From: ICML.cc/2021/Workshop/AML/Program_Chairs
title: Paper Decision
decision: Accept (Poster)
comment: This paper proposed a novel idea in adversarial training. The experiments are solid.

From: ICML.cc/2021/Workshop/AML/Paper44/Reviewer_epn2
title: It is a novel work in adversarial training which uses the worst-case samples from the combination of multiple semantic attacks
review: This paper is well organized and the expression is clear.

This paper proposes a novel idea in adversarial training that adversarial samples are generated by both multiple semantic transformations and an $l_\infty$ threat model. This paper not only optimizes each attack models but also optimizes the order of them. This method significantly improves robust accuracy on attack models compared to sota adversarial training methods.

The experiments are solid in the comparison with existing adversarial training methods, while they are only conducted on CIFAR-10, which might weaken the effectiveness of the conclusions.

I’m confused by the notation $A$ in equation (2). Is $A$ a list composed by $N$ attacks selected from $\Omega_A$? This is necessary to be mentioned in your paper.

rating: Accept
confidence: 4: The reviewer is confident but not absolutely certain that the evaluation is correct