Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper presents a new method to certify the robustness of semantic segmentation models against adversarial patch attacks without extra training.

strength_and_weaknesses: Overall, the paper is interesting and extend the certification for semantic segmentation. 

Strength:
1) This paper is well-written. 
2) This is the first method to certifiably defend against adversarial patch attack on semantic segmentation.  
3) This method can be applied on any off-the-shelf segmentation model without finetuning or any other adaptation.

Weakness:
1. One minor weakness is that this paper did not apply to the STOA transformer based methods such as Segformer. Hope to see the performance on Segformer. 
2. Hope the author can provide the code to check the reproducibility of this paper. 

[1] SegFormer: Simple and Efficient Design for Semantic Segmentation with Transformers.  
clarity,_quality,_novelty_and_reproducibility: The clarify and quality are good.  
For the reproducibility, it is reasonable to me. However, if the author can release the code, it would be much better. 
summary_of_the_review: It implements certified defense under patch attacks on semantic segmentation.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The manuscript addresses adversarial patch attacks for segmentation models. The proposed approach extends previous work on certified patch robustness for image-wide models. It is capable both of certified detection and certified recovery and it can be applied to any semantic segmentation model. The main idea is to apply a set of K masks to the input image, inpaint the void areas with ZITS, and then to detect or undo adversarial patch attack by analyzing all predictions at the given pixel.

strength_and_weaknesses: Strengths
1. adversarial robustness is an important problem
2. a previous image-wide approach [salman21arxiv] has been extended for the case of dense prediction.

Weaknesses
1. This approach is likely going to strongly diminish semantic accuracy at small objects.
2. The majority of input pixels is inpainted. The manuscript does not seem to consider opportunities of attacking the inpainting algorithm either through adversarial patches or through data poisoning. 
3. The second to last sentence of the proof to theorem 1 is not convincing. 
4. Unclear implied guarantees of certification. Consider the example from Figure 18. An adversarial patch has opportunity to affect only T=4 of K=9 masks. Still, the model is going to make mistakes in the remaining K-T=5 masks. Could these mistakes lead to adversarial patch pass unnoticed?
5. Unclear relation with respect to adversarial training. Would it make sense to combine these two approaches?

clarity,_quality,_novelty_and_reproducibility: The manuscript is hard to follow (eg. paragraph certified recovery in section 4.1) and has several weaknesses (see above). 
summary_of_the_review: The reviewer perceives moderate novelty, tough reading and several weaknesses.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposed Demasked Smoothing (DS), a certified defense against adversarial patch attacks on semantic segmentation. The empirical performance outruns baseline certified defenses such as DRS.
strength_and_weaknesses: While to my knowledge I agree that this paper is one of the first certified defenses proposed for semantic segmentation, I have several questions about the current presentation of the results (see the following sections).
clarity,_quality,_novelty_and_reproducibility: 1. While it is true that the defense applies to any segmentation model, the defense requires the use of an off-the-shelf image inpainter, which could be the bottleneck (or even harmful) to certified performance if the inpainter is not reliable. Can the authors do an ablation study on the effect of image inpainter?

2. The certification criterion seems to be largely different from certified patch defense, in that there is no notion of majority vote on masked parts. Rather, the proposed defense aims at recovering a consistent pattern of the masked part and uses it for the final certification. In a way, the recovery is either correct or incorrect, and there is no notion of correctness when there is some inconsistency of demasked results, which intuitively should give stronger certified results. Can the authors comment on this? Also, if I understand correctly, the proposed method cannot certify the maximum size of a certifiable patch, which is another limitation. The certification is more similar to robust segmentation recovery using multiple damasked segmentations from an inpainter. I hope the authors can comment more on the limitation of the proposed method.

3. To make a fair comparison to DRS and Randomized Cropping, can the authors compare semantic segmentation similar to their settings (e.g., using segmentation models robust to random masking)? Is there still any notable performance gain?
summary_of_the_review: Sufficient novely on certified defense for semantic segmentation, though the certification seems rather restrictive (e.g., requiring very high consistency of image recovery rather than majority voting). More discussions on the working mechanism, limitations, and additional comparisons are needed.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The work provides their "DEMASKED SMOOTHING" approach, which the authors argue provide defence framework against patch attacks for segmentation models. They evaluate their model on semantic segmentation datasets ADE20k and COCO-Stuff-10K. They use models trained on existing benchmarks, evaluated on various masking schemes. The authors discuss the results and approach compared to baselines in Section 5.
strength_and_weaknesses: Strength:
* The work is well organized, clear to follow with no major grammatical errors
* The empirical evaluation seems reasonable, along with the prior work.
* The results on the benchmarked datasets seem promising.


Weaknesses:
* The theoretical grounding is not clearly explained in the main paper.
* Limitations are not clearly described, evaluation limited to semantic segmentation domain

clarity,_quality,_novelty_and_reproducibility: As detailed above, the work is clear to follow. It seems reasonably reproducible based on the details in Algorithm 1 and Section 4. The authors detail the novelty compared to prior work in Section 2, describing the uniqueness.
summary_of_the_review: Overall the work is well organized, described clearly and makes an original contribution of reasonable significance. The empirical results look promising, although it seems authors skipped some detailed on limitations and expanding theoretical claims.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: In this paper, the authors present a Certified Defences method, Demasked Smoothing, Against Adversarial Patch Attacks on the Semantic Segmentation problem. The authors claim that in Demasked Smoothing, any segmentation model can be applied without particular training, fine-tuning, or restriction of the architecture, and both for certified detection and certified recovery can be achieved using different masking strategies.

The reviewers appreciate that (1) this paper is well-organized and is easy to follow and (2) this paper is one of the first certified defenses proposed for semantic segmentation.
The weaknesses raised by the reivewers have been properly addressed, including experimental evaluation, comparisons with previous works, and clarification of certified defense,

Given the above reasons and the reviewers consistently give positive comments, the AC recommends to accept this paper.

justification_for_why_not_higher_score: The proposed Demasked Smoothing certification requires an upper bound on the size of the expected patch. This is a limiation in this work but seems to be acceptable so far.
justification_for_why_not_lower_score: This paper is one of the first certified defenses proposed for semantic segmentation.
Decision: Accept: poster