Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
While deep learning has led to remarkable results on a number of challenging problems, researchers have discovered a vulnerability of neural networks in adversarial settings, where small but carefully chosen perturbations to the input can make the models produce extremely inaccurate outputs. This makes these models particularly unsuitable for safety-critical application domains (e.g. self-driving cars) where robustness is extremely important. Recent work has shown that augmenting training with adversarially generated data provides some degree of robustness against test-time attacks. In this paper we investigate how this approach scales as we increase the computational budget given to the defender. We show that increasing the number of parameters in adversarially-trained models increases their robustness, and in particular that ensembling smaller models while adversarially training the entire ensemble as a single model is a more efficient way of spending said budget than simply using a larger single model. Crucially, we show that it is the adversarial training of the ensemble, rather than the ensembling of adversarially trained models, which provides robustness.
 The paper proposes to train an ensemble of models jointly, where the coupling lies in that at each time step, a set of examples that are adversarial for the ensemble itself is incorporated in the learning. The experiments are thorough and compare multiple types of attacks, although they are all based on gradients (while the paper does mention recent attacks that do not rely on gradients so much). The results are rather convincing and show a clear difference between the proposed method and independently training the models of the ensemble (even if each one is training with examples adversarial to itself). The paper is clear and well-written. Pros: - The superior performance of the proposed method - The method is simple and thus could have a practical impact - Clear and thorough analysis Cons: - Only gradient based attacks (which are somewhat criticized in the introduction) - Novelty may be a bit limited: this is a rather small variation on existing stuff (but it works rather well) Remarks: - Fig 2c could use the same line styles and order as Fig 2a/2b - "a gap 7 accuracy"?
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
While deep learning has led to remarkable results on a number of challenging problems, researchers have discovered a vulnerability of neural networks in adversarial settings, where small but carefully chosen perturbations to the input can make the models produce extremely inaccurate outputs. This makes these models particularly unsuitable for safety-critical application domains (e.g. self-driving cars) where robustness is extremely important. Recent work has shown that augmenting training with adversarially generated data provides some degree of robustness against test-time attacks. In this paper we investigate how this approach scales as we increase the computational budget given to the defender. We show that increasing the number of parameters in adversarially-trained models increases their robustness, and in particular that ensembling smaller models while adversarially training the entire ensemble as a single model is a more efficient way of spending said budget than simply using a larger single model. Crucially, we show that it is the adversarial training of the ensemble, rather than the ensembling of adversarially trained models, which provides robustness.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 The paper proposes to train an ensemble of models jointly, where the coupling lies in that at each time step, a set of examples that are adversarial for the ensemble itself is incorporated in the learning. The experiments are thorough and compare multiple types of attacks, although they are all based on gradients (while the paper does mention recent attacks that do not rely on gradients so much). The results are rather convincing and show a clear difference between the proposed method and independently training the models of the ensemble (even if each one is training with examples adversarial to itself). The paper is clear and well-written. Pros: - The superior performance of the proposed method - The method is simple and thus could have a practical impact - Clear and thorough analysis Cons: - Only gradient based attacks (which are somewhat criticized in the introduction) - Novelty may be a bit limited: this is a rather small variation on existing stuff (but it works rather well) Remarks: - Fig 2c could use the same line styles and order as Fig 2a/2b - "a gap 7 accuracy"?
assistant
 The paper proposes to train an ensemble of models jointly, where the coupling lies in that at each time step, a set of examples that are adversarial for the ensemble itself is incorporated in the learning. The experiments are thorough and compare multiple types of attacks, although they are all based on gradients (while the paper does mention recent attacks that do not rely on gradients so much). The results are rather convincing and show a clear difference between the proposed method and independently training the models of the ensemble (even if each one is training with examples adversarial to itself). The paper is clear and well-written. Pros: - The superior performance of the proposed method - The method is simple and thus could have a practical impact - Clear and thorough analysis Cons: - Only gradient based attacks (which are somewhat criticized in the introduction) - Novelty may be a bit limited: this is a rather small variation on existing stuff (but it works rather well) Remarks: - Fig 2c could use the same line styles and order as Fig 2a/2b - "a gap 7 accuracy"?