Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: This paper proposed a APGDA attack method, in which the model ensemble attack, universal attack, and robust attack are unified. The authors proved their APGDA's superiority in theory, ${i.e.}$, convergence rate and strong attacking ability. All of the mentioned tasks (ensemble attack, universal attack, robust attack) are investigated through experiments.
main_review: $\textbf{Cons:}$

(1) According to Table 1,  it is clear that the proposed APGDA outperforms the compared methods in ${ASR}_{all}$ metric (for ensemble attack task). 
However, I found that in the $ACC_B$ metric, the proposed method performs worse than the comparisons under each setting, indicating the possibility of error due to the model selection and causing my great concern. The same problem appears in Table A3 and Table A4. 

(2)In addition, I think the experiments are not conducted fully. For example, the author conducted experiments (ensemble attacks) on MNIST with model ABCD but forgot to test EFH as tested on CIFAR-10. In Table A4's caption, all of the learning rate and regularization factors are the same as those in Table A3, but why did you change the parameter $\epsilon$ (0.05, 0.03 in $l_{\inf}$, and 2.0, 1.5 in $l_2$)?

(3)The proof of Theorem 1 seems not finished?

(4) When it comes to universal attack, I am confused that the PGD attack is not designed for "universal attack". Thus, comparing with PGD can not demonstrate the performance of the proposed APGDA.

(5)I am scared that the same concern as I mentioned in issue(1) occurs again according to Table 5.

(6) The noise size of the attacking methods has not been fully considered. I think the corresponding results will make this work more solid.
limitations_and_societal_impact: The authors have addressed the limitations.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper studies a min-max formulation for adversarial attacks over multiple domains, which covers attacking ensembling attacks, multiple threat models, and universal perturbations. They propose a regularized formulation and show improvements performance on these tasks. 
main_review: The proposed regularized formulation of adversarial attack appears to improveme the attack performance in all three settings. Empirically, the paper seems sufficient. However, the paper suffers greatly with issues in clarity. The paper as a whole could be improved greatly, and two parts that stand out are: 

1. The paper introduces their formulation as a problem of robust learning. This is somewhat misleading, as the "robust learning" in this paper is referring to a robust formulation of the adversarial attack, and not for updating the model parameters (i.e. "learning"). The latter is what I see most commonly in the literature for robust learning, and it is not clear to me that this is a formulation for adversarial attacks until Section 3. 

2. The results are not clear and require a lot of parsing. For example, the text refers to ensemble baselines, but it is unclear what in the table this refers to (I assumed it was the ones with "avg" under "opt", since the table captions refer to both attacks as ensemble attacks). There is a column in the table that is labeled "Lift" which seems to suggest an amount of improvement, however it is not clear to me what number or metric this is supposed to be improving and I could not find any explanatory text in either the caption or the text. 

Overall, the proposed formulation and the corresponding results seem alright. I do like how the authors studied a simple, generalized regularized formulation and evaluated it in multiple attack settings. However this was only after struggling to parse and understand the paper, the presentation of which was not very clear to me. 

Other minor questions/comments: 

The convergence analysis (Theorem 1) appears to make very strong assumptions on the problem. Specifically, it is assumed that the problem has L-Lipschitz continuous gradients. Is this really a reasonable assumption for the setting considered in this paper (i.e. classification in deep networks)? 

There are some recent works that improved upon the multi-perturbation robustness setting (over MSD) that would be nice to compare to, i.e. "Learning to generate noise for multi-attack robustness" (this is recent work, and so I did not hold this against the authors, but it would be nice to include in the final version). 
limitations_and_societal_impact: I did not find a discussion of the limitations of their work. It would be nice if the authors described some possible properties of their approach that may not be a strict improvement over the compared baselines.
review_title: null

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: The paper provides a general min-max framework to formulate several popular problems in the literature including Ensemble attack over multiple models, Universal Perturbation over multiple examples, and adversarial attack over data transformations. For each case, a standard first-order approach converging to a stationary point of the problem is provided. The effectiveness of the min-max approach compared to the standard empirical risk minimization has been demonstrated by extensive experiments.  
main_review: Major Concerns:
- While the effectiveness of the proposed min-max framework for solving several problems over the regular empirical risk minimization is shown through the experiments, the novelty of such formulations is not clear for the reviewer. There are many papers in the literature using the same min-max formulation for solving such problems, especially for attack generation (see [1]). 

- Moreover, almost all formulations, lemmas, and theorems in the paper use the basic idea that the max of finite terms can be written as the maximization of a convex combination of the terms over a simplex. Mathematically speaking: 
Max (x_1, x_2, …, x_n) = max_{w} w_1 x_1 + w_2 x_2 + … w_n x_n        s.t \sum_{i=1}^n w_n x_n = 1, x_i >= 0 for all I. 

It seems the common element among different investigated problems is the min-max formulation (which is not novel) and the mentioned trick. Thus, it cannot be considered a framework in the reviewer's opinion. 

- From an optimization perspective, the contribution of the paper is limited. The provided algorithms are basically different variations of the projected gradient descent ascent algorithm. 

Strengths:
- The experiments show that the robust formulation (min-max) of the attack generation problem works far better than the average case. 
limitations_and_societal_impact: The authors provide ample justification for the potential benefits of their work in safety-critical AI applications.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposes a unified alternating projected gradient descent-ascent (APGDA) attack by considering the min-max operation for adversarial attack settings. The proposed method can be applied in generating model ensemble attacks, universal adversarial attacks, and robust attacks over data transformations. Extensive results show that the proposed method can achieve better attack performances for these three applications.
main_review: Strength:
- The proposed method is general in generating attacks when multiple domain losses are needed to be optimized together. The insights behind the method in smoothifying and balancing weights are very interesting for the adversarial attack with multiple domains.
- The paper is well written and easy to follow.
- Comprehensive experiments illustrate the strength of the proposed methods over general attack methods. The ablation study and the following analysis are insightful in improving the studied three tasks.

Weakness and comments:
- The method is not that novel as it simply applies non-convex min-max optimization for adversarial attacks. The proposed min-max optimization and concave regularizer are mostly proposed in existing works like [45]. 
- More importantly, a very similar idea for ensemble attack via universal perturbation is explored in [G] (e.g., equation 13 in [G]) even though it is more for black-box attack setting. Comparisons for ensemble model evasions and universal perturbations settings against [G] are very important and discussions about the differences in related work are at least needed.
- The proposed methods are not well compared with state-of-the-art attacks for the universal adversarial attacks. Generating universal adversarial perturbations (UAPs) has been extensively studied in both targeted [A,B,C] and non-targeted scenarios [D, E, F]. The authors should at least compare against one or two recent methods to demonstrate the effectiveness of the proposed methods.

[A] Double targeted universal adversarial perturbations, ACCV 2020

[B] Understanding adversarial examples from the mutual influence of images and perturbations, CVPR 2020

[D] Ask, acquire, and attack: Data-free UAP generation using class impressions, ECCV 2018

[E] Cross-domain transferability of adversarial perturbations, NeurIPS 2019

[F] Regional homogeneity: Towards learning transferable universal adversarial perturbations against defenses, ECCV 2020

[G] Min-Max Optimization without Gradients: Convergence and Applications to Adversarial ML, ICML 2020
limitations_and_societal_impact: No limitations and societal impact.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper adapts the min-max problem proposed for multi-domain robust optimization [45] to the problem of generating adversarial attacks. They show how several adversarial attacks scenarios can be formulated using this min-max, for example they show that this min-max formulation can be used to find successful attacks against an ensemble of models. They also show how this min-max can also be used to train robust models against multiple $\ell_p$ attacks. They show experimentally that the approach outperforms several baseline in several setting.
main_review: **Originality**:
This paper adapts and existing min-max problem that was proposed for multi-domain robust optimization [45] to the problem of generating adversarial attacks. This work clearly explains its contributions and put them into context of existing work. However, the author mention that some paper have explored min-max formulation in the context of adversarial attacks but don't cite them, for example one work related to problem eq. 5 that also uses a min-max formulation is (Bose et al. 2020).

**Quality**:
The claims of the paper are overall well supported. However It would be nice to have confidence intervals for the experimental results.
I really enjoyed the experimental section, I found Table 2 and Figure 1 quite interesting, showing the importance of having adaptive weights and how the weights acts like an attention mechanism to focus more on the hardest task. Table 4 is also quite informative.
The author address the time complexity and additional parameters in section 5.3.

**Clarity**:
The paper is well written and very clear.

**Significance**:
The idea of training against the worst-case scenario is very interesting, this could lead to much more universal attacker.

**Minor comments**:
- Typo L298: $\gamma=\infty$ for averaging case


**Additional references**:
- Bose et al. "Adversarial Example Games." (NeurIPS 2020).
limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The work proposes a min-max framework APGDA that can take in different models related to adversarial robustness. APGDA can generate model ensemble attack, universal attack over multiple images, and robust attack over data transformations. They perform experiments to evaluate their method.
main_review: **Originality:**

**Are the tasks or methods new? Is the work a novel combination of well-known techniques?** 

It doesn't differ much from previous work (Universal Adversarial Training, Shafahi et al., 2018). 

**Is it clear how this work differs from previous contributions? Is related work adequately cited?**

Yes.  


**Quality:**

**Is the submission technically sound? Are claims well supported (e.g., by theoretical analysis or experimental results)? Are the methods used appropriate?**

Partly, claims are mainly supported by experiments. 

**Is this a complete piece of work or work in progress? Are the authors careful and honest about evaluating both the strengths and weaknesses of their work?**

Yes.


**Clarity:**

**Is the submission clearly written? Is it well organized? (If not, please make constructive suggestions for improving its clarity.)** 

Mostly clear. 

**Does it adequately inform the reader? (Note that a superbly written paper provides enough information for an expert reader to reproduce its results.)**

Yes.


**Significance:**

**Are the results important? Are others (researchers or practitioners) likely to use the ideas or build on them? Does the submission address a difficult task in a better way than previous work?**

Not sure. 

**Does it advance the state of the art in a demonstrable way? Does it provide unique data, unique conclusions about existing data, or a unique theoretical or experimental approach?**

N/A
limitations_and_societal_impact: 1. The authors perform many experiments on MNIST, but MNIST is known to be a poor dataset to study adversarial examples, especially in this experiment-based article.

2. As the authors have trained models on MNIST and CIFAR-10, why not demonstrate Table 2 on CIFAR-10? According to Table 1 and Appendix E, their method performs better on MNIST, I suspect it will perform worse on large datasets(e.g., ImageNet).
review_title: null

Meta-review: This review results for this paper are borderline. While the reviewers appreciate some of the positive aspects of the paper (such as the formulation and the comprehensive numerical experiments), they have reservations about the novelty and the presentation of parts of the paper. However, regarding the contribution of the paper, the authors' argument about the novelty of 1909.13806 (published) w.r.t. 1906.03563 (unpublished) is reasonable and may justify the contribution.
Decision: Accept (Poster)