Recent studies have demonstrated the vulnerability of deep convolutional neural networks against adversarial examples. Inspired by the observation that the intrinsic dimension of image data is much smaller than its pixel space dimension and the vulnerability of neural networks grows with the input dimension, we propose to embed high-dimensional input images into a low-dimensional space to perform classification. However, arbitrarily projecting the input images to a lowdimensional space without regularization will not improve the robustness of deep neural networks. We propose a new framework, Embedding Regularized Classifier (ER-Classifier), which improves the adversarial robustness of the classifier through embedding regularization. Experimental results on several benchmark datasets show that, our proposed framework achieves state-of-the-art performance against strong adversarial attack methods.
Summary
========
This paper proposes to make neural networks robust to adversarial examples via dimensionality reduction.
The paper builds on and compares to prior approaches (e.g., MagNet and Defense-GAN) that are known to be broken, which casts serious doubts on the validity of the performed experimental evaluation.
The theoretical part of the paper is also very hard to follow.
For these reasons, I recommend rejection.
Comments
=========
The way I understand the proposed framework, it is trying to compress the data into a form that is as close as possible to a standard Gaussian distribution, while maintaining classification accuracy.
The intuition, formulated next to Figure 1, seems to be that compressing the data will force the network to only retain the most important features for classification, which will thus lead to higher robustness.
I have two main concerns with this approach:
- First, recent work by Ilyas et al ("Adversarial examples are not bugs, they are features") seems to suggest that models tend to learn features that are not robust yet generalize well. It is unclear why compressing the data would remove such features.
- Second, it is unclear why constraining the compressed data to be close to a Gaussian would have a positive effect on robustness. The authors claim that this is to remove some "pathological" mappings from the input space to the embedding space. Can you explain what you mean here? What are these pathological mappings and why should they be the source of non-robustness?
The theoretical analysis in Sections 2.3and 3. is very hard to follow. The authors first mention that "optimal transport theory [...] provides a much weaker topology than many other [distances]". What do you mean by this? What is the advantage of optimal transport theory that you are trying to exploit?
When Kantorovich’s distance is first introduced, the reader has no idea what any of the symbols represent. What are Y, U, \mathcal{U}, P_Y, P_C, etc?
The authors then mention a relation to the Wasserstein distance and to Wasserstein GANs. How does this relate to this paper?
I could not understand how Algorithm 1 related to the discussion in Section 3.
Algorithm 1 simply uses a standard cross-entropy loss to train the classifier C. Is this what you mean by minimizing the optimal transport cost between P_Y and P_C? This seems like a very convoluted way of justifying the use of the most standard loss function in ML.
Algorithm 1, step 6 mentions sampling from Q(Z|x_i). But isn't the encoder Q deterministic? If not, where does the randomness come from?
In the experimental section, the authors compare to Defense-GAN, which was shown to be broken in "The Robust Manifold Defense: Adversarial Training using Generative Models" by Jalal et al.
The authors mention that they evaluate robustness using an untargeted white-box PGD attack, but they do not specify which objective their attack is optimizing. As this papers proposed a different classification pipeline, adaptive the attacks to this pipeline is crucial.
The experimental results (Figure 2 & 3) raise a number of questions:
- Why does the ER-classifier variant without adversarial training perform so much better than the one with? The author's explanation about the difficulty of optimizing over the embedding space should be supported. 
- Do the attacks reach 0% accuracy for large enough epsilon? The very high accuracy even for large epsilon suggests that the evaluated attacks are not evaluating the right objective to fool the classifier. E.g., on MNIST, eps=0.4 can nearly destroy the whole image so the accuracy should be expected to be lower.