From: ICLR.cc/2023/Conference/Paper1406/Authors
title: Submission Withdrawn by the Authors

From: ICLR.cc/2023/Conference/Paper1406/Authors
title: Response to Reviewer dCrC
comment: Thanks for your review. And we have discussed our novelity on common responses [A0].

[A1] Questions about the experiments.
1. Following the experimental settings of Jia et al.[1], we also provide more baselines on Table 7 and Table 8 (Appendix), which proves the validity of our method. We achieved better or comparable results than lbgat on robust accuracy and significant advantages on clean accuracy (6.87% on CIFAR-10 and 6.83% on CIFAR-100). Also, we can combine with LBGAT to further improve the robustness.

Table 7:
New quantitative experiment on CIFAR10. "*" are the results directly quoted from [1].

|  Defense  | Clean Acc | PGD-20 Acc |C\& W-20 Acc | AA Acc|
|-|-|-|-|-|
| Vanilla AT* | 85.17| 55.08  | 53.91 | 51.69 |
| MART* | 84.17 | 58.56 | 54.58  | 51.10  |
| FAT* | **87.97** | 49.86 | 48.65 | 47.48 |
| GAIRAT* | 86.30 | **59.54**  | 45.57| 40.30|
| AWP*| 85.57| 58.13| 56.03  | 53.90|
| TRADES* | 85.72 | 56.10    | 53.87| 53.40    |
| LAS-TRADES*    | 85.24    | 57.07  | 55.45    | 54.15    |
| TRADES + Ours  | 87.07    | 58.51  | **56.81**| **54.70**|
| TRADES + LBGAT | 80.20    | 57.41  | 54.84  | 53.32  |
| TRADES + LBGAT +Ours | 86.69    | 58.04  | 56.75  | 54.47 |

Table 8:
New quantitative experiment on CIFAR100. "*" are the results directly quoted from [1].

|  Defense  | Clean Acc | PGD-20 Acc |C\& W-20 Acc | AA Acc|
|-|-|-|-|-|
| Vanilla AT*    | 60.89    | 31.69  | 30.10    | 27.86    |
| SAT*     | 62.82    | 27.17  | 27.32    | 24.57    |
| AWP*     | 60.38    | 33.86  | 31.12    | 28.86    |
| TRADES*  | 58.61    | 28.66  | 27.05    | 25.94    |
| LAS-TRADES*    | 60.62    | 32.53  | 29.51    | 28.12    |
| TRADES + Ours  | **67.47** | 34.99  | 31.61    | 28.95    |
| TRADES + LBGAT*| 60.64    | 34.75  | 30.65    | 29.33    |
| TRADES + LBGAT+ Ours | 65.40    | **35.46**     | **32.36** | **30.17** |

2. The central region of LBGAT in Figure 3 shows more interclass confusion, while ours is clearly easier to distinguish between different classes of samples.

3. Thank you for your suggestion, we will update the results with variance and mean in the future.

4. We have updated details about $L_{robust}$ on Appendix. When combined with Vanilla AT, $L_{robust} = CE(softmax(\widetilde{M}({\widetilde{X}})))$;  
when combined with LBGAT+ Vanilla AT, $L_{robust} = CE(softmax(\widetilde{M}({\widetilde{X}}))) + MSE(M({\widetilde{X}}),\widetilde{M}({\widetilde{X})})$;   
when combined with TRADES, $L_{robust} =CE(softmax(\widetilde{M}({X})))+ \beta* KL(\widetilde{M}({X}),\widetilde{M}({\widetilde{X})})$;  
and when combined with LBGAT+TRADES, $L_{robust} =MSE(M({\widetilde{X}}),\widetilde{M}({\widetilde{X})})+ \beta* KL(\widetilde{M}({X}),\widetilde{M}({\widetilde{X})})$.
[1] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy. CVPR22

From: ICLR.cc/2023/Conference/Paper1406/Authors
title: Response
comment: [A0] We have discussed our novelity on common responses [A0].

[A1] We changed it as "aligning the representations of clean data and adversarial samples or classifying the adversarial data correctly."

[A2] This is based on t-SNE in Sec 2.2, and [1] also mentioned a similar phenomenon.

[A3] Here geometric propertie means the well relationships between different samples, and which is easy to classifer a unknown sample only based on its label-known neighbors in feature space. What's more, the adversarial sample may be considered as a data augmentation of a clean sample, which is still a kind of sample within the data distribution, and therefore we believe that the conclusion of Belkin can also be applied.

[A4] "Adversarial strength" means different $\beta$ in TRADES.

[A5] The k-NN accuracy is used as the relationship score for the learned feature space. At Section 2.2, we used the clean samples of the training set and their adversarial samples (generated by PGD-20) totaling 5wX2 data as the support set to predict the class of data in the test set (clean samples and their adversarial samples, totaling 1wX2). Because KNN classifies samples based on their neighbors only, manifold learnings use it to assess the quality of dimensionality reduction (i.e., to assess the consistency of inter-sample relationships in high-dimensional space and low-dimensional space), $\alpha$ equals the K of k-NN, and we have corrected it on rebuttal version.

[A6] The LBGAT+Vanilla AT result mentioned by the Reviewer is LBGAT+ TRADES ($\beta = 0$), which generates the adversarial sample with KL loss, while the LBGAT+Vanilla AT result in our paper generates the adversarial sample with CE loss, and the difference here has a greater impact especially on the robustness.

[A7] The central region of LBGAT in Figure 3 shows more interclass confusion, while ours is clearly easier to distinguish between different classes of samples. What's more, relationships score also  certicitied our effectiness on sample-relationships.

[A8] In order to quickly compare with LBGAT we follow its experimental settings and resize the image to 32*32, while Rade et. al. does not do so, in addition, our epoch, lr and other superparameters are inconsistent. At the limit of computational resources, we will follow Rade et. al.'s experimental settings and rerun the results of Tiny ImageNet in the future.

[1] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan S Kankanhalli. Geometry-aware instance-reweighted adversarial training.

From: ICLR.cc/2023/Conference/Paper1406/Authors
title: Response to Reviewer q8J7
comment: Thanks for your review.

[A1] "Cluttered over-smoothing feature space caused by adversarial training (AT)" is based on t-SNE in Sec 2.2, and [1] also mentioned a similar phenomenon.


[A2] "Why ‘the representation visualization for AT models shows more robustness, but worse relationships among different data resulting in lower discrimination in different classes’." First, we show robust accuracy and clean accuracy on Fig. 2, adversarial training models have higher robust accuracy and lower clean accuracy. Second, t-SNE shows that compared with the standard trained model, the adversarial samples and clean samples (➕ and ● in the figure) in the feature space of the adversarial training are closer together on both the training and test sets, but the confusion between samples of different classes is more apparent, and the larger the confusion can be naturally introduced that the model will generalize less well to unknown samples.

[A3] Firstly, the adversarial training models used by t-SNE are checkpoints selected with early stopping, after which overfitting has occurred, so we believe that there is no problem with the convergence degree of this model. At the same time, we also use KNN classification accuracy as a quantitative evaluation metrics of inter-sample relationship, which also used in manifold learning.

[A4] We also provide quantitative metrics. The k-NN accuracy is used as the relationship score for the learned feature space. At Section 2.2, we used the clean samples of the training set and their adversarial samples (generated by PGD-20) totaling 5wX2 data as the support set to predict the class of data in the test set (clean samples and their adversarial samples, totaling 1w X 2). Because KNN classifies samples based on their neighbors only, manifold learnings [3,4] use it to assess the quality of dimensionality reduction (i.e., to assess the consistency of inter-sample relationships in high-dimensional space and low-dimensional space), $\alpha$ equals the K of k-NN, and we have corrected it on rebuttal version.

[A5] Table 3 in the main paper demonstrates that our algorithm has essentially the same time consumption compared to LBGAT.

Table 3: Time cost comparisons. We show the number of seconds required for different algorithms to train an epoch on one RTX 3090 GPU.

| Vanilla AT | Vanilla AT + LBGAT | Vanilla AT + Ours | TRADES | TRADES + LBGAT | TRADES + Ours |
|---------------------|-----------------------------|----------------------------|-----------------|-------------------------|------------------------|
| 821     | 848 | 849| 1079| 1106  | 1109 |

[A6] We have discussed our novelity on common responses [A0], and we will also add BIM as the baseline in the future.

[1]Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan S Kankanhalli. Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.

From: ICLR.cc/2023/Conference/Paper1406/Authors
title: Common Questions
comment: 
[Q0] The novelty.

[A0] We are motivated by the fact that adversarial training brings adversarial samples, which are far from the real category distribution, and clean samples closer together, and this process inevitably affects the representation of clean samples, thus making the overall distribution more mixed, with samples of different classes in the representation space all mixed together. Previous work was not aware of this problem and therefore did not completely avoid the negative impact of adversarial samples on the clean sample representation.

To solve this problem, we use the standard training model for localization. Considering the importance of inter-sample relations for classification and the difficulties in adversarial training optimization, we use relation distillation with relative relation preservation, thus avoiding the negative impact of adversarial samples on the representation of clean samples.

Differences with LBGAT.
1. LBGAT directly distills the logit of the standard training model, which believes that the standard training model has a better classification boundary, so it is beneficial to distill its logit directly, without realizing that the reason for its success lies in the reduction of the negative impact of the adversarial sample, so that the standard training model and the adversarial training model of LBGAT are updated simultaneously.
2. We reproduce the LBGAT and find it hard to converge, especially in combination with TRADES, while we distill the relative relationship to give more freedom on model optimization and do not encounter the hard convergence problem.
3. We are adding constraints at the feature layer, while LBGAT focuses on the logit layer, which we can combine with to further improve the model effect, and the experiments also prove this.

[Q1] Common questions about the experiments.

[A1] 1. Following the experimental settings of Jia et al.[1], we also provide more baselines on Table 7 and Table 8 (Appendix), which proves the validity of our method. We achieved better or comparable results than lbgat on robust accuracy and significant advantages on clean accuracy (6.87% on CIFAR-10 and 6.83% on CIFAR-100). Also, we can combine with LBGAT to further improve the robustness.

Table 7:
New quantitative experiment on CIFAR10. "*" are the results directly quoted from [1].

|  Defense  | Clean Acc | PGD-20 Acc |C\& W-20 Acc | AA Acc|
|-|-|-|-|-|
| Vanilla AT* | 85.17| 55.08  | 53.91 | 51.69 |
| MART* | 84.17 | 58.56 | 54.58  | 51.10  |
| FAT* | **87.97** | 49.86 | 48.65 | 47.48 |
| GAIRAT* | 86.30 | **59.54**  | 45.57| 40.30|
| AWP*| 85.57| 58.13| 56.03  | 53.90|
| TRADES* | 85.72 | 56.10    | 53.87| 53.40    |
| LAS-TRADES*    | 85.24    | 57.07  | 55.45    | 54.15    |
| TRADES + Ours  | 87.07    | 58.51  | **56.81**| **54.70**|
| TRADES + LBGAT | 80.20    | 57.41  | 54.84  | 53.32  |
| TRADES + LBGAT +Ours | 86.69    | 58.04  | 56.75  | 54.47 |

Table 8:
New quantitative experiment on CIFAR100. "*" are the results directly quoted from [1].

|  Defense  | Clean Acc | PGD-20 Acc |C\& W-20 Acc | AA Acc|
|-|-|-|-|-|
| Vanilla AT*    | 60.89    | 31.69  | 30.10    | 27.86    |
| SAT*     | 62.82    | 27.17  | 27.32    | 24.57    |
| AWP*     | 60.38    | 33.86  | 31.12    | 28.86    |
| TRADES*  | 58.61    | 28.66  | 27.05    | 25.94    |
| LAS-TRADES*    | 60.62    | 32.53  | 29.51    | 28.12    |
| TRADES + Ours  | **67.47** | 34.99  | 31.61    | 28.95    |
| TRADES + LBGAT*| 60.64    | 34.75  | 30.65    | 29.33    |
| TRADES + LBGAT+ Ours | 65.40    | **35.46**     | **32.36** | **30.17** |

2. The central region of LBGAT in Figure 3 shows more interclass confusion, while ours is clearly easier to distinguish between different classes of samples.

3. As for our analysis experiments, we use k-NN accuracy as the relationship score for the learned feature space. At Section 2.2, we use the clean samples of the training set and their adversarial samples (generated by PGD-20) totaling 5w*2 data as the support set to predict the class of data in the test set (clean samples and their adversarial samples, totaling 1w*2). Because KNN classifies samples based on their neighbors only, manifold learnings[2,3] use it to assess the quality of dimensionality reduction (i.e., to assess the consistency of inter-sample relationships in high-dimensional space and low-dimensional space), $\alpha$ equals the K of k-NN, and we have corrected it on rebuttal version.

[1] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy.

[2] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE.

[3] Leland McInnes, John Healy, and James Melville. UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction.

From: ICLR.cc/2023/Conference/Paper1406/Reviewer_q8J7
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: For adversarial training (AT), this paper introduces a viewpoint from the perspective of feature distribution and proposes a relationship preserving AT method. Through some empirical observations, this paper points out that typical AT methods produce cluttered feature representations, resulting in a decreasing of test accuracy for both clean and adversarial samples. In other words, taking the feature distribution of standard training model as one baseline, adversarial training destroys the relative relationship of neighbor (clean) examples. To alleviate this issue, this paper attempts to use the priori relationship of embedding features produced by standard model, to correct or guide the feature distribution of adversarial model during training. Experimental results indicate that the proposed flexible relationship preserving AT (FRPAT) can improve the test accuracy in term of generalization and robustness.
strength_and_weaknesses: * **Strength**: This manuscript is well organized and easy to follow. The idea of proposed FRPAT is clear. 

* **Weakness**: Overall, the argument and empirical analysis may be unconvincing enough, and the operation of the proposed method is cumbersome. 

Several main concerns are as follows:
1. The illustrations and empirical observations in this paper cannot provide enough support to the proposed FRPAT. 
    - (1) The argument about cluttered over-smoothing feature space caused by adversarial training (AT) is somewhat unconvincing.
The discussion and description in the second paragraph about the feature distribution are absolutely relied on Fig.1. However, in my opinion, Fig1 is only a conceptual assumption, which is not enough to support the authors' argument or conclusion. A better organization maybe needed. 
   - (2) The empirical analysis is not clear in section 2. 
The discussion in Section 2 is insufficient, such as, the description simply gives a conclusion that ‘the representation visualization for AT models shows more robustness, but worse relationships among different data resulting in lower discrimination in different classes’. Why? A more detailed discussion is needed. 
   - (3) According to the illustration of TRADES method in Fig2 (b), the distribution of training inputs does show a scattered situation (small plots), which seems to indicate a low discrimination of AT model. However, in general, AT is difficult to converge. In this case, it is certainly difficult to produce class-separate (discriminative) features for AT model. Therefore, this empirical visualization seems not to be a good selection to support the conclusion and some other claims, such as ‘the cluttered feature representations’, ‘the relationship between samples of the adversarial training model is worse’, ‘cluttered over-smoothing feature space’ and so on.
   - (4) Besides, the t-SNE is a reprocessing of the embedding features, it is difficult to give an actual observation of high-dimensional features. Such as we cannot confirm the setting of t-SNE is suitable to the TRADES method. Compared to the original ResNet-18, a modified model with 2D-embedding may be better to provide a reasonable visualization. 

2. It is difficult to confirm whether the benefits brought by FRPAT are enough to supplement the difficult operation of feature-level relationship preservation.
      - (1) The main idea of the proposed FRPAT is to transfer the prior knowledge of standard model to adversarial model during training. One of the main differences from the logit-level distribution consistent operation of LBGAT (Cui et al., 2021) is, FRPAT further conducts a feature-level relationship preservation between different inputs. However, compared to LBGAT, the feature-level distance measurement and selection of neighboring inputs can bring more difficult or complex operations for model training. 
     - (2) The joint training with clean and adversarial inputs has provided a very simple regularization via clean inputs. In fact, BIM (Adversarial machine learning at scale, in ICLR, 2017) has significantly improved the test accuracy of clean examples. In this paper, the empirical analysis and experiment lack a key comparison with BIM. And this raises whether the composite feature-level operation is necessary. 

clarity,_quality,_novelty_and_reproducibility: - **Clarity**:  The overall organization and presentation of this work is clear.
- **Quality**: Good.
- **Novelty**: According to the above weaknesses, the novelty of this work is incremental. 
- **Reproducibility**: It is reproducible.
summary_of_the_review: Overall, the writing and organization of this work are good. However, as discussed in the weakness, the contribution of this work is incremental and the theoretical and experimental supports for the claims are somewhat weak.
correctness: 2: Several of the paper’s claims are incorrect or not well-supported.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper1406/Reviewer_BM3U
confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
summary_of_the_paper: This paper studies the problem of improving the adversarial robustness of deep nets. The authors introduce a plug-and-play term over the adversarial training methods. The term focuses on the geometrical relationship preserving from the clean space to the adversarial space. The authors claimed by such a design, the over-smooth effect of adversarial training can be alleviated. Experiments on several datasets show that the proposed method improves over adversarial training baselines from both clean and robust accuracy. 
strength_and_weaknesses: **Strength**

[1] The method is overall easy to understand.

[2] The method serves as a plug-and-play term on several adversarial training baselines and brings some improvement in both clean and adversarial accuracy.

[3] Three datasets: CIFAR-10, CIFAR-100, and Tiny-Imagenet are used to evaluate the perforamnce.

**Weaknesses**

[1] Questionable summarization of previous adversarial training methods. The authors mentioned that the mechanism of several previous adversarial training methods is by "aligning the representations of clean data and adversarial samples". However, this is only true for the method of TRADES and its successor MART. This is not true for Madry's adversarial training, since the representation of clean data is never obtained. 

[2] "As shown in Fig. 1b, the feature representation for clean samples are influenced by adversarial training and thus resluts in cluttered over-smoothing feature space". This statement is weakly supported. The authors only used a schematic diagram to illustrate this behavior. There are neither scientific experimental observations nor solid theoretical proofs to support the heuristics provided by the authors. This brings significant doubt on whether the cases are really true. From this point, the motivation of this paper is somewhat weak. 

[3] Inappropriate criticism of previous methods. "However, these point-wise distilling models ignore the geometric properties of the feature space which is important for improving the model generaliztion (Belkin et al., 2006)." The authors didn't point out the necessity of "geometric properties" in the adversarial training setting, thus it cannot be used to claim it is a drawback of previous methods that didn't consider it. Belkin's work is applied in the semi-supervised learning setting which is different from the investigated task of this paper. Not to mention that the "geometric properties" is not mathematically defined or clearly explained. I feel very confused here about what kind of geometric properties they are and what will happen if ignoring them.

[4] What does "adversarial strength" mean? It seems not a common sense term in adversarial training literature. Therefore I am confused again about what "analyzed the correlation between the adversarial strengths and the inter-sample relationships" means. 
(I noticed later where it refers to different $\beta$s in TRADES in Section 2.2. But I believe it is a better way to clarify your terms when they first appeared.)

[5] The term "relationship score" is unclear. "the k-NN accuracy is used as the relationship score for the learned feature space." The authors also mentioned, "we use both clean and adversarial data in the training set as the support set to predict the labels of all the examples in the test set." Then I am confused about the setting here. So if I guess right, the support set contains 50k clean + 50k adversarial. Why is it called "relationship score" here? What does "relationship" mean here? "their corresponding relationship qualities for different α", what is $\alpha$? Is it a typo for $\beta$?

[6] Questionable experimental results of the comparison methods. LBGAT seems to be the closed baseline of the proposed method since these two methods share pretty a lot in common. However, it seems the reported results of LBGAT by the authors are significantly worse than the results in their original paper. LGBAT reported 88.22% for clean accuracy and 57.55% for PGD-20 robust accuracy, with the same network backbones (ResNet18 for standard training and WideResNet-34-10 for adversarial training), for CIFAR-10. However, the reported results by the authors are 86.55 and 54.34. A significant drop can be witnessed. The authors should explain the reason for this. Same thing for CIFAR-100. 

[7] The t-SNE figure in Figure 3 is somewhat hard to show the superiority of the proposed method. It is just my personal subjective opinion.

[8] The results of TinyImageNet seem questionable. All results of different methods are significantly worse than the reported results of a recent ICLR22 paper. I am curious why.

*Rade, Rahul, and Seyed-Mohsen Moosavi-Dezfooli. "Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off." International Conference on Learning Representations. 2021.*

*Typos*: 

resluts $\to$ results 

generaliztion $\to$ generalization
clarity,_quality,_novelty_and_reproducibility: **Clarity**: The authors did not clearly clarify the motivation of this paper.

**Quality**: The writing quality needs significant improvement.

**Novelty**: This method seems quite similar to LBGAT, except that LBGAT updates the standard model with geometrical regularization term which the proposed method doesn't. 

**Reproducibility**: The authors claimed "We provide core source codes in the supplementary material, and detailed experimental settings in the paper".
summary_of_the_review: The main reason for my rate is the writing of this paper. The motivation is not clearly explained. Moreover, some of the experimental results especially for the comparison method are questionable.
correctness: 1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.
technical_novelty_and_significance: 1: The contributions are neither significant nor novel.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 1: strong reject

From: ICLR.cc/2023/Conference/Paper1406/Reviewer_dCrC
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: This paper addresses the problem that adversarial training will decrease the accuracy of clean examples. In this paper, the author proposed a flexible relationship preserving adversarial training (FRPAT). Similar to standard adversarial training, FRPAT generates adversarial examples on-the-fly, and the clean example and the generated example are then optimized with standard cross entropy loss. Unlike standard adversarial training, FRPAT encourages the geometry of the adversarial feature to be similar to that of clean feature. The experiment does not fully demonstrate the effectiveness of the proposed method.
strength_and_weaknesses: Strength
(1).	The proposed idea of regularizing the feature geometry of adversarial examples and that of the clean example is interesting.
(2).	Figure 1 is clear and captures the high level idea of the work
(3).	Algorithm 1 helps the reader to understand the training details.

Weakness:
(1).	The proposed FRPAT is not effective on Cifar100, especially on the robust accuracy. Take Table 2 for example. When comparing TRADES + FRPAT (ours) with TRADES + LBGAT, we can see that LBGAT is better than the proposed method on PGD-20, C&W-20 and AA. Similar observation can also be found on Vanilla AT. 
(2).	While there are many methods to avoid the degradation of clean accuracy, the proposed FRPAT is only comparing to LBGAT in Table 1 and Table 2. For example, there is a wave of instance reweighting [a-c] for adversarial training that deals with the degradation on clean examples. It is unclear why the proposed FRPAT is not comparing to these prior works. 
(3).	It is challenging to tell whether TRADES +LBGAT or TRADES + FRPAT is better from the illustration in Figure 3.
(4).	The author is suggested to show variance of accuracy in Table 1 and Table 2. 
(5).	The writing of the paper can be further improved. For example, the author only mentioned that “Lrobust(·) stands for the adversarial training loss” without explicitly defining it. 


[a] Minseon Kim, Jihoon Tack, Jinwoo Shin, and Sung Ju Hwang. Entropy weighted adversarial train- ing. In International Conference on Machine Learning Workshop, 2021
[b] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In International Conference on Learn- ing Representations, pp. 1–29, 2021
[c] Qizhou Wang, Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, and Masashi Sugiyama. Probabilistic margins for instance reweighting in adversarial training. In Advances in Neural Information Processing Systems, pp. 1–12, 2021.

clarity,_quality,_novelty_and_reproducibility: Clairty: The writing of the paper can be further improved.

Quality: More comparison to the baseline is needed. Furthermore, the proposed method does not outperform the prior work (LBGAT) on most settings in CIFAR100, especially on the robust accuracy. For example, the result of Vanilla AT + LBGAT and TRADES + LBGAT  is similar to that of 
Vanilla AT + FRPAT and TRADES + FRPAT.

Novelty / Originality: While the high level idea of regularizing the geometry of adversarial examples and clean examples have been proposed in the prior works, the technical details proposed in this work is novel from my best understanding.

Reproducibility: Algorithm1 is clear and contains details for reproducibility. The code is provided. 

summary_of_the_review: The main concern of this paper is its effectiveness and the missing comparison to other potential baselines. Please refer to weakness section for more information.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 3: reject, not good enough