Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes an automatic approach for attacking classifiers, by approximating a possible adaptive attack that can take place on a newly-published defense. The methodology (MAMA) applies meta machine learning techniques, by training it on different defenses to let it grasp what might be a good signal to follow when attacking an unknown classifier. The authors then test this strategy and a naive version of it (that is, the one that is only trained on the attacks, and not fine tuned on a test set) against other attacks proposed in literature.
Results suggest a modest improvement against defenses hardened with adversarial training.
main_review: Pros:
+ the usage of meta learning techniques is interesting to create better attacks
+ preliminary step ahead for the research in creating better adaptive attacks

Cons:
- results suggest a too modest improvement w.r.t. the computational effort for training the attack
- only adversarial training is considered

Minor:
- confusion between MAMA and BMA

The creation of automatic adaptive attacks is an important step ahead for the adversarial machine learning community.
However, the proposed technique is hindered by the following key issues.

**Results suggest a too modest improvement w.r.t. the computational effort for training the attack**
The results proposed in the paper show that MAMA and BMA reduces the robustness accuracy of the strongest automatic attack (AA) by a very low delta (Table 5), but the table do not show all the effort that is needed for optimizing the optimizer.
Hence, I am doubtful about the overall technique, since it behaves similarly to other strategies that do not need to be trained on any models.
Also, the deltas shown in Table 5 are computed against the original evaluation, and not the output of the best attack against the considered defense. This is misleading, since the discussion should revolve around the efficacy of the proposed attacks against the other ones, and the table seems to suggest an improvement that is not real.

**Only adversarial training is considered**
While it is true that adversarial training (AT) is becoming widely used, it is not the only defense that has been proposed, or that it will be proposed in the future.
Hence, how this method can adapt to a technique whose loss landscape is very different from an adversarially-trained one? Intuitively, more defenses should be added to the set used in the algorithm, but more experiments should be conducted to understand their effect on the meta learner. Or rather, this should be stated as limitations (that are not discussed).
Finally, the fact that this strategy only addresses AT should be mentioned in the abstract, since it is now misleading the reader into believing that this method can adapt itself to every defense.

**Minor comment: confusion between MAMA and BMA**
The authors might need to better describe BMA and MAMA, maybe by creating a better visual plot.
As it is now, the paper starts by describing BMA, and later MAMA, but the paper title is centered on MAMA. So, the discovery of BMA is a bit misleading while reading.

summary_of_the_review: I opt for a rejection, since I struggle to see a clear contribution w.r.t. the literature. Other attacks that do not need any optimization have comparable efficacy to the ones scored by BMA and MAMA, but without all the effort that is needed for training the meta learner. Also, the table is reporting misleading results in the delta column, since it is computed against the original evaluation, and not w.r.t. the strongest attack against a particular defense.
Also, these techniques only adapt themselves on adversarial trained models, limiting the scope of the meta learner efficacy.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a model-agnostic meta-attack and achieves promising adversarial attack performance compared with state-of-the-art adversarial attack algorithms. The proposed algorithm overcomes many issues, such as the vanishing gradient problem, training instability problem, generalization to other defense models. The detailed experiments support the proposed method.
main_review: I think the proposed adversarial attack algorithm makes a nice contribution to the adversarial machine learning community, and this method can be considered as the main evaluation for a newly proposed defense model. 

The strengths are listed as follows:

1: The proposed adversarial attack has less computational cost compared with other state-of-the-art attacks (As shown in Table 4).

2: The proposed attack has outperformed other strong attacks under 12 robust defense methods.

3: The proposed attack can be applied to a large-scale dataset (ImageNet as shown in Table 5)

The weakness of the paper is the lack of novelty. Meta-learning-based adversarial attacks have been considered before and using RNN as an optimizer has also been considered. The contributions of this paper are those improvements made to improve the performance.


summary_of_the_review: In the perspective of proposing an adversarial attack algorithm, the author has conducted detailed experiments to support the method. However, the contributions of this paper are the improvements to the existing framework.

Hence, I support a marginal acceptance of this paper.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes both a Basic and a Model-Agnostic Meta-Attack, designed to automatically produce more effective update directions during adversarial example generation than standard or hand-crafted evasion attacks against deep neural networks.
main_review: The presentation of the paper was very good. Clearly laid out and comprehensively presented, with thorough experiments to back up the claims.

I am not an expert in this particular area, and so my comments may be misguided or have missed key issues (my Confidence score reflects this).

My main reservation is that the improvement in performance is only minor. That said, since it comes at little extra computational cost, it is certainly not an argument to not use it.

Related to the above comment, the deltas reported in Tables 4 and 5 are against the Reported accuracies from the source rather than the author’s discovered accuracies from their experiments. This seems to show their method(s) in a better light and so is a bit disingenuous.

Some minor comments:
-	Remove “the” (“the maliciously ...”) in first sentence of Introduction. Same at the start of the Ethics Statement
-	In Algorithm 1, n is undefined
-	“be integrating” should be “by integrating” in caption for Table 2
-	Are there missing bold highlights on some of the data in Table 3?
-	The Ethics Statement section is not an ethics statement. It is more of a summary of the paper.
-	In the Ethics Statement: a few grammatical corrections
    o	“effects of” should be “effects on”
    o	“and may promote new adversarial attacks” (i.e. add “and”
-	The second line of the two line equation in Annex B is corrupted (norm)
-	In Annex C, discussion of the MT attack refers to 9 classes. More general to say “all other classes” of course.

summary_of_the_review: The paper provides only small improvements in performance. But since this is at minimal computational cost, this is not necessarily an issue. Given the importance of effective adversarial example generation in properly assessing the risk in usage of ML solutions, any contribution to improving the state of the art is welcome.

The authors draw a distinction to a similar Learning to Learn approach from 2020, establishing that though their approach is not therefore strongly novel, is distinct and has merit in its own right.

Hence I would recommend this paper for publication.
review_title: null

Meta-review: This paper introduces a "model agnostic" attack to evaluate the robustness
of machine learning models, specifically focusing on adversarial training
style defenses. The attack uses a RNN optimizer and meta-learning to achieve
this goal.

The reviews are mixed. The two more positive reviewers appreciated the
technical ideas of the attack, found the paper well written, and noted
the results were stronger than prior attacks.

However the more negative reviewer raises valid concerns around (a) the
magnitude of the contribution compared to prior attacks, and (b) to what
extent this attack will be useful more generally.

Starting with the first point (also raised by the other reviewers) the
total contribution of this paper is to improve attack success rates by
~0.1% compared to the best prior attacks. This is a fairly limited total
gain, especially because this technique requires much more sophisticated
attack techniques.

More fundamental is the question if this attack is useful to the community.
I tend to agree with reviewer 8AXD here that this contribution is rather
limited for two reasons:
1. As the authors acknowledge, the attack is most effective for adversarial
  training techniques, or others that don't make the gradient hard to
  optimize. This limits the attack to a smaller subset of defenses.
2. Complexity complicates attack evaluations. It's hard enough to get an
  attack working in the first place, and this paper has to use some fairly
  sophisticated tools to just get the attack marginally better than
  prior attacks that are (much) simpler. It's not clear that we would
  expect authors of future defenses to be able to get as good results,
  when prior methods are much simpler to apply.

And so on the whole, this paper's main contribution is improving attack
success rate by a small amount, with a fairly complex method, that only
applies to a class of defenses that don't make gradient descent difficult.
So while there is nothing outright wrong with this paper, in its current
form it seems to be adding unnecessary complexity to achieve something
that can already be done with existing techniques.
Decision: Reject