From: ICML.cc/2021/Workshop/AML/Program_Chairs
title: Paper Decision
decision: Accept (Poster)
comment: This paper proposed entropy-weighted adversarial training. The experiments show the effectiveness.

From: ICML.cc/2021/Workshop/AML/Paper76/Reviewer_sJLZ
title: The paper proposed Entropy-Weighted Adversarial Training(EWAT), which weighs the loss of each adversarial example based on its entropy of the predictive distribution.
review: The paper considered the unequal importance of each sample in Adversarial Training(AT) and pointed out that related works such as MART and GAIRAT are vulnerable to target attack(e.g. AutoAttack) although they achieve impressive robustness against untargeted PGD attacks. Noticing high-entropy samples are more vulnerable to targeted adversarial attacks, the paper proposed Entropy-Weighted Adversarial Training(EWAT), which assigns a weight to each adversarially-perturbed sample based on the entropy of its predicted distribution. The experimental results show EWAT can improve the robustness against AutoAttack. The observation is interesting and the method is novel. However, EWAT isn’t as robust as MART against untargeted PGD attack(Table 2). What’s more, it’s better to evaluate EWAT against other targeted adversarial attacks
rating: Accept
confidence: 3: The reviewer is fairly confident that the evaluation is correct