Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary:  Quantization is technique that changes the parameter representation of a neural network into lower precision ones, in order to reduce the memory footprint and the computational cost. The parameter perturbations caused by the transformation may result in behavioral disparities before and after quantization. This paper weaponizes quantization-aware training and propose a new training framework to implement adversarial quantization outcomes.
main_review: This paper considers the security vulnerability in quantization, and proposes a novel training framework to implement adversarial quantization outcomes. It presents three attacks based on the framework: an indiscriminate attack, a targeted attack against specific samples, and a backdoor attack. Moreover, it extends the attacks into practical scenarios, such as transfer learning and federated learning. 
This paper is clearly demonstrated, conducting with a wide range of experiments. 

limitations_and_societal_impact: As regard to the backdoor attack experiment, one key hyper-parameter is the poison rate, which is set to 20% in the setting. This rate is very large compared to existing backdoor works. Different poison rates may lead to different results. The authors should conduct extensive experiments with respect to different poison rates.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: 
This paper presents a new attack that can only be triggered once the model is quantized using modified "quantization-aware training".
main_review: Paper quality is good and has strong evaluation. However, there are a couple of questions:

1. The setting seems a bit artificial: why the quantized model cannot be tested? Especially, as [Jacob et al, 2018] argue for QAT to recover performance, it makes perfect sense to test the model after quantization (at least to verify that QAT has worked).  

2. In federated learning, for communication efficiency, the user will send only already quantized model, which the server can test. Furthermore, once the server receives the quantized model it will be de-quantized for further use. So it's not clear how the proposed attack fits in this setting.

3. I doubt that this attack is practical, quantization is not a separate part of the model supply chain like data gathering, model training, and model serving, but rather a part of model serving. Therefore, the attacker that controls the training (to inject the attack) assumes the victim will test the model only before quantizing it but serve the quantized model without testing. 

4. The defenses such as NeuralCleanse or SentiNet might be very efficient when evaluated against the backdoored quantized model. It's unclear whether the attack can be caught when the defender has access to the quantized model.

limitations_and_societal_impact: Addressed
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper proposes a quantization-aware training framework to detach model's performance before and after quantization. The attack will be activated upon quantization. Three different attacks are presented, along with the framework, to encode indiscriminate, targeted, and backdoor malicious behavior into the model that are only activated after quantization. The authors evaluate their proposed attacker against multiple quantization methods, and study the effectiveness of their attacker in two ML scenarios, transfer learning and federated learning.
main_review: *The authors study and explore an interesting and delicate direction: how to implant specific malicious behavior into a model and only being activated upon quantization. To the best of my knowledge, the idea itself is quite novel. In particular, prior quantization schemes aim to minimize behavior differences before and after quantization (Li et al. 2021, Zhao et al. 2019, Banner et al. 2019), or defensive quantization (Khalid et al. 2019, Feng et al. 2020, Maungmaung Aprilpyone et al. 2020, Shupeng Gui et al. 2019). But how to attack a model aiming for quantization have not been usually explored and discussed.

*The proposed approach is intuitively reasonable and the proposed loss functions are motivated to be functional as attackers. The authors demonstrate the effectiveness of their attackers systematically in experiments.

*The paper is well organized and clearly written, which allows an easy read. The experiments directly point
out the focused research direction, and answer my questions one by one.

Questions & Comments:
1. How to set $\alpha$ and $\beta$ in practice? How to vary these parameters for different attackers on different tasks, models, and etc? The  authors are suggested to provide any observations, conclusions, or ablation study on it. 
2. In 'Targeted misclassification of a specific sample', the author mentioned they "conduct ......10 target samples randomly chosen from 10 different classes, correctly classified by a model." However, in Table 3, if $(x_t, y)$ are chosen to be correctly classified by VGG16, why the accuracy is $70\%$ of the clean model instead of $100\%$?
3. In Section 4.5 transfer learning, what if one uses "compromised ResNet, trained on Tiny ImageNet as teachers" to teach a smaller model, say MobileNet, on Cifar-10? It is a case between fine-tuning the entire layers for the same task and transferring the malicious behavior to a new task, just being curious about what will happen for this case.
4. The authors are suggested to define the meaning of $\textbf{bold numbers}$ in all tables. I understand it is a way to make readers pay attention to those numbers, but the way it shows now is kind of misleading and confusing.

Minor comments:
1. Page 5, line 206, miss one '.' after 'in the target class'
2. Page 9, line 349, activate -> activated
limitations_and_societal_impact: Yes, the authors addressed the limitations.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper considers an adversarial setting where the attacker can manipulate the model parameters in the training process subject to common constraints. It proposes a general framework for stealthy attacks that only take effect after parameter quantization – an increasingly popular technique for model compression. The paper instantiates the framework on un-targeted, targeted and backdoor attacks against various models, and successfully demonstrates the power of these attacks.
main_review: This paper picks a very interesting adversarial setting to me: how will quantization affect the security of ML pipelines. It is easy to read and well-motivated.

In terms of correctness, the attacker’s object function looks natural to me, and the experiment design is solid. Three different attack scenarios are considered, and a transferability study is done too. 

My main concern is on Table 5. The caption says the numbers in Table are ASRs. However, for IA, it seems the attack success rate is very low after quantization. This contradicts with the result in Table 3, and the **accuracy** drops after quantization. Could you please explain why? In addition, it seems that IA and BD attacks have totally the opposite behavior in Table 5 after quantization. Are the reported results both ASR? 


Overall:
I’m giving a score of 6 for now, and I’m willing to raise my score if the inconsistency between Table 3 and 5 can be addressed.

limitations_and_societal_impact: Yes, they are adequately addressed.
review_title: null

Meta-review: The reviewers were satisfied by the responses by the authors, and encourage them to include additional results to the final version of the paper.
Decision: Accept (Poster)