Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper proposed a block-box adversarial attack method on the video classification task. The proposed method requires fewer queries with high attack success rates compared to SOTA methods, by leveraging Geometric transformations to parameterize and reduce the search space. 
main_review: This paper is well written and organized. However, I have some concerns about the experimental results:

1. from fig.3 the proposed method show perception video quality degradation compare with the clean video. what are the numerical differences (like PSNR) between x and xadv on different attack methods? Will this attack impact the video quality? 

2. from Table 2 and Table 3, why does [19] have less ANQ compare with the proposed method at the UCF-101 dataset on C3D and TPN classifier? 
It would be better if the authors would provide detailed and insightful explanations. 

3. what's the exact time to finish an attack of the proposed method compared with the other SOTA methods instead of the number of query reduction?

limitations_and_societal_impact: see the main review.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a new method for constructing black-box adversarial attacks against video classifiers. Such attacks are usually hard to mount (moreso than attacks against image classifiers) since the dimension of the input is very large (T x C x H x W) instead of just (C x H x W), which increases the complexity of the corresponding gradient estimation problem. Previous work considered reducing this query complexity with various heuristics (e.g., sparsity/only attacking a few frames, or leveraging optical flow)---here, the authors propose an alternative prior. Namely, the proposed method learns a single C x H x W signal, as well as a parameterized (typically affine) transform for each frame (so another T x 6 parameters, for the affine case). This greatly reduces query complexity and is shown to improve upon previous more heuristic priors in practice.
main_review: The work was clearly written and I was able to understand the method rather easily given the text, which is not always the case with black-box attack papers. As far as I am aware, the idea of "splitting" the perturbation signal into a single frame and a temporal transformation is a new and creative one, and the results are enough to convince me that the method achieves a nontrivial improvement over prior work. My main comments are below:

- I thought Figure 1 actually detracted from the readability of the work, particularly because it is called upon before the actual method is introduced in text; I spent a while trying to decipher the Figure when in fact the plain-text description of the algorithm is not so long and is (in my opinion) much easier to follow.

- The paper hypothesizes that the key to GEO-TRAP's improvement is that it leverages the temporal continuity of videos. I think this claim could be strengthen via a quantitative experiment that compares some notion of the "smoothness" or continuity of a video with the query complexity required by each method to attack it. E.g., under the stated hypothesis, we would expect SINGLE-NOISE to do best on the smoothest videos (since it has fewer parameters), MULTI-NOISE to perform best on the least-continuous videos, and GEO-TRAP to perform best on the remaining/middling videos. It would be interesting to understand where the performances intersect and when it is best to use each method.

- In Table 2, the paper should also present numbers of the form "# of queries required to reach X% success rate" for some value of X, or better yet, a graph that puts the query budget on the x axis and the success rate on the y axis. Without this graph it is hard to compare GEO-TRAP with other methods that have smaller query budgets but lower success rates. 

- The proposed method seems somewhat specific to L-infinity attacks, since you don't have to care about the interaction between different frames in terms of the perturbation budget. I don't think this is a fatal flaw of the paper, but it would be nice if the authors discussed how the method relies (or does not rely, if the above intuition is mistaken) on the considered threat model).

- Very minor: in table 1, should "perturbation model" be "substitute model"?
limitations_and_societal_impact: The authors include a Broader Impact section discussing societal impact. As for limitations, as I mentioned above a discussion of the exact scope of the method (in terms of threat models) would strengthen the paper.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper studies adversarial attacks against black-box video classification models. By adopting geometric transformation, the proposed GEO-TRAP reduced the search space for attacking the models. The attack process against black-box models is similar as the extant methods, by estimating the gradient of the loss function. By conducting experiments, the proposed method could use fewer queries to achieve better attack performance.
main_review: The paper proposed the GEO-TRAP method to attack black-box video classification models, but the idea seems trivial and it combines many methods from extant attack methods. The experimental results also need some further explanation.
1)	The proposed method adds perturbation to each frame. How to guarantee the continuity of the generated perturbation in different frames?
2)	Please explain the intuitive idea of adopting geometric transformations. How to generate such transformation and evaluate the effectiveness of the transformation by theoretical analysis;
3)	Estimating the gradient for attacking black-box models is commonly adopted in many extant methods. The novelty / main contribution is limited to the dimensionality reduction by randomly sampled geometric transformation parameter tensor (as Section 3.1 stated).
4)	The paper does not state clearly whether the black-box model would output the confidence of the classification result (Section 3). If the model only outputs the classification result (without any confidence value), how to define the loss function? The model settings should be introduced in detail since there are still many different settings of black-box models;
5)	In the experiment, the paper should also compare the added perturbation to the video, not only the success rate and the average number of queries;
6)	The number of maximum queries of the method is set as 60,000 for untargeted attack and 200,0000 for targeted attack. How about the other algorithms? As shown in Table 2 and 3, the success rate of other algorithms is not high; would increasing the maximum number of queries achieves higher success rate?
7)	From the supplementary materials, the classification accuracy of the four black-box models on UCF-101 is lower than that on Jester. The attack success rate on UCF-101 is much higher that that on Jester. The high success rate may lie in low classification accuracy of the original models;
8)	The proposed method adds perturbations to each frame. But such attack method cannot be adopted in real scenario. In many safety-critical systems such as the mentioned perceptual modules in autonomous vehicles, it is difficult to add perturbations on the video. 

limitations_and_societal_impact: The paper could consider how to generate such adversarial attacks in real-world, which might be utilized to improve the current classification systems. As adversarial learning with generated adversarial examples might improve the robustness against some (may not exist) adversarial examples, but the accuracy of the original system would be reduced slightly.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper proposes a query-efficient score-based black-box adversarial attack on a video classification task. To address the problem of the high dimensionality, the paper introduces a simple method to reduce the dimension of the search space by applying random geometric transformations to a single random noise of size $H \times W \times C$ to generate a search direction candidate of size $T \times H \times W \times C$ . The paper empirically shows that the proposed method achieves a higher attack success rate with fewer queries than the baselines on various types of models and datasets.
main_review: ### Strong Points

- Clarity: The paper is well-written and easy to follow. The paper clearly states the threat model and attack settings and specifies the hyperparameters.
- Simplicity: The paper proposes a simple method to generate the effective temporal structure of the search direction with geometric transformations that requires no additional parameters or learning process and can be easily implemented using only matrix multiplications.
- Empirical analysis: The paper provides a thorough analysis of the gradient estimation quality of the proposed method (Figure 2 in Section 4) to validate its effectiveness.
- Experiment: The paper conducts extensive experiments varying datasets, models, and perturbation budgets in both targeted and untargeted settings and shows that the proposed method outperforms the current state-of-the-art methods.

### Weak Points

- Novelty: The proposed algorithm is a simple modification of [1], replacing the motion prior by random geometric transformations. Although this change can significantly improve the attack performance, the novelty of the proposed method is incremental.
- How it works: There is no clear theoretical or empirical explanation of how the proposed method leads to better-estimated gradients.
- Baselines: It seems that the results of [1] are not reproduced properly. Based on the original paper, it can achieve a 98.02% attack success rate with a 4,748 average number of queries against I3D on the UCF-101 dataset, which is different from Table 2 in your paper. Note that this result is comparable to the performance of the proposed algorithm.

### Final thoughts

- The paper proposes a simple method to effectively finds search directions for estimating NES gradients. However, there are critical points on the novelty and reproducing the baseline. Therefore, I marginally accept this paper.

### Reference
[1] Hu Zhang, Linchao Zhu, Yi Zhu, and Yi Yang. Motion-excited sampler: Video adversarial attack with sparked prior. In ECCV 2020

### Update

- Thank you for the clarification. Most of my concerns has been addressed and I raise the score. Please include the results of ablation study (and its empirical analysis) that the performance gain comes mainly from the dilation operation to make the paper stronger.
limitations_and_societal_impact: ### Suggestion

- Ablation study: Similar to the experiment in Section 5.2,  I suggest the authors conduct an ablation study that compares the performance of the proposed transformation (translation + dilation) with translation only or dilation only. The authors need to clarify why translation and dilation should be combined.
review_title: null

Meta-review: The authors propose a black-box adversarial attack method for video classifiers. The challenge is to reduce the search space (T x C x H x W) for attack efficiency measured in number of queries. The idea is to employ geometrics transformations to parameterize and reduce the search space. The experiments demonstrate significant improvement in higher success rate at fewer queries compared to the baseline methods. I suggest the authors incorporate the suggestions raised by the reviewers in the camera ready version. Please include a) plot of query budget versus success rate in addition to the tables 2 & 3; b) the ablation study for the results on translation only and on dilation only.
Decision: Accept (Poster)