We are grateful to Reviewer M88c for bringing to our notice certain issues. We are also delighted that reviewer M88c finds our paper sound and interesting. Below we include our detailed response.

Response to concerns

1. The use of the terms ‘white-box’ and ‘black-box’ attacks in the introduction of the paper has been clarified to reflect their significance.
2. While we agree that just saying ‘we conducted white-box attacks’ is not enough, we would like to strongly emphasize the fact that we are indeed conducting direct gradient-based attacks, where the adversary has access to the model’s exact gradients across time. This is in contrast to the inexact and indirect gradient-based attacks carried out on Deep Equilibrium Models, which has been discussed in detail in section 2.2. More specifically, we evaluate the gradient of the loss term with respect to the input to compute the perturbation to the images. We thank the reviewer once again for pointing this issue in our writing and we modified section 3.1 and section 3.3 to include details of our attacks, which we hope would improve the readability of the paper.
3. There have been several works in the ICLR community that highlight the growing concern of computational complexity of adversarial training, particularly as model size continues to grow. As pointed out in [R1,R2], adversarial training is not just computationally expensive, it often does not generalize to attacks that are different from the ones that the models were trained on. Hence the search for simpler approaches, that are able to generalize their robustness to multiple forms of attacks, is gaining importance. Thus we anticipate that generalized robust models of the future would often be known for their simple implementations, and we hope our work serves as a stepping stone for such models.

[R1] Wong, Eric, Leslie Rice, and J. Zico Kolter. "Fast is better than free: Revisiting adversarial training." International Conference on Learning Representations. 2019.

[R2] Shafahi, Ali, et al. "Adversarial training for free!." Advances in Neural Information Processing Systems 32 (2019).

We thank Reviewer GSeC for their detailed feedback and their critical assessment of the paper. Here we address reviewer GSeC’s concerns in detail.

Response to concerns

1. We agree with the reviewer that it is unclear what loss function is used to train and attack the EP model, and that this information is important for accurately assessing the robustness of EP to adversarial attacks. Cross-entropy loss is used to train and attack all models tested here, including EP. As a result, we believe the experiments are sound because we are training and attacking EP the same way as all other models, which is the standard way to train and attack deep neural network classifiers in general. We will add these details in the main text to ensure that this is clear.
2. We admit that details on carrying out white-box attacks are not straightforward and are grateful to reviewer GSeC for pointing this out. As a result, we are moving the section on temporal projected gradient descent from the appendix to the methods section 3.2.
3. Describing EBM in detail
   • We are including clarifying sections in the methods section which explains how predictions are made by models trained with Equilibrium Propagation.
   • The training cost of such models are discussed in section 4.2. As of the time of writing this paper, EP has only been able to scale to ImageNet32 [R1] and takes exponentially more time and computational resources to attack, when implemented on standard GPU based hardware. Our implementations offer a speedup of 30% as discussed in section 4.2, which was one of the major reasons we were able to carry out gradient-based attacks in a reasonable amount of time.
4. The implemented model architecture is kept simple because it is expensive to train on standard hardware. As the world starts moving towards non-standard spiking hardware, such models will become the more efficient alternative. We are confident that these would scale to more complex architectures / problems as previous work by Laborieux et al. [R1] have shown that even such small models perform well across various complex tasks (CIFAR 10, CIFAR100, and ImageNet-32).

Answers to Questions by Reviewer GSeC

1. Severity of natural noise is described in the paper that introduced the CIFAR10-C dataset [R2], which is a standard benchmark used to evaluate robustness to natural noise.
2. We admit to the fact that attacked images in Figure 5 may not always appear as “deer” to our readers. To this end, we are including a collage of images from multiple classes bearing perturbations in the appendix, to convince our readers that perturbations in EP are not limited to the background.
3. Minor comments
   • We apologize for the use of sections instead of using /appendix in the paper. We thank reviewer GSeC for pointing out this error. We have fixed this issue in our paper.
   • We are grateful to reviewer GSeC for pointing out the fact that the plots of EP should be rendered above the lines corresponding to robust accuracies of other models.

[R1] Laborieux, Axel, and Friedemann Zenke. "Holomorphic equilibrium propagation computes exact gradients through finite size oscillations." Advances in Neural Information Processing Systems 35 (2022): 12950-12963.

[R2] Hendrycks, Dan, and Thomas Dietterich. "Benchmarking Neural Network Robustness to Common Corruptions and Perturbations." International Conference on Learning Representations. 2018.

We thank Reviewer 8aDx for their detailed feedback and their critical assessment of the paper. Here we address reviewer 8aDx’s concerns in detail.

Response to concerns

1. We added a table summarizing the results of all adversarial attacks against all models tested. Results for EP are presented separately, at the end of the table, for each of the attacks. The best performing robust accuracies for each epsilon has been highlighted and comparison with EP shows that EP performs as good as the adversarially trained models for moderate attacks.

2. We would like to address the concerns about novelty in terms of our approach.Energy-based models are a class of AI models that learn through local learning rules and the limited previous work that exists, has only focused on different training techniques and architectures but has not addressed the robustness of these models. We were the first to show the inherent robustness of models trained with Equilibrium Propagation, through an ensemble of attacks where the gradient-based attacks were carried out exactly. As a result, we believe the novelty and contribution of the results is more than marginal.

3. We have added detailed procedure on attacking the EBM model and renamed section 3.1 to clearly reflect our contributions

4. We add an additional section into the appendix of the paper where we provide an intuitive discussion of where the robustness comes from (energy landscape of the EBM). We leave thorough theoretical analysis for future work.

5. We do not anticipate our results would change very much under different data modalities. However, this is outside of the scope of this work, which was to test the robustness of existing EP models (which have been applied only to image classification in previous works). We do agree that this is a good suggestion for future work, though.

We thank you again for your valuable feedback. Please let us know if the above explanations do not address your concerns completely. We are happy to answer any further questions.

We thank Reviewer QZD5 for their insightful feedback and their efforts in pointing out the grammatical issues. We are encouraged that Reviewer QZD5 finds our approach pioneering and capable of leading to multiple follow-up works, this is indeed the kind of reception we hoped for. Below we address Reviewer QZD5's concerns in detail and provide additional experimental results.

Responses to concerns

1. We have indeed conducted the AA attack and presented our results in Figure 4 in the original submission. We also conducted C&W attacks across all models and have added the results in the appendix. However, we would like to discuss a few details on FGSM and C&W.
   • FGSM is a 1-step version of PGD and thus superseded by both PGD and AA, which we use in other experiments and have presented in the results section of the original submission. Many other previous works have also illustrated that PGD attacks provide a much better test of a model’s robustness relative to FGSM. For all of these reasons, we believe it is unnecessary to include FGSM attacks in our experiments.
   • We agree with the reviewer that the inclusion of C&W attacks would provide a more thorough evaluation of EP’s robustness, and we thank the reviewer for this suggestion. We have included results from a C&W attack in the modified submission. Under these C&W attacks, EP is one of the most robust models, even more than the adversarially trained models, for the CIFAR-100 dataset.
2. We appreciate your comment about our work lacking theoretical analysis. We added a section in the appendix that provides intuitive analysis and hypothesis of why EBM models are more resistant to adversarial attacks as opposed to traditional training methods and we leave a thorough theoretical approach for future work.

Answers to questions by Reviewer QZD5

1. There are no pooling layers following the fully connected layers, so the second term on the right side does not contain any pooling terms.
2. Weight update rules are provided in the supplementary section of the original paper[R1].
3. For a hyperparameter search, one has to check the state of the system after activations have been applied and make sure the value of the states post-activation are not zeroed.
4. We are very grateful to you for pointing out the editorial issues and we have made sure that the paper is grammatically consistent and easier to read.

Thank you again for your time and effort in reviewing our paper! We believe your suggestions have strengthened our paper greatly. Please let us know if the above explanations do not address your concerns completely. We are happy to answer any further questions.

[R1] Laborieux, Axel, et al. "Scaling equilibrium propagation to deep convnets by drastically reducing its gradient estimator bias." Frontiers in neuroscience 15 (2021): 633674.