Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper proposes a new black-box adversarial attack method called TREMBA, in which the search for the “adversary” is done in a reduced space z. Summary of its contributions:
-	A attack method that improves query efficiency of black-box attack
-	Produces perturbations that are effective across different networks
-	Improves attack success over SOTA defended networks 

In general, the paper is very well written, with clear mostly clear exposition and sufficient experimental verification. What follows are the itemized pros and cons (mostly just points that would be good to address):

[pros]:
-	Well written
-	A good overview of previous methods and how the TREMBA fits within them
-	Sufficient experimental validation

[points to address]
-	In Black-Box Attack method of related works, did you mean to say, “Targeted attack is much harder than un-targeted attack for transfer-based method.”?
-	You ought to explain what NES is - Natural Evolution Strategies – and the general description of the method, as it is a major part of your algorithm (Section 3.2). It took two papers to find what NES stands for.
-	In section 3.2 you write – “The sign function provides an approximation of the gradient, …” – is there a citation that should go with this claim? 
-	Make sure to explain all of the variables in the paper, e.g. $\omega_k$ in Eq. (3) or $\nu_k$ in Eq. (4).
-	IS there a particular reason you chose the hinge loss to train the generator? Could you have used other losses instead?
-	“A higher value of $\kappa$ laeds to higher transferability to other models” – maybe a citation required? Or else more intuition?
-	Adding specifics about ConvNet1, ConvNet2
-	How did you set $\epsilon$ ?
-	Would changing the sample size for each method improve the performance for respective methods?
-	It would have been interesting to include a Future Works section
-	A more thorough discussion why the models works so well.

review_title: Official Blind Review #1

final_score: rating: 8: Accept
review_content: Review: The paper proposes a new framework (TREMBA) for black-box adversarial attack. The method utilizes a pretrained source network to learn a low dimensional embedding, it then searches efficiently within the embedding space (using NES) and produces an adversarial perturbation that can attack an unknown target network. A generator model first encodes an input to a latent vector and then decodes it to give an adversarial perturbation as an output. This generator is trained so that it can fool the source network and is then used to find the adversarial pattern when searching in the latent space. TREMBA produces perturbations with high level semantic patterns, and is easily transferable to different target architectures. The paper demonstrates its performance in terms of number of queries vs success rate on different datasets, Google cloud vision API and adversarially defended networks.

- I like the exhaustive evaluation and comparative study done in the paper. It was especially interesting to see how TREMBA outperforms other techniques when attacking SOTA defended networks (on CIFAR 10 and Imagenet dataset). 
- When the method seems intuitive, it shows a novel way to combine transfer-based and score-based attack methods. 
- The motivation behind using low dim embedding space to accelerate adversarial pattern searching is also well explained in the paper. 
- The contributions are well-stated in the paper and definitely show an improvement over the past methods in not only reducing the number of queries but also improving the success rate of the attack. 

Comments:
The loss function L_{target}(xi, t) on Page 3 has yi instead of t in the equation.

review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: This paper proposed a new method for black-box adversarial attacks which tries to learn a  low-dimensional embedding using a pretrained model and then performs efficient search within the embedding space to attack the target network. The proposed method can produce perturbation with semantic patterns are easily transferable. It can be used to improve the query efficiency in black-box attacks. 

- The main idea of this paper is quite simple, i.e., using a autoencoder model to capture encoding in the embedding space and then searching over the embedding space for possible attacks. While searching for adversarial examples in the embedding space is not something new, such as manifold attack or GAN-based attack, the authors claimed that by doing so, it can help reduce the query complexity of black-box attacks. However, it is not immediately clear to me why this can help reduce the query complexity, as intuitively, restricting the attack image space to an embedding space (or a manifold) will naturally increase the difficulty for finding adversarial examples. The authors’ explanation is not quite convincing to me since many adversarial examples are not necessarily on the embedding space.

- Algorithm 1 is not clearly written and I do not understand the update rule in Algorithm 1. What is Li exactly? If Li means eq(1) or eq(2), it seems totally independent of sampled Guassian noise? Also, the update rule in Line 5 of Algorithm 1 is different from what is described in eq(4) or other black-box attack algorithms. Can the author explain the algorithm design with details?

- In experiments section, the authors miss a few important black-box attack baselines. I would suggest the authors to further comment and compare with the following black-box attacks to better demonstrate the performance of the proposed algorithm.

Ilyas, Andrew, Logan Engstrom, and Aleksander Madry. "Prior convictions: Black-box adversarial attacks with bandits and priors." ICLR 2019.
Moon, Seungyong, Gaon An, and Hyun Oh Song. "Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization." ICML 2019.
Chen, Jinghui, Jinfeng Yi, and Quanquan Gu. "A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks." arXiv preprint arXiv:1811.10828 (2018).

- Also can the authors further conduct experiments using more common choice of \epsilon to help the reader get better understandings. For example, add ImageNet experiments with \epsilon = 0.05.

Detailed comments:

- In section 3.2, the author suggests that by removing the sign function, the attacks can be more effective in (Li et al., 2019).  I didn’t find the corresponding argument in (Li et al., 2019). Can the authors be more specific on this argument?

-------------------------
I have read the response and it addressed my concerns. I will increase my score
review_title: Official Blind Review #3

Meta-review: This paper proposes a new black-box adversarial attack approach which learns a low-dimensional embedding using a pretrained model and then performs efficient search in the embedding space to attack target networks. The proposed approach can produce perturbation with semantic patterns that are easily transferable and improve the query efficiency in black-box attacks. All reviewers are in support of the paper after author response. I am very happy to recommend accept. 
Decision: Accept (Poster)