Paper: Doubly Robust Instance-Reweighted Adversarial Training (ICLR-2024)

Reviewer comment (Evaluation):
The improvements on PGD and AutoAttack seem to be less significant. The more significant improvements are observed from RA-Tail-30. Therefore, it is necessary to provide more details of the evaluation protocol for RA-Tail-30.

Author response:
Many thanks for this useful comment! As we discuss in the introduction, a critical limitation of the conventional AT method is that it suffers a severe non-uniform performance across the empirical distribution. For example, while the average robust performance of the AT method on the CIFAR10 dataset can be as high as 49%, the robust accuracy for the weakest class is as low as 14%, which depicts a huge disparity in robust performance across different classes. So based on this critical remark, we propose the RA-Tail-30 metric which represents the robust performance (i.e., RA-PGD) on the 30% most vulnerable classes, and hence can be seen as a proxy measure of the robustness against attacks on the most vulnerable data points.

Reviewer comment (Experiments):
Since the advantage is mainly demonstrated at the imbalanced dataset, the current evaluations on Imbalanced datasets (CIFAR10 and SVHN imbalanced) are not enough for analyzing the performance breakpoint.

Author response:
Many thanks for the suggestion! We've conducted new experiments on more diverse imbalance degrees on the CIFAR10 and SVHN datasets. We report the empirical results below. 
| Dataset & Ratio | Method |   SA   | RA-PGD | RA-Tail-30 |
|:---------------:|:------:|:------:|:------:|:----------:|
| **CIFAR10 r=0.1**   |   AT   |  61.8  |  41.3  |     3.1    |
|                 |  ours  | **70.5** | **44.9** |   **11.2**   |
| **CIFAR10 r=0.2**   |   AT   | 69.74  | 42.37  |    6.25    |
|                 |  ours  | **74.2** | **48.3** |   **17.2**   |
| **CIFAR10 r=0.5**   |   AT   |   77   |  47.2  |    16.2    |
|                 |  ours  | **78.8** | **54.4** |   **27.8**   |
| **SVHN r=0.1**      |   AT   |  82.5  |  45.4  |    28.4    |
|                 |  ours  | **82.7** | **48.2** |   **30.6**   |
| **SVHN r=0.2**      |   AT   |  88.5  |  51.1  |    33.7    |
|                 |  ours  | **88.9** | **55.9** |   **41.1**   |
| **SVHN r=0.5**      |   AT   | **91.6**  |  55.2  |    42.7    |
|                 |  ours  |  91.3  | **62.5** |   **47.9**   |

Again, we thank the reviewer for the suggestions and we will do our best to include even more results related to this aspect in our final version.

Reviewer comment (Experiments):
Comparisons with more recent adversarial training methods are missing.

Author response:
Many thanks for the suggestions! We have conducted new experiments to compare with [1] published in ICML’23, which is the most recent adversarial training SOTA. Note that [1] is a diffusion-based defense method and falls under a category of new models that boost the performance of adversarial defense using self-supervised learning on tens of millions of additional synthetic images. For example [1] uses the latest SOTA diffusion model to generate tens of millions of synthetic images for CIFAR10 to boost the adversarial robustness. 
We've conducted a new experiment using 1 million images generated for CIFAR10 by the same diffusion model as in [1]. Using this, our DONE-GD algorithm achieves 86.65% SA and 60.74% AA for the Resnet18 model. As a comparison, [1] achieves 86.42% SA and 58.51% AA. We will include those results in our final revision.

Reviewer comment (Experiments):
It is encouraged to make comparisons with more recent adversarial training methods.

Author response:
Many thanks for the suggestions! We have conducted new experiments to compare with [1] published in ICML’23, which is the most recent adversarial training SOTA. Note that [1] is a diffusion-based defense method and falls under a category of new models that boost the performance of adversarial defense using self-supervised learning on tens of millions of additional synthetic images. For example [1] uses the latest SOTA diffusion model to generate tens of millions of synthetic images for CIFAR10 to boost the adversarial robustness. 
We've conducted a new experiment using 1 million images generated for CIFAR10 by the same diffusion model as in [1]. Using this, our DONE-GD algorithm achieves 86.65% SA and 60.74% AA for the Resnet18 model. As a comparison, [1] achieves 86.42% SA and 58.51% AA. We will include those results in our final revision.

Reviewer comment (Experiments):
Experiments on more diverse imbalance degrees are necessary for more comprehensive evaluation.

Author response:
Many thanks for the suggestion! We've conducted new experiments on more diverse imbalance degrees on the CIFAR10 and SVHN datasets. We report the empirical results below. 
| Dataset & Ratio | Method |   SA   | RA-PGD | RA-Tail-30 |
|:---------------:|:------:|:------:|:------:|:----------:|
| **CIFAR10 r=0.1**   |   AT   |  61.8  |  41.3  |     3.1    |
|                 |  ours  | **70.5** | **44.9** |   **11.2**   |
| **CIFAR10 r=0.2**   |   AT   | 69.74  | 42.37  |    6.25    |
|                 |  ours  | **74.2** | **48.3** |   **17.2**   |
| **CIFAR10 r=0.5**   |   AT   |   77   |  47.2  |    16.2    |
|                 |  ours  | **78.8** | **54.4** |   **27.8**   |
| **SVHN r=0.1**      |   AT   |  82.5  |  45.4  |    28.4    |
|                 |  ours  | **82.7** | **48.2** |   **30.6**   |
| **SVHN r=0.2**      |   AT   |  88.5  |  51.1  |    33.7    |
|                 |  ours  | **88.9** | **55.9** |   **41.1**   |
| **SVHN r=0.5**      |   AT   | **91.6**  |  55.2  |    42.7    |
|                 |  ours  |  91.3  | **62.5** |   **47.9**   |

Again, we thank the reviewer for the suggestions and we will do our best to include even more results related to this aspect in our final version.

Reviewer comment (Evaluation):
The computational analysis is missing.

Author response:
Thanks for the comment! Compared to the conventional AT method, only the Jacobian-vector product computation due to bilevel optimization may cause additional compute burden. However, in terms of time and memory complexity it is a known fact from automatic differentiation that computing a Jacobian-vector product has order-wise (up to a constant) the same time and space complexity of gradient computation when reverse-mode automatic differentiation is employed (please see [Griewank 08’] or  [Baydin 15’] for a shorter version). 

Moreover, we also conducted additional experiments that use a first-order approximation of our hypergradient estimator (i.e., we ignore the second part of the hypergradient $\nabla L(\theta)$ that contains the second-order computation due to bilevel optimization). We found that our algorithm still maintains the same performance level while achieving exactly the same running-time as standard AT. For example on the CIFAR10, we obtain for the DONE-GD algorithm: 83.13% SA and 57.28% RA-PGD. These new results suggest that the instance weights optimization using DRO is in fact the most important feature of our algorithm. We will include more results about these findings in our revision.

Reviewer comment (Theory):
It is better to discuss the justifiability of Assumption 1-3 for AT problem.

Author response:
Thanks for the suggestion! Assumptions 1-3 are standard assumptions widely adopted in bilevel optimization literature [Ji ‘21; Grazzi ‘20]. Specifically, Assumption 3 characterizes the variance of cost function over data samples, which is typically bounded. Assumptions 1-2 require the Lipschitzness of the objective function and its first- and second-order derivatives, which is crucial for analyzing convergence performance of bilevel optimization.

Reviewer comment (Evaluation):
The SA performance is a weakness of the proposed method. It is better to explain this limitation.

Author response:
This is indeed an important comment! Yes, while our approach generally improves the robust performance, it did not improve the SA (but it still has comparable SA performance with the other baselines). In order to further investigate this in terms of the overall performance (i.e., SA-RA tradeoff) of our approach, we have run new experiments with evaluations on 70% clean-30% adversarial, 50% clean-50% adversarial; 30% clean-70% adversarial; and all are randomly i.i.d. chosen. This captures the practical real world scenarios where only fractions of the input data are attacked. We provide the experimental results for the CIFAR10 dataset below.  Note that Xc-Ya means performance on  X% clean and Y% adversarial. 

| method | 0c-100a | 30c-70a | 50c-50a | 70c-30a| 100c-0a |
| --- | --- | --- | --- | -- | -- |
| Ours | 57.46 | 65.41 | 70.15 | 75.38 | 83.41|
| AT | 49.29 | 59.33 | 66.02 | 72.29 | 82.1 |

We found that our method is still able to interpolate on the good decent standard and robust accuracy. We thank the reviewer for bringing this up and will include those discussions in our final revision.

Reviewer comment (Evaluation):
It is better to add some statistical analyses like P-values, CIs, effect sizes, and so on.

Author response:
We thank the reviewer for the useful suggestions! We’ve run the CIFAR10 experiments 10 times for our method and the AT method and used the t-test to compute the p-value for each of the metrics SA, RA-PGD, and RA-Tail-30. 

| Metric     | Our        | AT        | P-value        |
|------------|-------------------|------------------|----------------|
| SA         | 83.45 (±0.51)     | 82.86 (±0.47)    | 0.039          |
| RA-PGD     | 57.69 (±0.36)     | 48.96 (±0.49)    | 1.525e-13      |
| RA-Tail-30 | 40.22 (±0.43)     | 28.20 (±0.31)    | 1.536e-14      |

Note that the p-value measures the significance of the advantage of our method compared to AT. The lower the p-value, the higher significance of our advantage over AT. 
Clearly in the above table, these results (all p-values less than 0.05) show that our method has a meaningful and consistent performance advantage over the AT method across these metrics for this dataset. We will do our best to include more statistical metrics in our final revision.