongly opines that the draft needs to be improved w.r.t. the clarity of presentation clarifying all the issues raised by the reviewers. Moreover, the discussion and the experiments presented do not strongly convince about the effectiveness of the proposed framework against adversarial attacks. The reviewer reckons that the authors' notion of a proof-of-concept level of work needs to be substantially supported (with the points mentioned by the reviewers) to be discussed at a venue such as ICLR.

Author response:
We thank the *Reviewer* for his/her *post-rebuttal* comment. We also apologise for the initial confusion caused by the lack of notification about the publishing of such comment – having it been written as an edit to an already-published review instead of a new comment, necessary to ensure a notification to the *Authors*.

As far as points of merit are concerned, our definition of the experiments and results contained in our work as *proof-of-concept* pertained to a specific comment of *Reviewers* with respect to the choice of benchmark datasets utilised in the paper (*i.e.* CIFAR-10 and CIFAR-100) – and definitely not to the strength and value of such results.
Indeed, within the experimental scope so identified, our results show a clearly improved $\ell_{\infty}$ adversarial accuracy of CARSO against any of the baselines considered, and also against the current best published *adversarial training* and *adversarial purification* models and protocols.

Even more so, because of the fact that – as mentioned in both global and specific rebuttals – our choice of experimental framework and purification model to be employed, was not driven by purification performance. Instead, exact differentiability of the purification model, and constraints on computational expenditure, were mainly took into consideration – even at the cost of decreased overall robustness, and a much harder setup for our model to defend.

With respect to all other issues identified, we believe our work, especially in its *post-rebuttal* form – not to be unclear or misleading to the readers – and refer to the specific rebuttals for an in-depth discussion on the merits of the matter.

Reviewer comment (Writing):
The draft reads that to sample from the generative model in the proposed framework, the auxiliary encoder $\mathcal{D}$ is unnecessary. However, it appears that the sampling process needs the encoder's output - which is driven by both the auxiliary encoders $\mathcal{C}$ and $\mathcal{D}$ - concatenation of $z_i$ and $c'$. Authors may provide a clarification for this.

Author response:
**On whether the auxiliary *data pre-encoder* is required at inference time**
We refrain that inference-time operation of CARSO **does not** require the auxiliary *data pre-encoder* $\mathcal{D}$, as stated in the manuscript, and correctly understood by the Reviewer. Indeed, not even the *proper* encoder is needed: only the auxiliary *representation pre-encoder* $\mathcal{C}$ is necessary.
As a matter of fact, at inference time, $c^{\prime}$ is obtained by feeding the extracted internal representation from the classifier to $\mathcal{C}$, whereas the vectors $z_i$ are sampled from the *i.i.d.* Standard Normal priors of the VAE. This is explained in *Section 4.1*, *Inference* and in *Figure 1* right next to it.
Such design choice is crucial to ensure that no gradient flows from the input to the bottleneck of the VAE during an adversarial attack, preventing known vulnerability pathways to be exploited [1].

Reviewer comment (Presentation):
In section 4.5, it is mentioned that the proposed approach - instead of including the conditioning on tensor, which is customary to the conditional VAEs- designed a DGDN-based decoder. However, the schematic representation in Figure 1 depicts the decoder being conditioned on the output of the auxiliary encoder $\mathcal{C}$. Authors may provide clarity on this discrepancy.

Author response:
**On the role of $c^{\prime}$ in the reconstruction task**
In *Section 4.5*, we **do not** state that the reconstruction task is not conditional on the conditioning tensor $c^{\prime}$. As it appears from *Figure 1*, and as the Reviewer notices, such reconstruction is indeed conditional on $c^{\prime}$. What we remark instead is the absence of such tensor $c^{\prime}$ **from the target** of the reconstruction task.

Reviewer comment (Theory):
How is it different to learn the purifier from the feature space of an adversarial trained classifier than learning from that of a normally trained classifier?

Author response:
**On the use of non-adversarially-trained classifiers**
Within the incipient phases of our work, we experimented with similar architectures where the classifier was trained on clean inputs only. In none of such situations (except on simpler, smaller datasets) we obtained better or comparable end-to-end adversarial accuracy, with results always significantly better *w.r.t.* the undefended model – but largely varying on a case by case basis. When a *cleanly-trained* classifier was used also for the classification of reconstructed inputs, decreased *clean* accuracy was sometimes observed – due to increased sensitivity of the classifier to noise or reconstruction artifacts. Since an adversarially-trained classifier was deemed necessary, in the end, for the classification of reconstructed data, subsequent efforts focused in the direction of the final architecture proposed. In such setting, the classifier is used also as a *featuriser* – allowing to exploit during inference the peculiarities of gradients arising as part of an adversarial attack described in *Section 4.2*. Additionally, such choice increases *end-to-end* robustness, and a more consistent *clean* accuracy across trials.