Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes Flareon, a new backdoor attack that is hidden in the data augmentation step commonly used when training computer vision models. The attack aims to remain stealthy: data labels are not changed, images only suffer small augmentations that add the triggers, and the memory and computation overhead of Flareon are relatively low. Moreover, this code injection attack is able to introduce backdoors that target any class starting from any original clean label. The method seems to reach a good clean accuracy-attack success rate trade-off on CIFAR-10, CelebA and Tiny ImageNet datasets.
strength_and_weaknesses: Strengths:
- Flareon seems to have many qualities, and solves some limitations of existing backdoor attacks.
- The topic of the paper is interesting and relevant to the ICLR community.
- Good experiments, investigating the effect of varying method parameters, but also evaluating the proposed method against state-of-the-art baselines.
- Well-written, clear paper.
- Open-source implementation.

Weaknesses:
- The experimental evaluation could be improved.
- The limitations of the proposed method are not discussed in the paper.

See more details below.
clarity,_quality,_novelty_and_reproducibility: Novelty:
- Flareon seems novel.

Quality:
- The statement that backdoor attacks assume full control of the training process is mostly not true. The majority of methods only assume full control of the dataset, without any changes to the training procedure.
- It is not clear to me how the proposed attack accomplishes the targeting of a specific label from a given clean label (any2any).
- Method limitations should be addressed in the paper:
  * Flareon seems limited to the image domain.
  * It seems that, for good performance of the proposed attack, ~80% of the images need to be backdoored. This is not particularly efficient.

Quality - experiments:
- The main comparison with other attacks (Tab. 5) seems to be using the numerical values from the original papers. Moreover, many values are missing, leading to an incomplete and skewed comparison. The baselines should preferably be re-run in the same conditions as the proposed method.
- The paper seems to cite other backdoor attacks that optimize the trigger (e.g., reference [Turner et al., 2019] in the paper), however these are not included as attack baselines.
- The literature review on backdoor and poisoning defenses is a bit light. Examples of additional references to include: [Wang et al., 2020], [Weber et al., 2020]. These could also be part of the experiments.
- It would be relevant to see how Flareon and the other attacks fare against defenses.

Clarity:
- Overall, a clear, well-structured paper.
- Additional proofreading would improve the quality of the paper.

Reproducibility:
- Open-source implementation provided.

Minor:
- Fig. 1 is a bit misleading, as it looks similar to an adversarial examples pipeline. It is not clear that the model is trained with the backdoor.
- tempering -> tampering
- code-inject -> code-injection
- and etc. -> etc.
- "motion-based triggers can successfully deceive recent backdoor attacks" -> "motion-based triggers can successfully deceive recent backdoor defenses"?

References
* [Wang et al., 2020] Binghui Wang, Xiaoyu Cao, Neil Zhenqiang Gong, et al. On certifying robustness against backdoor attacks via randomized smoothing. arXiv preprint arXiv:2002.11750, 2020.
* [Weber et al., 2020] Maurice Weber, Xiaojun Xu, Bojan Karlaš, Ce Zhang, and Bo Li. Rab: Provable robustness against backdoor attacks. arXiv preprint arXiv:2003.08904, 2020.

summary_of_the_review: Novel code injection attack that aims to overcome all limitations specific to backdoor attacks. Good evaluation, that could still be improved.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: In this work the authors present a data poisoning attack that inserts class-conditional triggers in the data augmentation stage. 

The threat model the authors consider is:
* The defender is oblivious and uses the attacker's malicious data augmentation pipeline
* The attacker has arbitrary access to the data augmentation pipeline and wants to be able to use triggers at test-time that will make images classify as certain classes

The authors method is to insert class-consistent triggers (specifically: -1/1 valued vectors chosen according to a beta distribution for each target class). The method has consistently high adversarial success rates.
strength_and_weaknesses: Strengths: the presented method has consistently high adversarial success rates.

Weakness: the core weakness is novelty. The presented method is a straightforward extension from previous work. More details below.

Novelty - aspects of the presented algorithm that are new compared to previous work:
* Focus on data augmentation aspect of pipeline: Previous works can also be implemented as data augmentation (as they just add a class consistent perturbation i.e. [0, 1])
* Type of backdoor: [2] also uses a beta distribution to sample backdoor triggers
* Many types of triggers: straightforward extension, done previously in [1]
* Adversarial success rate: the presented method is consistently in the same ballpark as previous methods (see Table 5 in the paper)

[0] https://arxiv.org/abs/2002.00937 Section 3

[1] https://people.cs.uchicago.edu/~ravenben/publications/pdf/backdoor-sp19.pdf

[2] https://ojs.aaai.org/index.php/AAAI/article/view/17266
clarity,_quality,_novelty_and_reproducibility: See above for discussion of novelty.
summary_of_the_review: The presented method is not novel enough to warrant publication.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a new backdoor attack that does not alter the label of the poisoned samples, a.k.a, clean-label attack. The high-level idea is to craft a trigger such that it breaks the semantic features in an input image and adds a trigger that is easier to be learned. Adding this trigger to the input and training the model could force a learning model to pick up the association between the backdoor trigger and the sample label rather than the semantic features between the sample label. The paper evaluates its attack on three datasets and against three defenses to demonstrate its exploitability. 
strength_and_weaknesses: Strengths
+ The paper conducts a reasonably large set of experiments, and the results are promising.
+ The authors open-source the implementation of the proposed technique. 

Weaknesses:  
1. My first concern about this work is its novelty and technical contribution. The idea of the proposed method is similar with an existing technique, which is also cited in the paper, i.e., Turner et al 2019. In that paper, the authors proposed clean-label attacks (label-consistent attack). This set of attacks also adds triggers to the samples from the target class and does not vary the label of the original samples. To do so, it also proposed to break the semantic features in an original samples, add a trigger, and force the model to learn the shortcuts from the trigger to the target class. To achieve this, it proposes two methods, one is GAN-based generation, the other is adversarial perturbation-based method. The latter is similar with the method in this work. Especially, Line 15 in Algorithm1 of this work is actually generating adversarial examples. As such, I am afraid that this work has limited technical novelty and contribution. Besides, the authors' argument about the limitation of Turner et al 2019 is also not convincing enough. It states Turner et al 2019 introduce too much additional computational cost and is not applicable to the problem of this work. As I discussed above, the perturbation-based method in Turner et al 2019 is similar to the one proposed by this work, which also require only gradient computation. If the method proposed in this work is acceptable, so should be the one proposed in Turner et al 2019. Besides, regarding the GAN-based method, if GAN is pretrained, the computational cost of generating adversarial trigger is also marginal. Therefore, I am not fully convinced by the argument. Overall, I belive the paper does not well distinguish itself from an existing technique and thus lack novelty. 

2. The proposed technique is not clearly introduced. Some important details are missing. I belive the proposed motion-based trigger generation deserve a more detailed description since it is one of the main technical novelties. The current description is not entire clear. Frist, I would suggest the authors explain what motion-based stands for. Second, I would suggest explaining the design intuition of each step, for example, why using beta distribution. Can we use gaussion or uniform instead? Third, the paper does not explain what "grid_sample" stands for. Finally, visually, the triggers in Figure 4 are similar to pixel-level adversarial perturbation. I do not fully understand the difference between these two. Actually, Line 15 is generating adversarial perturbation. Can we just use Line 15 without the proposed trigger transformation? 

3. The evaluation on defense misses: (1) An important baseline (Turner et al 2019); (2) One type of defense works that learns a robust model from poisoned samples (e.g., [Rab: provable robustness against backdoor attacks]).
 
clarity,_quality,_novelty_and_reproducibility: The paper lacks technical clarity and novelty (See above for details). 
Since the implementation has been released, I believe the results are reproducible.
summary_of_the_review: This paper proposes a new backdoor attack against DNNs. As I mentioned above, the proposed technique is similar to the existing clean-label attack and lacks technical novelty. The evaluation is not comprehensive, missing important baselines and possible defenses. As such, I believe this work may not be able to meet the bar of ICLR, a top-tier conference in ML.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This work studied a new threat model where the attacker could insert malicious code within the data augmentation module, and acquired no control over and no prior knowledge of the rest of the training algorithm, as well as the training data. It proposed a new type called any-to-any attack. 

The reviewers had several important concerns about the novelty and technical contribution, some careless claims about existing works, inadequate literature reviews, insufficient experiments. Some of them are not well addressed in the rebuttal. 

Besides, I also two additional concerns: 
1. The practicality studied threat model should be discussed with more details. It is glad to see a new but really practical threat model in the community. 
2. The authors claimed that 80% training sampled are affected to achieve high ASR, the clean accuracy is not affected much. That seems surprising. 

Overall, exploring new threat model and new attack type is appreciated. However, the current shape of this work is not ready. Please keep improving this work.  
justification_for_why_not_higher_score: See above
Decision: Reject