Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a robust universal adversarial perturbation which is robust to many transformations such as rotation, pixel intensity. It proposes a robustness estimation approach which can be leveraged to conduct adversarial attack.
strength_and_weaknesses: positives:
+ it is important to improve the robustness of universal perturbation, especially when applying them in physical attack. 


negatives:
- the proposed method is straightforward since it just combines the idea of physical attack and digital universal perturbation attack.
- But experiments conducted in this paper almost focus on the digital domain, instead of real-world physical transformation. Due to that, it is hard to measure the effectiveness of the proposed method. 
clarity,_quality,_novelty_and_reproducibility: It is well written and easy to follow. 
It is limited in its novelty and experimental evaluation, as mentioned above.  
summary_of_the_review: The problem discussed in this paper is important when applying universal perturbation attack to real-world physical attack. But my concerns are the limited novelty and experimental evaluation, thus it needs to be significantly improved before being accepted.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The authors consider the problem of making universal adversarial perturbations (UAPs - those that can be applied to any input and trigger classification for a certain class) under a set of transformations. The authors present a new algorithm. It involves applying SGD over  examples (in the outer loop) and randomly chosen transformations (in the inner loop). The caveat is that for each batch the algorithm estimates robustness (i.e. adversarial success rate under the transformation set) in the optimization loop, allowing the algorithm to move on to the next batch only after the resulting UAPs are estimated to be robust to a certain level. It turns out that in practice this algorithm has higher adversarial success rate than just performing SGD alone, especially on complex sets of transformations.
strength_and_weaknesses: Strengths: the method outperforms baselines on adversarial success rate, especially under large sets of transformations.

Weaknesses: the SGD baseline is underspecified. It would be interesting to see the extent to which the presented algorithm outperforms SGD while contextualizing compute used. Some questions: 
* How much compute is used to perform RobustUAP compared to SGD?
* How much compute is used to obtain robustness estimates?
* What happens when this same amount of compute is used to run SGD?
* What happens as you vary the number of SGD iterations? Does SGD improve its ASR or does it just asymptote?
clarity,_quality,_novelty_and_reproducibility: The paper is well written and the methods are novel. It would be nice to compare with more extensive baselines (see above). 
summary_of_the_review: A well written paper that tackles an important problem with new ideas. The only lacking aspect is extensive baselines. My score will increase if the authors run more extensive baselines.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This work introduces robust Universal Adversarial Perturbations (UAPs). The objective of robust UAPs is to increase the resilience of UAPs against image transformations. Robust UAPs are obtained by incorporating transformation functions into the UAP generation process. Evaluation on CIFAR10 and ImageNet demonstrate the increased performance of robust UAPs compared to baseline approaches. 
strength_and_weaknesses: ## Strengths
(+) This work deals with the topic of the robustness of Universal Adversarial Perturbations (UAPs). This is an important topic, since, as the authors demonstrate, the effectiveness of UAPs decreases under image transformations.  
(+) The provided experimental results are convincing, showing that the proposed method outperforms the compared baselines.  

## Weaknesses
(-) The contribution of this work is limited. In essence, this work shows that to overcome the susceptibility of UAPs to transformations, transformations need to be incorporated into the UAP crafting process. The increased robustness is hence expected.  
(-) The proposed algorithm has only limited novelty and is a collection of proven methods in the literature, namely batch-training [A, B], expectation over transformations [Athalye et al., 2018], and PGD [Madry et al., 2017]. It would be beneficial if the authors could differentiate their algorithm from the ones in the literature [Shafahi et al., 2020, A, B].  
(-) To further demonstrate the robustness of the UAP, the authors should evaluate the robust UAPs on hold-out transformation, which were not observed during training.  
(-) The authors mainly evaluated the robust UAP in the context of untargeted attack success rate. It would be further interesting to see a performance evaluation of the targeted attack success rate.  
(-) I am further curious about the data efficiency and transferability of robust UAPs.  
* Data efficiency: How do robust UAPs perform when only limited data is accessible during the training process? Please also note, that in the literature data-free methods exist.  
* Transferability: It is common to analyze the transferability of UAPs [Moosavi-Dezfooli et al. 2017, A, B, C]. I would be curious about the transferability of robust UAPs, compared to existing methods.   

(-) The authors mainly evaluated robust UAPs on VGG, Inception, and ResNet18. Recently, transformer architectures gained popularity. I am curious if the concept of robust UAPs holds for transformer-based models as well.  
(-) The related work section is insufficient. To name only a few missing works: [A-E].  

[A] Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations; T-PAMI 2018  
[B] Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations; CVPR 2020  
[C] Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses; ECCV 2020  
[D] Art of singular vectors and universal adversarial perturbations; CVPR 2018  
[E] Defense against Universal Adversarial Perturbations; CVPR 2018  

clarity,_quality,_novelty_and_reproducibility: ## Clarity
This work clearly written and technically sound to the best of my judgment.

## Quality 
The paper quality is sufficient in my opinion. 

## Novelty
In my judgment, this work holds only limited novelty. 

## Reproducibility
This work is reproducible (code provided) to the best of my judgment. 

summary_of_the_review: While it is indeed true that the efficiency of UAPs suffers under transformations, simply showing that this can be mitigated by introducing transformations into the crafting process does in my opinion not hold enough contribution to be accepted at ICLR. Additionally, as pointed out in my weaknesses section, this work lacks several crucial evaluations to fully judge the effectiveness of the proposed robust UAPs.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper presents a simple improvement to universal adversarial perturbations to make them robust to transformations.  The paper motivates empirical experiments via theoretical observations.
strength_and_weaknesses: How does the ability to craft perturbations which are robust under transformations depend on the invariance properties of the victim network to such transformations?  For example, is it easier to craft UAPs which are robust to horizontal flips for models trained with horizontal flip data augmentations.  How does this depend on the model used for crafting as well?

This paper contains virtually no ablations, for example on the choice of optimizer in the attack.  The authors use a different optimization strategy for example in the SGD baseline instead of PGD, so that is important to ablate.

My biggest qualm with this work is that the paper is packed with theory and notation, yet the proposed method is extremely simple and does not require any of the theory for motivation.  In fact, while I was reading the theory, I wrote down a note to myself asking if the authors tried a very simple and obvious baseline, and that baseline turned out to be exactly their proposed method.  The technique of EOT is widely used in the adversarial example and poisoning literature, for example, so it makes sense to use it here as well.  Simplicity is a good thing as simple methods are easier to understand and implement, but loading up a paper with entirely unnecessary theory and notation so that it is harder for the reader to understand the work defeats the purpose.  The algorithm only appears on page 6 of 9 in a method paper.
clarity,_quality,_novelty_and_reproducibility: The method may be novel, although I am not aware of other recent work on UAPs.  The writing is good in terms of the grammar, but the simple and intuitive method is hidden behind a wall of theory.
summary_of_the_review: I like the simplicity of the approach and the empirical robustness gains, but the presentation is hard to follow, and there are numerous experiments missing that would have been a better use of space than the theory.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: In this paper, the authors studied the robust universal adversarial perturbation (UAP) problem.
The proposed concept is simple but the novelty, as claimed by the authors, is that they rely on a novel sampling strategy that can provide probabilistic bounds on the closeness between the computed and theoretical expectations in eq. (5). This enables better robustness of the generated UAPs as shown in the experimental results.
The authors also confirm that not all combinations of EoT, batch-training, PGD, and UAP obtain the same level of robustness.

The major concerns are that (1) as mentioned by Reviewer CA3y and responded by authors, Restricted RobustUAP is slightly better than SGD. However, this phenomenon is not clearly described in the paper and the results shown in the tables will give a false sense that RobustUAP is significantly better than SGD under the same condition. (2) Some issues, including data-free methods for UAP generation and targeted attacks, raised by the reviewers, need to further explore instead of providing few (but selective?) experimental results. (3) As suggested by Reviewer pw3U, the paper is tougher than it needs to be to read because of the wall of theory in front of a very simple method.
Finally, how to select the parameter, \gamma (0.5/0.6(Table 1)/0.7(Table 4)/0.8(Table 2)), is not clear.

Based on the above reasons, this paper indeed has some merits but needs more work to make it complete.
It is suggested to be rejected at its current status.


justification_for_why_not_higher_score: The major concerns are that (1) as mentioned by Reviewer CA3y and responded by authors, Restricted RobustUAP is slightly better than SGD. However, this phenomenon is not clearly described in the paper and the results shown in the tables will give a false sense that RobustUAP is significantly better than SGD under the same condition. (2) Some issues, including data-free methods for UAP generation and targeted attacks, raised by the reviewers, need to further explore instead of providing few (but selective?) experimental results. (3) As suggested by Reviewer pw3U, the paper is tougher than it needs to be to read because of the wall of theory in front of a very simple method.
Decision: Reject