Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: the proposes a fine-tuning approach to improve the object detection performance without reducing the visual quality of the restored image. To achieve the authors follow a target adversarial attack on the object detection task  in order to improve the detection performance and on the other hand they don't effect the restoration task optimization.
strengths_and_weaknesses: Strengths:
- the paper proposes a simple technique that improves the object detection performance and on the other hand doesn't decrease the image restoration performance.
- they generate adversarial samples using the second-order gradients and cumulative momentum approach.

Weaknesses:
- Why is the performance using the proposed method significantly less in table 2 and table 3.
-  Can authors show zoomed versions of visualizations for easy understanding
- Can authors explain while generating adversarial attack samples how are they maintain image properties like how are the authors make sure whether the adversarial attack image naturally possible image or not.
- what happens if the images have multiple degradations will the proposed method still applicable 

questions: Please refer weaknesses
limitations: Authors discussed limitations that are relevant to the proposed method
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: Aiming at better object detection performance in bad environments such as hazy or low-light scenes, this paper proposes a new training protocol where an image restoration model is supervised by pseudo ground truths. The pseudo ground truths are generated using an adversarial attack method (Adam-like targeted attack in this paper). By doing so, the trained model shows better object detection performance in hazy or low light scenes than existing studies and plain models.
strengths_and_weaknesses: Originality

The proposed approach is interesting and it looks different from existing studies.

Quality

- Although the proposed approach is promising and interesting, my main concern is that the proposed method does not show good performance when image restoration models are trained on the pseudo samples of the training set and are evaluated on the test set. This seems natural because the difference between the images before/after performing the attack is slight, and thus it is difficult to learn.

- Another concern is that TOG achieves the almost same performance as the proposed method in Tables 2 and 3, indicating that the technical contribution of this work is limited.

- To show the effectiveness, it would be better to compare the proposed method with a simple baseline method that simultaneously optimizes the image restoration and object detector to minimize the loss of object detection.

Clarify

- There are several unclear points in this paper. For instance, what is "Y" in Tables 2 and 3? Also, what do you mean by "detection" in the caption of Table2? Finally, the authors mention that the mAP of YOLOv3 decreases by nearly 15% from that of clean images in lines 227 and 229, but where can we see the result of the clean images?

- It is somewhat unclear what is conducted and is the purpose of the experiment in Section 4.2.1. Please elaborate on it.
questions: Please see the Strengths And Weaknesses section.
limitations: Yes, the authors mention the limitations of their work but do not mention potential negative social impact.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper rethinks image restoration for object detection from the perspective of adversarial examples and proposes a fine-tuning pipeline by formulating the tasks of image restoration and object detection into one. Unlike most existing methods that focus on modifying object detectors, the paper attempts to adapt restoration algorithms for generating high-quality visual perception and better detection results. To this end, a momentum-based ADAM-like iterative targeted adversarial example generation algorithm is designed to produce pseudo ground truth for fine-tuning restoration models. The proposed methods are evaluated on two image restoration tasks, i.e., image dehazing and low-light image enhancement, and extensive experimental results demonstrate its superiority to state-of-the-arts both in quality and quantity.
strengths_and_weaknesses: Strengths:
1. Image restoration is usually viewed as a pre-processing for high-level computer vision tasks such as detection, but related discussions are rare in existing publications. The paper makes valuable explorations by formulating the two tasks into one.
2. Different from the conventional methods that modify object detectors, the proposed approach aims to adapt the restoration algorithms for improving the performances of both tasks.
3. The proposed Adam-variant adversarial example generation framework is based on Theorem 1, which is proved in the supplement, and thus becomes solid in theory.
4. Extensive experiments are conducted on various datasets, including a dehazing dataset and a low-light enhancement dataset, to demonstrate the effectiveness of the proposed method both in quality and quantity.
5. The paper is written well and easy to follow. It is good to illustrate the idea in Figure 1 and provide the proof and more analysis in the supplementary material.

Weaknesses:
1. L129 uses the math symbol D(x), while L131 utilizes D[R(x)]. It would be better to use a unified symbol. Similar typos are also present in equations 2, 3, and 5.
2. In the sentence “where \hat{x}^{*}=arg min_{x} ||\hat{x}^{*}-\hat{x}||” of equation 6, the symbol \hat{x}^{*} have two different meanings, i.e., a determined value on the left and a variable on the right.
3. In the captions of Tables 2 and 3, the word “ddetection” is a typo.
4. How to determine the initialization of the Number of attack iterations T, Update stepsize λ, and the Magnitude tolerance of Perturbation δ?
questions: See the weaknesses in the above. 
limitations: The authors have addressed the limitations of the proposed method in the paper.
review_title: null

Meta-review: metareview: In this paper, the authors provide an interesting formulation of an adversarial attack that can directly help object detector training in the presence of various degradations. This is a departure from the usual formulation of restoration, followed by detector training. I liked the initial derivation which is elegant and logical, and their experimental results show that mAP is clearly improved over baseline training. 2 of the 3 reviewers supported acceptance (with one being a strong accept). The third reviewer felt that the experimental improvements were insufficient. While I agree that the mAP improvements are not in the "wow" category, I still think the method is solid (as also accepted by third reviewer) and worthy of acceptance.
confidence: Certain
Decision: Accept