Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper presents a genetic algorithm (GA)  based method to generate adversarial images, i.e., images perturbed in a way such that it leads to misclassifications in a number of image classification models.
Investigation of GAs in the context of adversarial image generation task is a novel and interesting one.


main_review: Review of "ONE FOR MANY: AN INSTAGRAM INSPIRED BLACKBOX ADVERSARIAL ATTACK"

This paper presents a genetic algorithm (GA)  based method to generate adversarial images, i.e., images perturbed in a way such that it leads to misclassifications in a number of image classification models.
Investigation of GAs in the context of adversarial image generation task is a novel and interesting one.
It's however difficult to see the connection of this with Instagram filters. Why is a sequence of filtering required (Eqn 2) via composition of filters?

Moreover, more details need to be included on the GA process. How is a particular state represented (each row indicating filter parameters)? Details need to be included on what happens during the cross-over and the mutation operations? Do cross-over operations exchange filter parameter values? Does all the filters use the same number of parameters?

The paper mentions about "gradient towards a better solution". However, GA-based approaches don't require computing gradients.

Another concern is the time it would take to generate one adversarial example. Evaluation of the fitness function of each state needs to be evaluated by making predictions
with the target models, which indicates that executing GA in this case is going to be time consuming.

From a novelty perspective, the paper is quite limited because algorithm is also based on the AGV paper (Baia et. al. 2021). The only difference is that multiple target networks are used. It's not clear why (Baia et. al. 2021) wasn't used as a baseline. Moreover, there is no rational explanation provided on why zooming in on an AGV generated image wouldn't produce the visible artefacts --- what characteristics of the proposed approach is likely to ensure this?  

summary_of_the_review: The strengths of the paper (extensive experiments) hasn't been able to outweigh the weaknesses (limited novelty, lack of AGV baseline, a seemingly slow approach).
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper introduces a new family of black-box adversarial attacks. These attacks are constructed by composing Instagram filters-based transformation in the input space. Perturbations in the input space are unrestricted and large but only produce natural-looking artifacts. The input is transformed with 10 different filters. Each filter has two variables: alpha to control the intensity and s to control strength. To get the optimal values of these parameters, an evolutionary approach is used. Comprehensive experiments are performed to show the efficacy of the attacks. 
main_review: **Strengths**
1. An interesting research direction is explored and natural-looking attacks are proposed. 
2. The proposed family of attacks is a black box and more applicable in the real world.
3. The attacks seem to use fewer queries making them more effective. 
4. Comprehensive set of experiments are performed to show the effectiveness.


**Weaknesses**
1. One interesting thing is that the attacks produce natural-looking artifacts. However, it would be interesting to see some fail cases.
2. A comparison of the number of queries used by these attacks vs. other black-box attacks should be added. 

**Additional Recommendation**
1. It would be interesting to see if Instagram filters can also be used to improve privacy, something similar to [1].

References

[1] Unlearnable Examples: Making Personal Data Unexploitable 

summary_of_the_review: This paper introduced an interesting set of black-box attacks and showed their utility through comprehensive experiments. It seems like a good paper. However, I am not very familiar with recent work on black-box attacks.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes a black-box attack method that uses an evolutionary algorithm to find the best image filter parameters that can achieve untargeted attacks. Model ensembling is also used in the AE generation to improve attack transferability. The proposed method is compared to other similar image filtering-based AE generation methods. Results show that the proposed method is able to outperform most of the related works in terms of transferability. 
main_review: # Strengths
- Addressing an important problem: hard-label black-box setting is a more practical attack setting compared to existing white-box or soft-label black-box attacks.
- Combining evolutionary algorithm and model ensembling to achieve good black-box attack and transferability performance.


# Weaknesses
- The intellectual delta from existing works is low. As also identified by the authors, the idea of using image filters is not new--many existing works (SemanticAdv, Colorfool, Edgefool, Filterfool, ACE, etc) have already adopted such a concept to generate benign-looking AEs. The difference is that prior works assume knowledge on the confidence scores or even model internals. The authors address this by using evolutionary algorithms to find the best filter parameters, which is also a straightforward solution and the results are not surprising. To improve this, the authors may consider comparing different evolutionary algorithms such as GA, PSO, to systematically understand the tradeoff between the different methods.
- No evaluation on the AE stealthiness. Since the benefit of using image filters are the attack stealthiness as the generated AEs are intended to look benign. However, I cannot find any stealthiness evaluation in the paper. There are only a few images of the generated AEs shown in the paper. But that is not a systematic evaluation. There are two directions to address this. One solution is to calculate image perceptual metrics (such as those used in GANs [1]) of the AE. Another is to conduct a user study on the AEs to ask participants about the suspiciousness. For both solutions, random sampling of the successful AEs is required to ensure no biases in the selection.
- The good transferability mostly comes from the model ensembling as can be seen from the much lower transferability of AVG-single 5f in Table 3. 

[1] An empirical study on evaluation metrics of generative adversarial networks, https://arxiv.org/pdf/1806.07755.pdf
summary_of_the_review: The paper studies an important problem. However, the current evaluation in the paper is still lacking. More systematic evaluations on the evolutionary algorithms and stealthiness are necessary.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a new way to craft adversarial examples using Instagram inspired filters by means of evolutionary algorithms. The resulting adversarial attacks do not have recognizable artificial patterns as in other methods and show competitive performance including a difficult black-box scenario. 

main_review: Strengths:
1) Interesting evolutionary strategy to craft strong transferable attacks using image filters.
2) Adversarial examples look only as filtered clean images with no artificial patterns as in other gradient based methods.

Weaknesses:
1) Potentially weak attack. Judging by the examples shown in the paper, the adversarial images are mislabeled to a class which is very close to the ground truth (for instance, from “standard schnauzer” to “mini schnauzer” or from “Labrador” to “Dobermann” ) indicating that the attack strength is low. Is there any way to fix this? Can you make an attack more semantically strong?
2) Minor grammatical errors (e.g. “simoultaneously”)

summary_of_the_review: Although the attack looks indistinguishable from just a filtered image, it seems that the strength of the attack is questionable, in most cases images are mislabeled to a class which is very close to ground truth. Unfortunately, it undermines the whole purpose of the method, its practicality and effectiveness. Therefore, I tend to be on the rejection side.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a nested evolutionary algorithm to generate adversarial perturbations under the black-box settings. Such perturbations are composed of various image filters inspired by Instagram and can simultaneously attack multiple neural networks. They claimed that the attacks were semantically robust and had a low cost of queries.

main_review: Strengths:
This paper was clearly written and well organized with interesting motivations. Such Instagram-style filters are commonly used in daily life and might easily achieve lower suspicion than conventional techniques (large l_p perturbations). In addition, the authors compared a lot of other "unrestricted attacking" methods and demonstrated AGV can achieve higher transferability with less queries.

Weakness:
Experiments are not complete.

(1) The paper claimed, "our goal is to find one adversarial perturbation per-image that can fool many deep learning models". Therefore, when evaluating the performance of methods, it is necessary to present the worst performance on one model besides the average one. (Table 3) Readers can learn what model structures are harder for unconstrained adversarial attacks.

(2) It is unclear to me that the comparison between different methods is fair. In table 3, it seems the objective of AGV-5-NET 5f is to attack 5 different models. But I am not sure if other methods are also trained for attacking 5 different models.

(3) In table 2, the test model is limed to InceptionV3, InceptionV4, adversarially trained InceptionResnetV2-ens-adv [1], one potential improvement for this paper is to test more model architectures (e.g. ViTs). Also, details of InceptionResNetV2-ens-adv are missing (how is it adversarially trained?).

(4) I am not sure how to replicate this paper. To be specific, how does the inner algorithm in 3.3.2 perturb the original image? What is the initial learning rate and decay rate in the inner algorithm? I highly recommend the authors upload the codes or include more details for the methods.



Visual examples are limited.
The authors claimed, "our filter composition cannot be distinguished from any other filter composition used extensively every day to enhance images". However, the paper only includes several visual examples to demonstrate that. I am not sure the proposed methods can achieve low suspiciousness without any human studies or quantitative analysis. In addition, ten image filters used in the paper should also be visualized. 

I think the paper can be largely improved if previous issues are solved.

Questions:
How does the proposed method perform in terms of computational efficiency compared to others?
Is it possible to control the tradeoff between effectiveness and distortion of the image (e.g. constraining the parameters)?

Other comments/suggestions:
The authors should add a section of related works and summarize some important papers in the adversarial ML community e.g. [2,3,4,5]. 

[1] Ensemble adversarial training: Attacks and defenses, Tramer et al., ICLR 2018

[2] Explaining and harnessing adversarial examples, Goodfellow et al., ICLR 2015

[3] Intriguing properties of neural networks, Szegedy et al., ICLR 2014

[4] Adversarial examples in the physical world, Kurakin et al., CoRR 2016

[5] Transferability in machine learning: from phenomena to black-box attacks using adversarial samples, Papernot et al., arXiv 2016

summary_of_the_review: The idea in this paper is very interesting and novel to the adversarial machine learning community, however, issues on experiments and presentations prevent me from accepting it.
review_title: null

Meta-review: This work proposed a nested evolutionary algorithm to choose image filters and filter parameters for back-box attacks, with the emphasize of high transferability. 

After reading the manuscript, the comments of reviewers and the authors' responses, I think the main issues of this work include: 
1. The limited novelty of the main idea, since there have been many filter-based attacks, and this work is very close to an existing work;
2. The solution is not new, since the evolutionary method is also well adopted in adversarial attacks; 
3. Many many black-box attack methods are not cited and compared, though the authors argued that their perturbation upper bound are different such that they cannot be compared, which is not convincing; 
4. The claimed high transferability is not well explained, maybe due to the model ensemble (as indicated by reviewer eN8o). Besides, many existing works that studied transferability are not cited and compared. 
5. Experiments are inadequate. The authors added some results in the revised version, but the current shape is still not ready for publication. 

Thus, my recommendation is reject. Hope the reviews can help to improve this work in future.
Decision: Reject