CAT: Collaborative Adversarial Training

• The proposed method is trivial and not novel, it is just a modified version of TRADES.
• Lack of explanations about why such a modification of TRADES can lead to an improvement in performance.
• Lack of comparisons to the ensemble methods since ensemble methods are very relevant to the proposed method.
• The improvement seems negligible compared with AWP. The paper does not provide the previous SOTA method TRADES+AWP, which is reported to achieve an adversarial accuracy of $56.17\\%$ (under AutoAttack) in the original paper of AWP. Compared with TRADES, CAT improves the adversarial accuracy to $54.2\\%$, while AWP improves to $56.17\\%$, which is much better than CAT. Given the existence of AWP, adding CAT only improves the adversarial accuracy to $56.61\\%$, where the improvement is no more than $0.5\\%$, so I think there is no necessity to combine CAT with AWP, we can use AWP, since CAT leads to additional computations.
• The paper reports the best of the two in CAT models as the performance of CAT, however, in practice, how do you choose which model to use? The paper lacks discussions on this point.

1. One of the main drawbacks of the proposed approach is that it fails to convince that the collaboration always picks the best from the participating adversarial training methods. This is a general issue in any fusion-based approach. Given that the individual adversarial training methods have nontrivial prediction discrepancy, how does the proposed framework ensure that the collaboration always picks the best from individual methods?
2. From Figure $3$, it is clear that the proposed CAT framework is not very effective. For instance, for the model trained using TRADES, the gain in the adversarial accuracy (across $3$ different adversaries) is not more than $1$%. Notably, the peak performance occurs at a relatively lower value of $\alpha$. Furthermore, the performance appears to degrade swiftly. Observing the ablation results beyond $\alpha=0.2$ would have been complete. Similarly, for the model trained using AT (red curve), the maximum performance gain from the proposed collaboration is about $1$% (that too against the simplest of adversarial attacks, FGSM).
3. This observation can also be derived from Tables $1$ and $2$. The maximum gain from the proposed collaboration against the strongest adversarial attack (AA; best checkpoint) is not even $3$%.
4. Experiments to compare against the SOTA (Table $4$) also reveal a similar picture. Improvement of the proposed CAT over the AT+tricks is less than $.5$%; AWP improves the performance of CAT, that too only about $2$%.
5. Since the main contribution of the draft is strongly intuitive, it needs to be supported by strong experiments. However, the experimental evaluation presented in the draft considers relatively simpler datasets (CIFAR). The object recognition models trained on the ILSVRC would have strengthened the experimental evaluation.

• I am conerned with the writing clarity of the paper. There are numerous issues with in Section 3.

  1. The argmax in Eqt 1 should be max instead, because the argmax is an input image, not a scalar loss value. The notations for x^adv_AT, x^adv_TRADES is also not particularly rigorous as it does not make the dependence on the underlying functions f_\theta, g_\theta explicit.
  2. Similarly, without a set of clear notations, Eqt 6 is very confusing. Which version of L_TRADES are we referring to here? For f or for g?
  3. Also, in 3.2 f is used to denote the network trained by AT. But if we add adversarial examples generated by g into the training of f, then f is no longer than the same as the f that we would obtain by vanilla AT. So what exactly are we trying to do in Figure 2? Without precise notations it is very difficult to understand or reproduce the method properly.

• What is ALP and AWP referred to in the paper? They are used directly without a reference or the non-abbreviated form. If ALP is adversarial logit pairing, there have been doubts on whether the model is truly robust (see paper below). Then why are the CAT models trained with ALP performing so well?

Evaluating and Understanding the Robustness of Adversarial Logit Pairing Engstrom et al https://arxiv.org/pdf/1807.10272.pdf

1. The paper presents an important observation, but it fails to explain the cause for this prediction discrepancy. Further, it fails to explain why prediction discrepancy affects adversarial robustness. A thorough analysis of the observation is missing, such as (a) prediction discrepancy for models obtained via different runs for a given training method, and (b) analysis at the category level.
2. For CIFAR-10, the improvement in the robustness is not significant when compared with TRADES (table-2) and TRADES-AWP [1] (comparison is missing in table-4).
3. Minor: Mention the values of hyperparameters of TRADES and ALP. Provide references for the methods compared in Table 4.

[1] Wu, Dongxian, Shu-Tao Xia, and Yisen Wang. "Adversarial weight perturbation helps robust generalization." Advances in Neural Information Processing Systems 33 (2020): 2958-2969.