Venue: NeurIPS 2021 Track Datasets_and_Benchmarks Round1

Reviews:

final_score: rating: 5: Marginally below acceptance threshold
review_content: summary and contributions: In this paper, the authors present a benchmark to investigate the robustness of the commercial face detection system, such as Amazon Rekognition and Microsoft Azure. Using four public facial datasets, they firstly design a metric to measure the errors of the face systems, generate the corrupted images using 15 corruptions, and feed the clean and corrupted images to calculate the relative errors. They also report and analyze the benchmark results. 
strengths: This work mainly focuses on the robustness of the commercial face detection system, through 15 corruptions. Besides, they also do a detailed analysis on the results, which might be useful and helpful for the owner of the APIs to do further improvement. 
weaknesses: It would be much better if they could provide some cause and effect. Besides, the proposed metric and the whole process are very similar to the previous work [Hendrycks and Dietterich, 2019], since they used the 15 corruptions and similar metrics. They only mentioned twice in lines 42 and 96 in the manuscript, with a lack of comparison. 
correctness: Yes. Both of them are appropriate and performed correctly. 
clarity: Yes. This paper is well written and easy to follow. 
relation to prior work: The authors should compare their work with [Hendrycks and Dietterich, 2019] since they used the 15 corruptions and similar metrics. They only mentioned twice in lines 42 and 96 in the manuscript. Maybe the authors need to do more comparisons. 
additional feedback: Minors: 1. In lines 184 and 185, the authors claim that ‘Overall, AWS has fewer errors than Azure on corrupted data though the magnitude of the difference 185 is small. The mrCE for AWS is 12.3% whereas Azure is 3% higher than that. See Figure 3.’ However, the authors might miss reporting the whole results on two APIs. 
2. Between lines 146 and 147, there is an equation to indicate the relative corruption error. But, I found three types of ‘r’. I suggest the authors could re-organize it. 
3. There exist two kinds of ‘mrCE’ and ‘mRCE’ in the figure or manuscript. I suggest the author could only use just one. 
4. In line 144, if possible, the authors might provide some examples of the system’s response to understand its length. 
5. I suggest the authors could use just one image to show the 15 corruptions.
review_title: A face detection robustness benchmark with limited comparison with previous highly related work.  

final_score: rating: 6: Marginally above acceptance threshold
review_content: summary and contributions: The authors evaluated the robustness of Microsoft Azure and Amazon Rekognition commercial face detection and analysis systems. The robustness analysis studied how adding different noise types with varying severity (fifteen types of realistic noise perturbations across five levels of severity) impacts the performance of these commercial systems in detecting the face.  For their analysis, the authors leveraged four existing face datasets, namely,  UTKFace, CCD dataset, Casual Conversation dataset, and  Open Images dataset V6.  Based on their experiments, the authors conclude that individuals who are older, masculine presenting, darker skinned, and subject to dim light conditions are more susceptible to errors than individuals belonging to other groups. 
strengths: Relevance to the broader research community: The authors clearly state what the paper does not address, in other words, they recognize some of the shortcomings. This shows that the authors have looked at the problem from a broad perspective, even if they could study only a part of the larger problem. This gives a good holistic picture to the readers of the paper. 

Accessibility: The paper is generally presented well, with good structure and clarity

Ethical and social implications: The authors acknowledge that it would be wrong to interpret and generalize these results across different demographic groups. 

Accountability: The authors have answered all the questions in the checklist, and provided other relevant information such as the cost incurred in conducting the experiments, detailed description of their experimental setting, etc.

Significance of the contribution: The authors consider an important problem and focus on an interesting setting within the problem context. 
weaknesses: Significance and Contributions: There are quite a few concerns regarding the results presented, the datasets used in evaluation, the metrics proposed, and the analysis of the results themselves. Details are provided below. 

1. The main claim on having "mixed results on system superiority" is questionable, especially given that on some subsets of the datasets, reverse trends were observed. These patterns remind one of the "Simpson's paradox", and therefore demands further analysis to understand which of the two opposing results is actually valid. In order to analyze this issue, it is necessary to understand the causal structure governing the various variables of interest in the dataset and the problem under consideration. As such, the validity of the claims therefore is questionable. 
2. The conclusion made with respect to individuals who are older, masculine presenting, darker skinned, and those which are subjected to dim lights is perhaps not consistent across all the datasets studied in the paper. The datasets are not having similar characteristics, and so it is not clear how the results can be compared to arrive at a general trend. For e.g., the age distribution varies significantly across the datasets. So it is not clear as to what "older" means in this context when the authors make their claim. 
3.  Some bias might have been introduced as a consequence of the experimental design-- both in terms of the number of images taken from the individual datasets, as well as the type of information available in each dataset.  Only about 8194 images are from MIAP as opposed to ~22000 from UTK and CCD datasets. While there has been some randomness in selection in order to counter for class imbalance, one cannot discount the fact that the distributions of these individual datasets are different. For e.g. Adience dataset has 8 age buckets, which is not necessarily the case in other datasets. This raises questions related to the intersectional results presented in the paper. 
4. The evaluation metric proposed is not so very robust. The relative error in detecting the number of faces in a clean image and a corrupted image is not a reliable proxy---given that there can be many scenarios leading to false positives and false negatives. So, this cannot be a reliable indicator of a system's performance in detecting the face. 
5. Some relevant prior work is not cited, the authors might want to explain how the present study takes the field forward in the context of these prior works. 

Relevance to the broader research community :

In the context of the above concerns, the applicability of these results in a broader setting, and the benchmarks provided are not very robust. 



correctness: There are issues with respect to the soundness of the claims made in the paper given that opposite trends were observed on data subsets and entire datasets across the two systems. Please see responses under "weakness" for details. 
Also, there are issues related to the robustness of the evaluation metric as detailed earlier. 
The experimental designs are somewhat biased in that the data distributions/information available in the datasets considered are different.  Please refer to the previous response for details. 

clarity: Yes, the paper is well written with sufficient clarity and neat organization. 
relation to prior work: The authors might want to consider the following relevant prior work and explain how their work is different, compare when possible, and describe how their work advances the field in the context of these prior works.

https://www.cs.cornell.edu/~shmat/shmat_wacv16.pdf




additional feedback: 1. The authors may want to make note of a recent large scale face detection auditing experiment across diverse demographics. It might be interesting to analyze the results of their experimental setup in this problem setting to understand the feasibility of their method and generalizability of their results. 
https://drive.google.com/file/d/1dvrqMzIsaeK2m2LxCVXWYu2K9WFZY32e/view
2. The authors may want to better motivate their problem by describing a practical scenario wherein it would be required to detect faces under such noise perturbations. While it is an interesting problem to study, it would be better appreciated/be more compelling with a practical use case.
review_title: A good attempt at auditing face detection systems; however can be significantly improved 

final_score: rating: 6: Marginally above acceptance threshold
review_content: summary and contributions: The authors prob an important research problem in face recognition technology regarding how the noisy perturbations, including different ages, gender, skin color types, and lightening, could affect the robustness of current commercial face detection systems. They collect a subset of four public datasets from Open Images Dataset V6, The Causal Conversations Dataset, The Adience dataset, and the UTKFace dataset and corrupt the images by adding different types of noises. They use the noisy images to evaluate the robustness of Amazon AWS and Microsoft Azure’s face detection systems and demonstrate some interesting findings.
strengths: 1.	The paper is very well written and clearly conveys their ideas.
2.	It is the first systematic benchmark for commercial face detections that addresses and analyzes how the ``noise’’ affects the robustness of the facial detection system.
3.	It is an important research problem, and their experiments demonstrate intriguing results which are worthwhile for future investigation.
weaknesses: 
1.	The authors algorithmically generate the corruptions of images. Still, some of those noises do not look realistic, for example, the added snow and fog in Fig 1, and in fact, some of the noises in your corrupted images can be removed by many successful denoising algorithms. Such denoising algorithms are easily integrated into the current face detection system. So, could those denoising algorithms be applied to the facial detection systems and make them more robust to your noises? Please comment on this.

2.	Do you have the statistics about the number of images of different gender, ages, etc? When you contrast between two groups of pictures, do they keep balanced numbers of data? Do two contrasting groups of images have the same fractional amount of noises as different types of noises might influence the prediction? To draw a convincing conclusion, the above questions should be well discussed.
correctness: The noise types were added by basic techniques, which is not very convincing. Because it’s difficult to assess how many of these things happen in real situations. Note that the added noises could be addressed by many successful denoising algorithms, which require further investigation.
clarity: The paper is very well written.
relation to prior work: Yes.
additional feedback: Thanks for the authors' feedback. I have carefully checked the authors' feedback. They address my most of questions. I would like to increase my rating as the marginally above acceptance threshold.
review_title: Authors investigate the robustness disparities in commercial face detection. They observe some interesting findings. However, the core contribution of adding noise is not so convincing. Thus, the setup issue may occur in a lab environment rather than in a commercial face detection system.

Meta-review: This paper presents an audit of two commercial facial analysis systems focusing on robustness to various types of image corruptions, with results further disaggregated along age, gender expression, and skin tone. 

The method of analysis is similar to previous work of  Hendrycks and Dietterich. However, this paper focuses the audit on facial analysis systems rather than ImageNet and the results show that the same models exhibit different degrees of robustness to corruptions on ImageNet vs the facial datasets. 

Overall this paper is well written and present results that are well within scope of this track and of interest to the NeurIPS community. However, the reviewers express concern with some of the empirical analysis and the conclusions that can be drawn from them. I believe there is an important contribution in this paper but that it would clearly be strengthened by another round of revisions that more fully address the reviewer's comments, specifically relating to the interpretation of overall trends across datasets and the inclusion of a more detailed error analysis. I encourage the authors to resubmit to the second round of the track.

Decision: Reject