From: ICLR.cc/2023/Conference/Program_Chairs
title: Paper Decision
decision: Accept: poster
metareview:_summary,_strengths_and_weaknesses: This work proposes a new adversarial training approach where perturbations are added to the inner layers of the Transformer to affect an input's contextualized representation. Empirical experiments are run on NLU and robustness-based datasets that show the approach is effective relative to standard adversarial training.

Strengths:
* The paper analyses why simple adversarial training doesn't work for all NLP tasks.
* The proposed approach performs well on a variety of tasks.
* The paper is clearly written and easy to understand.
* The approach is well ablated in terms of cost and compared to an ensemble of the same cost.

Weaknesses:
* The improvements on BERT over the baselines (FreeLB) are partly limited (in particular MNLI and QQP). This raises concerns about which tasks the model really works for.
* The baselines (in particular FreeLB's epsilon parameter) might be undertuned leading to an unfair comparison.
* The work would benefit from a clear ablation between CreAT during pre-training and the FreeLB-style during pretraining. It's unclear how the experiment is constructed in the new result, i.e. what pretraining and finetuning procedures were used.
* The work would also benefit from showing the parameter search during finetuning.
justification_for_why_not_higher_score: The work would benefit from clearer and better-tuned baselines when ablating with FreeLB (particularly the epsilon parameter). In the new results, the pre-training and fine-tuning procedures are unclear.
justification_for_why_not_lower_score: The work has a useful contribution in showing why adversarial training doesn't work for some NLP tasks. The proposed approach itself also seems to effective on a wide variety of tasks, is well ablated and also does well against an ensemble of the same cost.
note_from_PC: if the above contains the word "oral" or "spotlight" please see: "oral" presentation means -> notable-top-5% and "spotlight" means -> notable-top-25%. As stated in our emails, we are disassociating presentation type from AC recommendations

From: ICLR.cc/2023/Conference/Paper2290/Reviewer_ANTZ
confidence: 2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: The paper proposes a new adversarial training approach in which perturbation is added to the inner layers of a deep transformer and thus affects contextualized representations. Empirical studies are conducted over a number of benchmarks with remarkable improvements to the existing AT methods. 
strength_and_weaknesses: Strength:
a new adversarial training approach that is effective over a number of tasks. 



clarity,_quality,_novelty_and_reproducibility: Clarity:
The paper is well-written and easy to follow.

Novelty:
The work brings some new ideas on how to train a robust model.

Reproducibility:
Since the datasets are public and the authors describe their algorithm clearly, it should be easy for others to implement the experiments in the work. 
summary_of_the_review: The paper discloses that existing AT methods fail to manipulate the contextual representations, and thus render inconsistent performance over different tasks. Hence, the authors consider add perturbations to inner layers of a deep transformer. 

The observations are interesting, and the proposed method is simple yet effective. The descent improvements over a variety of tasks indicate that it is worth to try the method in practice. It would be better if the authors could release their code and thus other can reproduce the results more easily. 

---------------------------------------
After reading the comments from other reviewers and the response from the authors, I agree that the improvements on BERT over the baselines are sometimes limited (e.g., on MNLI and QQP). I still feel that the idea is interesting, but also raise concerns on when or on what kind of tasks and models, the proposed method is really useful. Therefore, I slightly downgrade my rating. 
correctness: 4: All of the claims and statements are well-supported and correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 6: marginally above the acceptance threshold

From: ICLR.cc/2023/Conference/Paper2290/Reviewer_bCxQ
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: This paper studies the adversarial training problem in the NLP field.
Specifically, they focus on the contextualized representations and propose an AT algorithm that calculates the perturbations based on the contextualized representations, not just the classification losses.
They first provide an analysis exploring the loss and the similarity to back their intuition to construct representation-based adversarial training.
They conduct experiments on both NLU benchmarks and robustness-concerned datasets and prove the effectiveness of their method.

strength_and_weaknesses: Strength:
A. the paper is clearly written and easy to understand

Weakness:
A. the experimental results are not convincing enough. 
Generally, methods such as FreeLB and SMART, as well as a bunch of following adversarial training methods such as Token-Aware Virtual Adversarial Training (Li et al. 2021), adversarial training for large neural language models (Liu et al. 2020), Weighted Token-Level Virtual Adversarial Training in Text Classification (Sae-Lim et al. 2022) are exploring the effectiveness of adversarial training on general NLU tasks.
The proposed method seems only to obtain improvements on adversarial datasets as illustrated in Table 1.
The performances of methods like freeLB are lower than BERT-base results which are rather strange to me. 
Considering that the hyper-parameter setting is actually very important in the adversarial training process, I am wondering if the hyper-parameters are well-searched in all the baseline methods and the proposed methods.

B. a hyper-parameter concern.
As mentioned, the hyper-parameter setup is important in the adversarial training process, which is also well-studied in Searching for an effective defender: benchmarking defense against adversarial word substitution (Li et al. 2021) where a freeLB++ method is proposed with the perturbation range much wider than the FreeLB method.
According to the FreeLB++ method, the perturbation set to 1e-1 compared with some figures like 3e-5 or 3e-4 in the original FreeLB setup, the defense performances are significantly improved.
As the proposed CreAT method uses 1e-1 for all their experiments, I wonder whether the robustness improvement is not influenced by the contextualized representation-related term in the AT process.

clarity,_quality,_novelty_and_reproducibility: Clarity: the clarity is good, and the paper is easy to understand.
Quality: the paper is somewhat flawed since the method is well-illustrated yet the experimental results are not convincing enough.
Novelty: the idea of this paper is clear yet is somewhat trivial considering that the representation-related AT term might not be the key factor influencing the experimental results.
Reproducibility: the paper should be easy to implement.

summary_of_the_review: As mentioned in the strength and weaknesses, the paper is clear yet the experimental results seem less convincing especially since the key hyper-parameters are all fixed in all experiments.
I suggest a more detailed hyper-parameter search and analysis which could significantly improve the soundness of the proposed method.
correctness: 2: Several of the paper’s claims are incorrect or not well-supported.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper2290/Reviewer_Vm6d
confidence: 2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: This paper studies adversarial training for pretrained NLP models. In adversarial training for NLP, perturbations are applied to the input word embeddings -- such that the prediction changes. The authors investigate this and find that while it sometimes helps, it hurts many tasks, most notably a 3.4 points drop on HellaSWAG.

Investigating this further, the authors propose a new method called CreAT, where the idea is that a perturbation must not only change the model's prediction, but also push away the contextualized representation from the unperturbed state. Experiments show that it enables BERT-like models to be finetuned better.
strength_and_weaknesses: Strengths:
* The analysis about how simple adversarial training doesn't work on all NLP tasks seems important for the community to know about. It seems like a good corollary to Vision results that say there is an explicit tradeoff between robustness and performance (Madry et al 2018), and NLP results showing that it is effective on some tasks (Jiang et al 2020, Zhu et al 2020, Wang et al 2021 as in the paper). The NLP results might be cherry-picked and perhaps misleading to readers.
* The approach seems to work well on a variety of different tasks.

Weaknesses:
* Conventional wisdom is that BERT was an undertrained model. I'm glad DeBERTa large was tried too, but I'm curious as to whether this same result would hold on e.g. RoBERTa Base.
* I'd like to see some analysis as to the cost of running CreAT / AT for a finetuning task (e.g. HellaSwag.) For instance, if CreAT is K times more expensive than conventional finetuning (I'm not sure I know the exact K) -- is it better to do adversarial training or ensemble together K models? Future work might make these approaches more efficient, but I think this analysis would be nonetheless important for practitioners.
* I'd be curious as to how well the model does if only the new contextualized-representation perturbation is factored in. A reasonable question would be whether this is what's really important for pretrained language models during finetuning.
clarity,_quality,_novelty_and_reproducibility: This paper is not the clearest written, but I will try not to factor that into my review. I believe the approach is novel but I am not an expert in the adversarial robustness area.
summary_of_the_review: I'm slightly leaning towards accepting this paper, but I'd like to see a bit more contextualization of the cost of adversarial training, and how important the novel contextualized-representation-perturbation is. If those concerns are addressed I'd be happy to increase my score in revision.

---
Update post-author response: updating my score from 6->8.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 8: accept, good paper