Multi-way Encoding for Robustness to Adversarial Attacks
Deep models are state-of-the-art for many computer vision tasks including image classification and object detection. However, it has been shown that deep models are vulnerable to adversarial examples. We highlight how one-hot encoding directly contributes to this vulnerability and propose breaking away from this widely-used, but highly-vulnerable mapping. We demonstrate that by leveraging a different output encoding, multi-way encoding, we can make models more robust. Our approach makes it more difficult for adversaries to find useful gradients for generating adversarial attacks. We present state-of-the-art robustness results for black-box, white-box attacks, and achieve higher clean accuracy on four benchmark datasets: MNIST, CIFAR-10, CIFAR-100, and SVHN when combined with adversarial training. The strength of our approach is also presented in the form of an attack for model watermarking, raising challenges in detecting stolen models.
 This paper argues that a random orthogonal output vector encoding is more robust to adversarial attacks than the ubiquitous softmax. The reasoning is as follows: 1. different models that share the same final softmax layer will have highly correlated gradients in this final layer 2. this correlation can be carried all the way back to the input pertubations 3. the use of a multi-way encoding results in a weaker correlation in gradients between models I found (2) to be a surprising assumption, but it does seem to be supported by the experiments. These show a lower correlation in input gradients between models when using the proposed RO encoding. They also show an increased resiliance to attack in a number of different settings. Overall, the results seem to be impressive. However, I think the paper would be a lot stronger if there was a more thorough investigation of the correlation between gradients in all layers of the models. I did not find the discussion around Figure 1 to be very compelling, since it is only relevant to the encoding layer, while we are only interested in gradients at the input layer. The correlation numbers in Table 2 are unexpected and interesting. I would like to see a deeper investigation of these correlations. I am not familiar with the broader literature in this area, so giving myself low confidence.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Multi-way Encoding for Robustness to Adversarial Attacks
Deep models are state-of-the-art for many computer vision tasks including image classification and object detection. However, it has been shown that deep models are vulnerable to adversarial examples. We highlight how one-hot encoding directly contributes to this vulnerability and propose breaking away from this widely-used, but highly-vulnerable mapping. We demonstrate that by leveraging a different output encoding, multi-way encoding, we can make models more robust. Our approach makes it more difficult for adversaries to find useful gradients for generating adversarial attacks. We present state-of-the-art robustness results for black-box, white-box attacks, and achieve higher clean accuracy on four benchmark datasets: MNIST, CIFAR-10, CIFAR-100, and SVHN when combined with adversarial training. The strength of our approach is also presented in the form of an attack for model watermarking, raising challenges in detecting stolen models.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper argues that a random orthogonal output vector encoding is more robust to adversarial attacks than the ubiquitous softmax. The reasoning is as follows: 1. different models that share the same final softmax layer will have highly correlated gradients in this final layer 2. this correlation can be carried all the way back to the input pertubations 3. the use of a multi-way encoding results in a weaker correlation in gradients between models I found (2) to be a surprising assumption, but it does seem to be supported by the experiments. These show a lower correlation in input gradients between models when using the proposed RO encoding. They also show an increased resiliance to attack in a number of different settings. Overall, the results seem to be impressive. However, I think the paper would be a lot stronger if there was a more thorough investigation of the correlation between gradients in all layers of the models. I did not find the discussion around Figure 1 to be very compelling, since it is only relevant to the encoding layer, while we are only interested in gradients at the input layer. The correlation numbers in Table 2 are unexpected and interesting. I would like to see a deeper investigation of these correlations. I am not familiar with the broader literature in this area, so giving myself low confidence.
assistant
 This paper argues that a random orthogonal output vector encoding is more robust to adversarial attacks than the ubiquitous softmax. The reasoning is as follows: 1. different models that share the same final softmax layer will have highly correlated gradients in this final layer 2. this correlation can be carried all the way back to the input pertubations 3. the use of a multi-way encoding results in a weaker correlation in gradients between models I found (2) to be a surprising assumption, but it does seem to be supported by the experiments. These show a lower correlation in input gradients between models when using the proposed RO encoding. They also show an increased resiliance to attack in a number of different settings. Overall, the results seem to be impressive. However, I think the paper would be a lot stronger if there was a more thorough investigation of the correlation between gradients in all layers of the models. I did not find the discussion around Figure 1 to be very compelling, since it is only relevant to the encoding layer, while we are only interested in gradients at the input layer. The correlation numbers in Table 2 are unexpected and interesting. I would like to see a deeper investigation of these correlations. I am not familiar with the broader literature in this area, so giving myself low confidence.