Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper examines data poisoning attacks and defense for joint language-vision model (CLIP) in a retrieval setting. Expanding on Carlini et al. 2022, the authors propose attacks and defenses on both modalities instead of just vision signal and show vulnerability in both.

The paper proposes three attacks, all try to lead the model to mis-associate the text signal to the image signal. The first attack targets a class of text, swapping out the image from an <image, text> pair for another image of a different class. The second attack generalizes the target of the first into a class of image, and the third attack generalize the second attack into multiple classes of images. All three attacks work well during the fine-tuning process on COCO and Flickr-PASCAL even with very low poisoning rate and with virtually no loss in term of original test data utility. 

The authors then analyze the difference in the effect of data poisoning on the text/image encoders by freezing each and calculate the performance (Hit and Minimum rank) and show that the image and text encoder lead to slightly different forms of poisoned behavior. While the poisoned image encoder generally leads to worse behavior overall (generally higher rank of the poisoned image in retrieval), the poisoned text encoder leads to higher probability of top retrieval results being the poisoned class.

In the defense, the author proposes two methods, the first is data filtering with distance from the original encoders and the second is retraining with clean dataset. Both method improves the robustness substantially.
strength_and_weaknesses: Strength:
+ The paper is one of the first works to explore data security in both modalities of a joint vision-language model
+ Both the attacks and defense methods are simple but effective, with strong experimental results.

Weakness:
+ There has been numerous works on adversarial attacks on text models, many of them also about data poisoning, so it has been quite clear that linguistic modality is also vulnerable to data poison attack [1,2]
+ As Carlini et al. and others have shown in their previous work, CLIP is quite vulnerable to adversarial attacks, and they have also shown that CLIP can be poisoned with a very limited number of poisoned data points. 
+ The attacks and defense method proposed in the paper is different compared to previous work of Carlini, but the novelty is limited.

[1] https://aclanthology.org/2021.naacl-main.13.pdf
[2] https://aclanthology.org/2021.naacl-main.13.pdf
clarity,_quality,_novelty_and_reproducibility: To my knowledge, this is one of the first work to explore attack/defense from both modalities in joint vision-language model. However, the attack and defense methods are simple and not entirely novel. Previous works have also shown vulnerability of CLIP and text model in data poisoning attacks, which also reduce the novelty and potential impact of this work.
summary_of_the_review: My main concern is about the potential impact of the paper. The previous work of Carlini has shown the vulnerability in CLIP model while the attack and defense method is not novel enough.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on the data poisoning task on multimodal encoders. This paper investigates three types of poisoning attacks first. After that, it studies the effectiveness of attacking visual and linguistic features. In addition, it explores two types of defense mechanisms for defending against the attack on multimodal encoders.
strength_and_weaknesses: Strength:
1. This paper investigates a new problem about whether attacking the linguistic modality is also effective for the poisoning attack task. 
2. The experiments are extensive and provide a deeper understanding of the vulnerability of multimodal encoders.

Weaknesses: 
1. There is a lack of baselines in this paper. Although the paper proposes three types of attack, the comparison does not include other state-of-the-art methods. As mentioned by the author, there are existing methods in this domain, but they are not introduced in the experiment to show whether the attacking method is not redundant. 
2. There is a lack of discussion on whether it’s worth of attacking linguistic modality. Although it can be as effective as attacking linguistic modality, it is not clear whether it changes a lot of linguistic data compared to visual data. If not, based on the principle of not causing much difference in the data, it does not make sense to change the linguistic data.
clarity,_quality,_novelty_and_reproducibility: This paper is well-written and easy to follow. As for its novelty, it is new to see work on the poisoning attack domain to conduct a study on the linguistic modality. As for reproducibility, although the authors provide a reproducibility statement, it is still better to provide codes for other readers to implement the experiments.
summary_of_the_review: In total, this paper is novel for providing a study on attacking linguistic modality for multimodal encoders. The experiment is comprehensive and provides an easy-to-follow structure for readers. However, this paper lacks an illustration of why linguistic modality matters for poisoning attacking and whether the used attack method is better than the baselines. Thus, the reasonableness for conducting this type of attack needs more explanation.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper explores the poisoning attacks on CLIP. Compared to the previous work that focused on pre-training attacks on the image-modal encoder, this paper focuses on attacking the fine-tuning process and evaluating it using text-image retrieval, a downstream task that shows the attack's effect on both image and text-modal encoder. The attack is also generalized to a class-class poison rather than a target-class poison. The paper analyzes the differences between poisoning effects on both modalities and proposes post- and pre-training defenses against these attacks. 
strength_and_weaknesses: Strength:
1. To my knowledge, this is the first paper that tries poisoning attacks on a multimodal model during the fine-tuning phase. The scenario is realistic and easier to expand further for future experiments compared to training CLIP from the scratch. Using Image-Text retrieval is also a novel evaluation task for analyzing multi-modal attacks with more evaluation metrics like hit@k and minrank. 
2. This paper isolates the linguistic and visual modalities and analyzes the attack's effect on them separately, providing an interesting insight that may lead to effective attacks with more focusing goals (lower minrank or higher hit@k rate).
3. The paper gives simple but effective defenses against the proposed attacks.
4. The paper considers a more general attack scheme compared to the previous works.

Weakness:
1. I do not see significant differences between attack 2 and attack 3. both datasets seem to have consistent Hit@K ratios and MinRank values. The only values inconsistent are "ours-2" under the Flickr-PASCAL dataset, but I think it can be attributed to the specific dataset selections rather than the attack 3 itself being more harmful. There is an analysis in the ablation study on different combinations of classes during the attacks, but the consistency issue is not analyzed fully during the main experiment part.

2. I also cast a doubt on the dataset used, specifically Flickr-PASCAL. Even though the combined dataset has a relatively large size, only 20 categories from the PASCAL datasets could be selected to be poisoned and that may influence the scope of the attack. Namely, even though the overall poisoning rate is low, the effect may be stronger due to the data imbalance issue. 

3. Combing the freezing experiment with the main experimental result, I can have a clear understanding of the linguistic modality being attacked. However, the analysis of which modality is most vulnerable is not satisfactory. From the experiment, each image is matched to more than one caption, rendering an imbalance in encoding representations. As stated in previous work, when there are more diverse caption sets for each image, the model is more likely to change the image encoder compared to the text encoder. Although the statement is unjustified theoretically, It makes sense intuitively and a more considerate experiment concerning this issue or an explanation of why this concern is unnecessary could be very helpful to the overall argument. There is also a lack of explanation and extension on their result with the difference in attacking different modalities. 

4. Both the pre-training defense (removing less correlated data pairs) and the post-training defense sound a bit weak. For the pre-training, it is possible to have harder training tasks with larger cosine distances, and setting a threshold is difficult to do and could be harmful to the performances. For the post-training, the paper does not explore the situation when the fine-tuning datasets are of different scopes.

5. Overall, I think there is a lack of analysis and expansion on the experiments discussed
clarity,_quality,_novelty_and_reproducibility: This work is easy to follow and explains its reasoning in a clear manner. The focus is interesting and the experiments are very thorough. 
summary_of_the_review: The paper gives many new insights into analyzing attacks on multi-modal models. The training scheme on fine-tuning tasks makes future experiments more manageable and easier to transfer. However, I think there is a lack of explanation for many of the findings. I will raise my rating if there are more explanations on the points I mentioned.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper studies vulnerability of language and image modalities in multimodal language-vision pretrained models (CLIP) against poisoning attacks, during fine-tuning. In particular, the paper conducts three types of poisoning attacks and then proposes pre- and post-training defenses. The paper was discussed in the meeting with the reviewers, which I summarize below. 

Main strength: All the reviewers acknowledged the importance of the problem and the necessity of studying and defending attacks on multimodal models. 

However, 
- The main concern is that the proposed attacks are applied to and tested on the same data. This makes the proposed attacks (based on e.g. changing the labels) trivial to detect. A more interesting scenario is when the attack success rate is measured on (more than two) different datasets.
- Proposed defenses are very simple and may not be always effective.
- The quality of every encoder should be studied alone, to make sure that the attack does not affect the quality of each encoder on the rest of the data.
- Attacks during training from scratch is more realistic, and fine-tuning data is usually clean and more difficult to attack.
The above points will make the paper much stronger and more convincing.
justification_for_why_not_higher_score: Explained in part 1.
Decision: Reject