Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This paper studies the problem of semantic adversarial attacks with a differentiable de-rendering and rendering pipeline. More specifically, this paper proposed a variant of FGSM (Goodfellow et al. 2015) and PGD (Madry et al. 2017) by extending the traditional Lp-bounded adversarial attacks in the rich semantic space. It considered a list of semantic parameters including color, weather, foliage, rotation, transformation, and object shape. To facilitate back-propagation and improve the quality of rendering, this paper re-implemented the differentiable equivalents of several image manipulation operations based on the previous work (Yao et al. 2018). For experimental evaluations, this paper selected the object detector SqueezeDet (We et al. 2016) as the target model for attack on the virtual KITTI dataset. Experiments demonstrated that the generated semantic adversarial examples (SAEs) can attack the SqueezeDet (see Table 1 and Table 2). By re-training with augmented data by the proposed method, the robustness of SqueezeDet (see Table 3) can be further improved.

Overall, this is an okay paper with incremental technical novelty and clear presentation. Reviewer has several concerns regarding the experiments.

(1) This paper only conducts experiments on virtual KITTI dataset, a synthetic benchmark for object detection and semantic segmentation. In general, studying the adversarial examples in the synthetic domain seems not a significant contribution. Reviewer would like to know the performance on the real dataset such as Cityscape (used in Yao et al. 2018) and other challenging indoor datasets such as ADE20K. At least, reviewer would like to know whether re-training on adversarial examples help to improve the performance on real dataset?

(2) The conclusion is largely based on the 1547 semantic adversarial examples generated, while there are more than 4K synthetic images in the dataset. This seems contradicts against the flexibility of generating semantic adversarial examples described in the paper (e.g., single parameter modifications). Reviewer suspects the proposed differentiable rendering pipeline is not very effective so that generating SAEs requires quite a bit exhaustive search over the parameter space. Please comment on the average running time for generating a semantic adversarial example. How does that compare to generating a pixel-based adversarial example?

(3) While several different quantitative analyses have been conducted, this paper only provides two examples as the qualitative result (see Figure 2). It would be more convincing if this paper provides more such examples in the appendix. In addition, ablation studies on semantic parameters are currently missing. Furthermore, reviewer wonders if it is possible to report the FID score and make sure the generated adversarial examples have the same distribution as ground-truth images.

(4) SqueezeDet is the only model used in the paper. Please also consider other models and report the attack performance and transferability. In a high-level, reviewer would like to know whether the proposed differentiable rendering method generalizes to other tasks including semantic segmentation and depth prediction.

(5) The following paper is related (see Figure 5 of MeshAdv paper), but not even mentioned here. Reviewer would like to see the comparison between the proposed method and the MeshAdv baseline.

-- MeshAdv: Adversarial Meshes for Visual Recognition. Xiao et al. In CVPR 2019.

review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: Review: This paper focuses on generating adversarial perturbation in semantic space. The main contribution of this paper is to propose a general method to generate semantic adversarial examples by using advances in differential rendering and inverse graphics. 

Pros:
1. Generally, the presentation is clear and easy to follow.
2. A general way to transform any pixel-attack algorithm to its “semantic version” is novel.

Cons:
1. There are already a lot of ways to make adversarial examples even semantic adversarial examples. It’s not enough to just propose a new way to make adversarial examples. I think this paper would be more compelling if proposed SAEs have some special property (e.g, easy to take effect in the real world or stronger robustness against defense strategy).
2. In section 5.3, the authors show that data augmentation using SAEs increase the robustness to SAEs, but pixel perturbation AEs do not. This result is of little value. It is obvious that data augmentation using SAEs can increase more robustness to SAEs or pixel-perturbation AEs can increase more robustness to pixel-perturbation AEs. The authors are suggested to compare changes in general robustness caused by two types of data augmentations. For example, compare minimum adversarial distortion.
review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: This paper proposes to generate "semantic adversarial examples" (SAEs) by applying small perturbations in the semantic space, by contrast to more standard adversarial examples that apply perturbations to the image intensities. The concept of SAE has already  been considered in a few papers (where for example the color distribution of the images are changed). 

What the paper proposes is to consider small perturbations of the parameters of a scene. For example, a car can be slighted rotated in 3D, or its color changed, without changing its 2D bounding box. If the perturbation is differentiable, and with a differentiable rendering, it is possible to generate SAEs with optimization algorithms that generalize algorithms developed for "classical" adversarial examples (FGSM and PGD).
In practice the perturbations are performed by using the method from Yao et al. "3D-Aware Scene Manipulation via Inverse Graphics" (NIPS'18).

The paper shows that their SAEs disturbed an object detection method (SqueezeDet), and that training SqueezeDet with SAEs improves its robustness to their SAEs.

I found the paper interesting, however I am not convinced by the general concept:
* While the method from Yao et al is supposed to work on real images, it requires to detect and estimate the pose and the shape of 3D objects, which is still challenging to do on real images. This is probably why the paper considers only synthetic images (VKITTI), to be able to generate a large number of SAEs.  

* The generated images are also valid images, in the sense that for a slightly different scene, they would have been generated by the image renderer used for VKITTI. It sounds more like what the authors have is a method that can generate scenes to improve the performance of an object detector when trained on synthetic images, rather than a method  to be more robust to malicious attacks. This is very interesting, however the paper is not branded toward this  application.
review_title: Official Blind Review #3

Meta-review: The authors present a way for generating adversarial examples using discrete perturbations, i.e., perturbations that, unlike pixel ones, carry some semantics. Thus, in order to do so, they assume the existence of an inverse graphics framework. Results are conducted in the VKITTI dataset. Overall, the main serious concern expressed by the reviewers has to do with the general applicability of this method, since it requires an inverse graphics framework, which all-in-all is not a trivial task, so it is not clear how such a method would scale to more “real” datasets. A secondary concern has to do with the fact that the proposed method seems to be mostly a way to perform semantic data-augmentation rather than a way to avoid malicious attacks. In the latter case, we would want to know something about the generality of this method (e.g., what happens a model is trained for this attacks but then a more pixel-based attack is applied). As such, I do not believe that this submission is ready for publication at ICLR. However, the technique is an interesting idea it would be interesting if a later submission would provide empirical evidence about/investigate the generality of this idea. 
Decision: Reject