Venue: ICLR 2018 conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content:  The paper investigates using input transformation techniques as a defence against adversarial examples. The authors evaluate a number of simple defences that are based on input transformations such TV minimization and image quilting and compare it against previously proposed ideas of JPEG compression and decompression and random crops.  The authors have evaluated their defences against four main kinds of adversarial attacks.

The main takeaways of the paper are to incorporate transformations that are non-differentiable and randomised. Both TV minimisation and image quilting have that property and show good performance in withstanding adversarial attacks in various settings. 

One argument that I am not sure would be applicable perhaps and could be used by adversarial attacks is as follows: If the defence uses image quilting for instance and obtains an image $P$ that approximates the original observation $X$, it could be possible to use a model based approach that obtains an observation $Q$ that is close to $P$ which can be attacked using adversarial attacks. Would this observation then be vulnerable to such attacks? This could perhaps be explored in future.

The paper provides useful contributions in forming model agnostic defences that could be further investigated. The authors show that the simple input transformations advocated work against the major kind of attacks. The input transformations of TV minimization and image quilting share varying characteristics in terms of being sensitive to various kinds of attacks and therefore can be combined. The evaluation is carried out on ImageNet dataset with large number of examples.
review_title: Review

final_score: rating: 4: Ok but not good enough - rejection
review_content: To increase robustness to adversarial attacks, the paper fundamentally proposes to transform an input image before feeding it to a convolutional network classifier. The purpose of the transformation is to erase the high-frequency signals potentially embedded by an adversarial attack.

Strong points:

* To my knowledge, the proposed defense strategy is novel (even if the idea of transformation has been introduced at https://arxiv.org/abs/1612.01401). 

* The writing is reasonably clear (up to the terminology issues discussed among the weak points), and introduces properly the adversarial attacks considered in the work.

* The proposed approach really helps in a black-box scenario (Figure 4). As explained below, the presented investigation is however insufficient to assess whether the proposed defense helps in a true white-box scenario. 


Weak points:

* The black-box versus white-box terminology is not appropriate, and confusing. In general, black-box means that the adversary ignores everything from the decision process. Hence, in this case, the adversary does not know about the classification model, nor the defensive method, when used. This corresponds to Figure 3. On the contrary, white-box means that the adversary knows everything about the classification method, including the transformation implemented to make it more robust to attacks. Assimilating the parameters of the transform to a secret key is not correct because those parameters could be inferred by presenting many image samples to the transform and looking at the outcome of the transformation (which is supposed to be available in a 'white-box' paradigm) for those samples. 

* Using block diagrams would definitely help in presenting the training/testing and attack/defense schemes investigated in Figure 3, 4, and 5.

* The paper does not discuss the impact of the denfense strategy on the classification performance in absence of adversity.

* The paper lacks of positioning with respect to recent related works, e.g. 'Adversary Resistant Deep Neural Networks with an Application to Malware Detection' in KDD 2017, or 'Building Adversary-Resistant Deep Neural Networks without
Security through Obscurity' at https://arxiv.org/abs/1612.01401. 

* In a white-box scenario, the adversary knows about the transformation and the classification model. Hence, an effective and realistic attack should exploit this knowledge. Designing an attack in case of a non differentiable transformation is obviously not trivial since back-propagation can not be used. However, since the proposed transformation primarily aim at removing the high frequency pattern induced by the attack, one could for example design an attack that account for a (linear and differentiable) low-pass filter transformation. Another example of attack that account for transformation knowledge (and would hopefully be more robust than the attacks considered in the manuscript) could be one that alternates between a conventional attack and the transformation.

* If I understand correctly, the classification model considered in Figure 3 has been trained on original images, while the one in Figure 4 has been trained on transformed images. However, in absence of attack, they both achieve 76% accuracy. Is it correct? Does it mean that the transformation does not affect the classification accuracy at all?


Overall, the works investigates an interesting idea, but lacks maturity to be accepted. Therefore, I would only recommend acceptation if room.

Minor issues:

Typo on p7: to change*s*
Clarify poor formulations:
* p1: 'enforce model-specific strategies that enforce model properties such as invariance and smoothness via the learning algorithm or regularization schemes'. 
* p1: 'too simple to remove adversarial perturbations from input images sufficiently'
review_title: Valuable idea but immature contribution.

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: Summary: This works proposes strategies to make neural networks less sensitive to adversarial attacks. They consist into applying different transformations to the images, such as quantization, JPEG compression, total variation minimization and image quilting. Four adversarial attacks strategies are considered to attack a Resnet50 model for classification of Imagenet images.
Experiments are conducted in a black box setting (when the model to attack is unknown by the adversary) or white box setting (the model and defense strategy are known by the adversary).
60% of attacks are countered in this last most difficult setting.
The previous best approach for this task consists in ensemble training and is attack specific. It is therefore pretty robust to the attack it was trained on but is largely outperformed by the authors methods that manage to reduce the classifier error drop below 25%.  

Comments: The paper is well written, the proposed methods are well adapted to the task and lead to satisfying results.
 
The discussion remarks are particularly interesting: the non differentiability of the total variation and image quilting methods seems to be the key to their best performance in practice.
Minor: the bibliography should be uniformed.
review_title: Well argumented, solid work

Meta-review: A well written paper proposing some reasonable approaches to counter adversarial images. Proposed approaches include non-differentiable and randomized methods. Anonymous commentators pushed upon and cleared up some important issues regarding white, black and gray "box" settings. The approach appears to be a plausible defence strategy. One reviewers is a hold out on acceptance, but is open to the idea. The authors responded to the points of this reviewer sufficiently. The AC recommends accept.
Decision: Accept (Poster)