Deep models are state-of-the-art for many computer vision tasks including image classification and object detection. However, it has been shown that deep models are vulnerable to adversarial examples. We highlight how one-hot encoding directly contributes to this vulnerability and propose breaking away from this widely-used, but highly-vulnerable mapping. We demonstrate that by leveraging a different output encoding, multi-way encoding, we can make models more robust. Our approach makes it more difficult for adversaries to find useful gradients for generating adversarial attacks. We present state-of-the-art robustness results for black-box, white-box attacks, and achieve higher clean accuracy on four benchmark datasets: MNIST, CIFAR-10, CIFAR-100, and SVHN when combined with adversarial training. The strength of our approach is also presented in the form of an attack for model watermarking, raising challenges in detecting stolen models.
This paper argues that the vulnerability of classifiers to (black-box) adversarial attacks stems from the use of a final cross-entropy layer trained on one-hot labels. The authors propose replacing this layer by encoding each label as a high-dimensional vector and then training the classifier to minimize the L2 distance of the classifier output from the encoding of the correct class. While the approach is interesting and the paper well-written, both the motivation and the experimental evaluation is insufficient. Hence I consider it below the ICLR bar.
I find the approach weakly motivated. The argument in Figure 1 is very hand-wavy with no clear experimental or theoretical support. The authors argue that cross-entropy with one hot labels causes gradient correlation in the last layer and this propagates all the way through the network (bottom of page 3) but there are no experiments supporting this conjecture.
Moreover, the approach is not fundamentally different from standard networks with cross-entropy training. One can consider adding an extra layer (with number of neurons equal to the encoding vector dimensions) and keeping the weights of these neurons fixed (the output weights are essentially the encoding dictionary). Then training with cross-entropy is increasing the inner product with these vectors. This is qualitatively very similar to the proposed approach of this paper. Is there a benefit from explicitly considering the encoding vectors? 
Moreover, why is the length of the encoding vectors important from a conceptual point of view? As far as I can tell, this is simply encouraging the output of the network to be large in norm. This could be leading to gradient masking, similar to the phenomena observed for defensive distillation.
I find the proposed approach to watermark evasion interesting. However I consider it orthogonal to the rest of the results so it is hard to consider it as a contribution to the main point of the paper.
Figure 3 is missing white-box evaluation of RO classifiers. Is this on purpose? It is important to understand if the claimed improvement in robustness actually stems from RO rather than mostly from combining it with adversarial training.
The authors report an increase in white-box adversarial robustness. However, I don't believe that the evaluation of their method is thorough. There are plenty of examples by now where PGD has not been sufficient to evaluate the ground-truth robustness of a model. This can distort the relative robustness of different approaches. Given that the increase from baselines in white-box robustness is relatively small (<10% for most datasets) a much more thorough evaluation is required to conclusively demonstrate the benefit of this method. For instance, applying the SPSA attack from Uesato et al. (2018, https://arxiv.org/abs/1802.05666) or a variant of the CW (https://arxiv.org/abs/1608.04644) attack adapted to the particular method used.
As an additional point of concern emphasizing this issue, the authors present the results of Kannan et al. (2018) as state-of-the-art. So far, there is no conclusive evidence about ALP improving the robustness of neural networks beyond adversarial training. The original paper was found to be not as robust as claimed and retracted from NIPS. A similar paper reporting ALP to improve robustness in smaller datasets (CIFAR10) was submitted to ICLR (https://openreview.net/forum?id=Bylj6oC5K7) but was withdrawn after the authors performed additional experiments. The fact that the authors find the approach of Kannan et al. (2018) to offer an increase over the robustness of Madry et al. (2017) thus raises concerns about the reliability of the evaluation.
Other comments:
-- When the authors perform PGD, what is exactly the loss it is applied on? Is it clear that this is the optimal loss to use when attacking RO classifiers?