Review Report 3 - Anonymous Reviewer C

[colah]

The following peer review was solicited as part of the Distill review process.

The reviewer chose to keep keep anonymity. Distill offers reviewers a choice between anonymous review and offering reviews under their name. Non-anonymous review allows reviewers to get credit for the service them offer to the community.

Distill is grateful to the reviewer for taking the time to give such a thorough review of this article. Thoughtful and invested reviewers are essential to the success of the Distill project.

Conflicts of Interest: Reviewer disclosed no conflicts of interest.

---

High level:

• I'm skeptical whether this work is interesting enough for Distill. It is based on work that has been available on the web for over a year and has attracted little interest. If this was a conference reviewing system I think this paper would be rejected for low interest / low novelty at the least.
• It's hard to tell what the overall goal of this piece is: a pedagogical explanation of the topic, or a new results paper arguing that people were wrong to reject weight decay as a defense against adversarial examples in the past?
• If this is meant to be a pedagogy piece, it probably shouldn't argue so hard for weight decay in particular.
• If this is meant to be a pedagogy piece, I actually find the plots pretty confusing, even though I'm already familiar with the topic. I can reverse engineer them, but it takes effort.
• If this is meant to be a new results piece advocating weight decay as a new method, the evaluation should be more rigorous (the article itself calls the results on that front "inconclusive")
• Whether it's meant to be pedagogical or advocacy, any discussion of weight decay should probably be in the context of label smoothing (advocated for adversarial examples by David Warde-Farley) and entropy regularization (advocated for adversarial examples by Takeru Miyato and Ekin Cubuk in separate papers). These are other simple regularization methods that many people agree are helpful for adversarial examples in practice, they have simple interpretations for linear models, and those interpretations are more meaningful for deep nets (because they come closer to regularizing in function space rather than parameter space; parameter space weight decay of a deep net is quite different from parameter space weight decay of a linear model, but function space regularization of both model classes is similar).

I guess if this were a regular journal I would probably recommend "reject" or "resubmit with major revision" after deciding whether it's a pedagogy piece or a weight decay advocacy paper.

General suggestions:

• Maybe give the figures names, so people can refer to them specifically?

Just wrong: "In practice, using an appropriate level of regularization helps avoid overfitting and constitutes a simple form of adversarial training." -> weight decay isn't the same as adversarial training. The phrase "adversarial training" originates in "Explaining and Harnessing Adversarial Examples" by Goodfellow et al. Section 5 of that paper compares adversarial training to weight decay and shows how they are different things.

Medium size problem:

• The first plot has no axis labels and I just don't get what's going on. Why do all the data points move around when I change the regularization? I would expect the decision boundary to move, not the data points.
• The first plot doesn't tell me the amount of weight decay I'm getting as I move the slider.
• It seems unfair to quote 'Goodfellow et al. [2] have observed that adversarial training is “somewhat similar to L1 regularization” in the linear case' without also discussing the differences they report.
• Szegedy et al 2013 also experimented with using weight decay to resist adversarial examples and found that it didn't work. That isn't discussed in this article.
• The experiments advocating for weight decay don't really report clear metrics compared to other methods in the literature (I don't see anything like error rate for a fixed epsilon.

Nits: "In linear models and small neural nets, L2 regularization can be understood as a balancing mechanism between two objectives: minimizing the training error errtrainerrtrain and maximizing the average distance between the data and the boundary dadvdadv." -> maybe unpack this into a few more sentences. When I first read it, I thought the boundary was called d_adv. It took me a few reads to get that the d_adv was the distance.

Typos: " strongly titled." -> "strongly tilted"

One more thought: they really should use SVHN instead of MNIST. MNIST is basically solved for norm-constrained adversarial examples now. There's a trivial solution where you just threshold each pixel at 0.5 into a binary value, and the latest training algorithms are able to discover this solution. SVHN is not a lot more computationally demanding than MNIST but doesn't have this trivial solution.

[stared]

While there are many good remarks, this claim is demonstrably incorrect:

I'm skeptical whether this work is interesting enough for Distill. It is based on work that has been available on the web for over a year and has attracted little interest. If this was a conference reviewing system I think this paper would be rejected for low interest / low novelty at the least.

It got some interest on Reddit Machine Learning and Hacker News.