Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: The main question this paper aims to answer is how vulnerable binary image classification systems are.  This is an important question because of the application of such binary image classifications for check processing, invoice processing, and license plate registration. One also would think that such systems are less vulnerable to adversarial attacks given the simplicity of their inputs and the fact that most adversarial attacks are based on color or grey scale images.  The authors propose an adversarial attack algorithm called SCAR that efficiently flips the binary pixels with reasonable number of queries in order to confuse the classifier to return a desirable label with high confidence. The authors show that the proposed method outperforms the existing baselines on multiple data sets. Very interestingly, they also showed that their algorithm is able to attack the online deposit systems of US bank with a high success rate. Their example of a check with the amount of $401 that is minimally modified for the amount of $701  is quite significant given that the model had to change both the word and numbers on the check. 

The authors also provided some general theories on the existence of binary image classifier provably robust to any attack that modifies large, bounded number of pixels. However, it is not clear to me how this is related to the rest of paper’s discussion. The connection is missing in the paper. 
review_title: Interesting and practically important work

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary: The paper describes adversarial attacks on binary (black/white) image classifiers, flipping a classifier result by changing just a few pixels. The authors go on to show that these attacks work on a real-world financial application. 

Technical contributions: 

* A query-optimized method for finding adversarial attacks (SCAR).
* An empirical demonstration of the method
* A proof (via a straightforward argument) that there are certain types of binary image classifiers that are provably somewhat robust to attack. 

Recommendation: reject, but with weak confidence.

Reason for score: I see two main issues with this paper, both of which may be cleared up with further discussion.

* The authors make the case that this is a realistic attack on a high-value target. I believe it is worth opening a discussion on whether this raises ethical issues for publication.
* What is the relation to previous work on sparse adversarial attacks? For example, "SparseFool: a few pixels make a big difference" (Modas et al., CVPR 2019) and "One Pixel Attack for Fooling Deep Neural Networks," (Su et al., https://arxiv.org/pdf/1710.08864.pdf). While these do not relate to binary images, they seem to explore a closely related direction. The SCAR algorithm is different, but it seems important to compare with this work. The existence of other sparse methods also calls into question whether this represents a fundamentally new advance.

Areas for improvement:
* The numeric results (e.g., section 6.2) are hard to read. Putting them in a table would be helpful.
* A key goal of SCAR is "hiding the noise" (p. 4). It would be nice to have more discussion of this goal. If L_0 distance isn't the goal, why not? If there's an implicit perceptual metric at play, why not make it explicit? 


review_title: Interesting paper, but need clarity on consequences and previous work

final_score: rating: 5: Marginally below acceptance threshold
review_content: ##################################################################
Summary:
This paper targets at a challenging task of attacking binary image classification. A score-based black-box attack algorithm SCAR is designed to fool Tesseract and US banks’ commercial check processing systems.

##################################################################
Pros:
(1) This paper introduces a challenging task of attacking binary image classifiers.
(2) The proposed method SCAR is simple yet effective, which successfully fools Tesseract and the state-of-the-art check processing systems. 
(3) The paper reads smooth and is mostly well-written.

##################################################################
Cons:
(1)	The task of attacking binary image classifiers is a special case of L0 attacks, which also aim at perturbing a small number of pixels. The reviewer thinks that most L0 attack algorithms can be adapted to this binary attack task. The reviewer has concerns that since L0 attack has been widely explored, do we really need to study a much narrow task of binary attack? 
(2)	The novelty of the proposed method is somewhat limited. The proposed SCAR greedily selects the modified pixels, by considering spatial and temporal correlations. However, this method is not new enough. Similar heuristic algorithms have also been developed in previous black-box attack algorithms.  

review_title: Official Blind Review2

final_score: rating: 5: Marginally below acceptance threshold
review_content: ##########################################################################

Summary:

Adversarial attacks for binary image classification are unique from traditional attacks on color images due to its limited available space for perturbation.  This paper proposes an algorithm that efficiently searches for valid attacks (both targeted and untargeted) which cause minimum flipped pixels. The proposed method is evaluated on digit classification, letter classification, and check processing systems. The baselines compared are mostly methods that were originally developed for color images.


##########################################################################

Reasons for score:

This is a borderline paper which I tend to vote for rejection. The problem is well-defined and the method is clearly introduced. However, the evaluation of the proposed method is flawed. In particular, the classifiers being attacked seem to be simple and the perceptibility metric is questionable.


##########################################################################

Pros:

This paper proposes a novel problem with a non-trivial impact. The problem of binary image classification is also well-motivated. The authors provide a clear explanation of how attacks on the binary images are different from those on color images.
 
The authors provide theoretical analysis about the upper limit of pixels that need to be flipped in order to confuse the classifier.

The related work section is well-organized and the authors clearly state why previous works on color images do not apply to the binary image settings.

Both the problem formulation and description of the method are well-organized. 



##########################################################################

Cons:

In the problem formulation, one constraint is that the attacks should be imperceptible to humans. This is measured by D_x(x'). However, D_x is parameterized as L0 distance which is not convincing. For instance, slightly increasing the font size of the same letter would incur a large L0 distance while making the modification imperceptible. On the other hand, transforming the letter "I" to "T" might incur a very small L0 distance while causing perceptible change. The authors should justify the use of L0 or consider experimenting with other parameterizations of D_x.

While the classifier used in section 6.3 is carefully selected and well justified, the classifiers used in section 6.2 seems too simple. In addition, instead of attacking plain classifiers, it would make the case stronger if simple defense algorithms are also considered.

The results in Section 6.5 do not have baseline algorithms to compare with. Also, it would be helpful if a reference to the check processing system is provided.

This paper lacks a conclusion.


##########################################################################

Suggestions & Questions:

In section 6.1, tau is set to 0.1. How is tau selected and how does tau impact the performance?

Please consider rewriting the last sentence of the abstract.

Please address the comments in the cons.


#########################################################################
review_title: A borderline paper with clear motivation and method description but lacks rigorous evaluation

Meta-review: This paper was referred to the ICLR 2021 Ethics Review Committee based on concerns about a potential violation of the ICLR 2021 Code of Ethics (https://iclr.cc/public/CodeOfEthics) raised by reviewers. The paper was carefully reviewed by two committee members, who provided a binding decision. The decision is "Significant concerns (Do not publish)". Details are provided in the Ethics Meta Review. As a result, the paper is rejected based Ethics Review Committee's decision .

The technical review and meta reviewing process moved proceeded independently of the ethics review. The result is as follows:

This paper considers sparse (L0) attacks against binary images analysis systems, in particular OCR.  The major concern of the reviewers seems to be similarity to other methods in the literature, but reviewers did not specify any specific methods to compare to.  Because it was not possible for reviewers to address such vague concerns, and because I believe the authors did a good job differentiating their work in the rebuttal, I think the paper is of good merit.  
Decision: Significant concerns (Do not publish)