Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This work proposes an adversarial training method for self-supervised MDE models based on view synthesis without using ground-truth depth. It uses L0-norm-bounded perturbation in training to improve adversarial robustness against physical-world attacks. The experiments demonstrate the proposed methods can maintain similar performance on the raw data while defending PGD Patch attacks effectively. The idea of using self-supervised MDE is interesting and the novel framework seems novel. My main concerns are about the detailed designs and experiments.
strength_and_weaknesses: Strength:
1. The idea is interesting and seems novel. The structure of this paper is clear. 
2. The paper appears to be technically sound and achieves some improvements over the existing methods.

Weakness:
1. The support of not using L_2 L_inf for adversarial training should be included in the experiment sections. 
2. The experiment is inadequate. This paper only uses L0-norm-bounded attacks and PGD attacks for black-box and white-box attacks. More types of attacks should be added to demonstrate the robustness of the model.  Existing experiments only contain the PGD attacks while ignoring more powerful attacks like Autoattack, which affects the convincing. Besides, are the adversarially trained models still robust to the natural perturbation-based adversarial attacks like adversarial blur attacks, and adversarial light attacks? 
3. The reason for the baseline selection is unclear. The authors can further explain why they were chosen as baselines and at what point they contrast with the newly proposed model. 
4. It claims the synthesized views are realistic. However, there are no experimental supports. 
5. How about the influences of inaccurate projections on view synthesis?
6. The pictures in the article are somewhat misleading. The paper mentions that Figure 1 provides a conceptual illustration of their technique. It seems that in Figure 1 Cs and Ct are provided by two cameras, but the technique uses view synthesis in fact. Although they mention it in section 3, it would avoid misunderstanding if the authors could stress this in the figure.
clarity,_quality,_novelty_and_reproducibility: The structure of this paper is well-organized and clear. But there are still some parts that could be more specific and precise. This paper is likely to provide new methods to improve adversarial robustness against physical-world attacks. However, more experimental evaluation could be added to make their technique more convincing.
summary_of_the_review: This work proposes an adversarial training method for self-supervised MDE models based on view synthesis without using ground-truth depth. It uses L0- norm-bounded perturbation in training to improve adversarial robustness against physical-world attacks. The paper is well organized but the presentation has some details that could be improved. More experiments should be added to justify their technique.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper targets at the task of MDE against the physical attack in a self-supervised manner. This paper proposes a reconstruction pipeline that pasting the projection of a 3D object onto two views and perturbate one of them, and then minimize the reconstruction error for the adversarial training. In this way, the ground-truth labels are no longer required. A loss is proposed to mimic physical attack.     
Experiments are conducted on the KITTI with several attack mode, white box, black box and physical-world attack. 
strength_and_weaknesses: A working pipeline for the MDE task under the self-supervised training.
The image synthesize contains some issue. 
clarity,_quality,_novelty_and_reproducibility: The novelty is somewhat limited. However, as long as it works, it is fine
summary_of_the_review: Combine figure 1 and figure 2, figure 2 can be a subfigure of figure 1.

When summarize the contribution, pls make them concise. Some part of the description of summarized contribution can be moved out to the introduction part.  

“the image in one view can be transformed to yield the image from the other view. For instance, I_t can be acquired by shifting I_s to the left”. This is not that intuitive, which requires dense depth, and the accurate image inpainting process of the possible `holes' caused by scene disparities during the view shift. The situation becomes more challenging when using consecutive frames of video. 

There are image issues, such as inconsistent environment lighting between the scene and object, if we pasting the projection of a 3D object directly onto the image plane. Using a virtual rendering engine, as mentioned in the paper, faces the similar issue. 

Using the warp figures is not that informative for illustrate a figure.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a new adversarial training method for self-supervised MDE models without depth ground truth. The training utilizes the the reconstruction consistency from one view to the other view. And to improve the adversarial robustness against physical-world attacks, $L_0$-norm-bounded perturbations are utilized in training. Results on two MDE networks demonstrate the robustness achieved by the proposed methods.
strength_and_weaknesses: Strength:

This paper propose a self-supervised adversarial training strategy for MDE with view synthesis, and the results is obviously better than the supervised learning baseline and a contrastive learning baseline.

Weakness:

1. The proposed approach is limited on the MDE task with self-supervised setting, while practical depth estimation network are trained with supervised learning. Can the proposed approach be utilized for the situation where the ground truth is provided?

2. The experiments are only conducted on the KITTI which is an outdoor dataset, and I wonder if the robustness can be hold for the indoor scenes, e.g., conduct the experiments on the NYUD dataset.

3. Monodepth2 and DepthHints are not SOTA MDE frameworks. Although the authors have proved the superiority of the proposed self-supervised adversarial training with these two networks compared with supervised loss, more experiments should be conducted with SOTA MDE networks, like [A, B]

[A]The Temporal Opportunist: Self-Supervised Multi-Frame Monocular Depth, CVPR2021
[B]Exploiting Pseudo Labels in a Self-Supervised Learning Framework for Improved Monocular Depth Estimation, CVPR2022

4. The meaning of each method setting should be well shown in Tables 1 and 2.

5. This is one important baseline to compare: minimize the outputs of trained MDE networks with the inputs of clean and adversarial samples.
clarity,_quality,_novelty_and_reproducibility: I think this paper proposes a new strategy for the adversarial training of MDE networks. But the experiments are not sufficient to support the effectiveness of the proposed strategy. 
And this paper has not provided enough materials to guarantee the reproducibility.
summary_of_the_review: This paper needs more experiments to demonstrate their importances and effectiveness. And the paper should be organized with more details.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper addresses the problem of robustness for self-supervised MDE (monocular depth estimation). The focus is on physical world attacks that place an image on a board in front of the camera in order to create an incorrect depth estimation.

The proposed approach follows the adversarial training setting, by including these "board images" during the training phase. Self-supervised MDEs work with stereo cameras where, e.g., the right camera provides the labeling for the left camera. Therefore, a "board image" perturbation on the left image creates a specific perturbation on the right image. The proposed method models this effect from data (left image) to label (right image) via the known relative 3D locations of the cameras.

To create photo-realistic "board images", the approach starts with a realistic 2D image and perturbs it with respect to small 2D changes.
While the goal is to provide small L0 perturbations, this is done in an approximated manner (using tanh as an approximating function for L0)

The experiments start with state-of-the-art MDE models and evaluate the proposed methods on recent MDE attacks.
strength_and_weaknesses: Strengths:
+ The proposed method is explained in detail and every derivation is easy to follow
+ The challenges of creating adversarial examples for the presented regression problem is well motivated and convincingly executed
+ The paper use SOTA models as well as SOTA datasets for the training and SOTA attacks for the evaluation

Weaknesses:
- MDE can also be attacked by having an arbitrary painting on a board. This is neither addressed by the approach nor evaluated in the experiments

clarity,_quality,_novelty_and_reproducibility: The presented method appears to be new and is well written.

In particular, I like the effort that is put into Section 1 to first explain how a 3D attack can be executed and then, to hint that this effort can be reduced by simulating this during training. Therefore, it becomes very clear what kind of attack the paper is focused on, before the derivation of the 3D geometry-based simulation is described.

I can imagine that this paper is a very nice read for everyone who wants to get familiarized with the topic without having too much prior knowledge.
summary_of_the_review: Overall, I like the ideas, the evaluation and the presentation of the paper very much.
Due to the mentioned weakness, I cannot give the paper the highest rate, but I would like to see this paper presented at ICLR'23.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper introduces an adversarial training scheme for self-supervised monocular depth estimation. The work employs the L0-norm-bounded perturbation during training for enhancing the adversarial robustness against physical-world attacks. The authors show that this method is effective in experiments. Overall, the idea and the framework seems to be effective and novel, and all the reviewers are positive on this paper. The main weakness is that more experiments are needed, and the clarity can be further improved, which yet can be addressed in the final version. Authors need to carefully consider the comments of all reviewers, and improve the final version accordingly.
justification_for_why_not_higher_score: The work is limited on the MDE task with self-supervised learning, but in practice, the depth estimation models may be trained with supervised learning.
justification_for_why_not_lower_score: The overall method is interesting and the method is effective.
Decision: Accept: notable-top-25%