Neural networks achieve state of the art accuracy on many standard datasets used in image classification. One would like to design neural network models whose performance is not affected by natural (or non-malicious) geometric transformations as well as adversarial (or malicious) perturbations. Previous work has studied generalization to natural geometric transformations (e.g., rotations) as invariance, and generalization to adversarial perturbations as robustness. In this paper, we examine the interplay between invariance and robustness. We empirically study the following two cases: (a) change in adversarial robustness as we improve only the invariance using equivariant models and training augmentation, (b) change in invariance as we improve only the adversarial robustness using adversarial training. We observe that the rotation invariance of equivariant models (StdCNNs and GCNNs) improves by training augmentation with progressively larger rotations but while doing so, their adversarial robustness drops progressively and this drop is very significant on MNIST. As a plausible explanation for this phenomenon we observe that the average perturbation distance of the test points to the decision boundary decreases as the model learns larger and larger rotations. We take adversarially trained LeNet and ResNet models which have good ∞ adversarial robustness on MNIST and CIFAR-10, respectively, and observe that adversarially training them with progressively larger norms results in a progressive drop in their rotation invariance profiles. On these adversarially trained models we observe that the change in the rate of invariance is marginal for small rotations. As a plausible explanation for this phenomenon, we show empirically that the principal components of adversarial perturbations and the principal components of perturbations given by small rotations are nearly orthogonal.
This paper examines the interplay between the related ideas of invariance and robustness in deep neural network models. Invariance is the notion that small perturbations to an input image (such as rotations or translations) should not change the classification of that image. Robustness is usually taken to be the idea that small perturbations to input images (e.g. noise, whether white or adversarial) should not significantly affect the model's performance. In the context of this paper, robustness is mostly considered in terms of adversarial perturbations that are imperceptible to humans and created to intentionally disrupt a model's accuracy. The results of this investigation suggests that these ideas are mostly unrelated: equivariant models (with architectures designed to encourage the learning of invariances) that are trained with data augmentation whereby input images are given random rotations do not seem to offer any additional adversarial robustness, and similarly using adversarial training to combat adversarial noise does not seem to confer any additional help for learning rotational invariance. (In some cases, these types of training on the one hand seem to make invariance to the other type of perturbations even worse.)
This paper is mostly clear and reasonably written. However, I do not think that the results of this investigation are significant enough to warrant publication at ICLR. In particular, I'm not sure that I really understand the motivation of this research question. I suppose a full notion of robustness would include invariance to perturbations of all types -- whether adversarial or otherwise -- and one might hope that techniques for encouraging such resilience mutually reinforce each other. However, since they are human perceptible, the perturbations associated with invariance are exactly the features that are not associated with adversarial noise, so I don't see why they should be related at all. 
From a different perspective, invariance is a property of the true data distribution -- a rotated version of an image of a cat is another valid sample from the underlying distribution -- the invariance property is a type of constraint tying together different elements of the data generating distribution. On the other hand, adversarially perturbed images are often thought to be "off the data manifold" -- i.e. not valid samples from the true underlying distribution. Given this perspective, I am confused about why I should expect to see any interplay between these two ideas. The fact that the authors do not find any interplay is reasonable, but I remain confused about why they were investigating this question in the first place. 
Unfortunately, this means that I don't think this work meets the significance criterion for being published at ICLR.