Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: The paper proposes a new method for defending against stealing attacks.

Positives:
1) The paper was very readable and clear.
2) The proposed method is straightforward and well motivated.
3) The authors included a good amount of experimental results. 


Concerns: 
1) You note that the random perturbation to the outputs performs poorly compared to your method, but this performance gap seems to decrease as the dataset becomes more difficult (i.e. CIFAR100). I’m concerned that this may indicate that the attackers are generally weak and this threat model may not be very serious. Overall, I’m skeptical of this threat model - the attackers require a very large number of queries, and don’t achieve great results on difficult datasets. Including results on a dataset like ImageNet would be nice. 
2) How long does this optimization procedure take? It seems possibly unreasonable for the victim to implement this defense if it significantly lengthens the time to return outputs of queries. 
3) Although this is a defense paper, it would be nice if the attacks were explained a bit more. Specifically, how are these attacks tested? You use the validation set, but does the attacker have knowledge about the class-label space of the victim? If the attacker trained with some synthetic data/other dataset, do you then freeze the feature extractor and train a linear layer to validate on the victim’s test set? It seems like this is discussed in the context of the victim in the “Attack Models” subsection, but it’s unclear what’s happening with the attacker. 
4) It would be nice to see an angular histogram plot for a model where the perturbed labels were not crafted with knowledge of this model’s parameters - i.e. transfer the proposed defense to a blackbox attacker and produce this same plot. This would motivate the defense more. 



review_title: Official Blind Review #4

final_score: rating: 8: Accept
review_content: This paper proposed an effective defense against model stealing attacks. 

Merits:
1) In general, this paper is well written and easy to follow.
2) The approach is a significant supplement to existing defense against model stealing attacks. 
3) Extensive experiments. 

However, I still have concerns about the current version. 
I will possibly adjust my score based on the authors' response. 

1) In the model stealing setting, attacker and defender are seemingly knowledge limited. This should be clarified better in Sec. 3.  It is important to highlight that the defender has no access to F_A, thus problem (4) is a black-box optimization problem for defense. Also, it is better to have a table to summarize the notations. 

Additional questions on problem formulation:
a) Problem (4) only relies on the transfer set, where $x \sim P_A(x)$, right? 
b) For evaluation metrics, utility and non-replicability, do they have the same D^{test}? How to determine them, in particularly for F_A? 
c) One utility constraint is missing in problem (4). I noticed that it was mentioned in MAD-argmax, however, I suggest to add it to the formulation (4).

2)  The details of heuristic solver are unclear. Although the authors pointed out the pseudocode in the appendix, it lacks detailed analysis. 

3) In Estimating G, how to select the surrogate model? Moreover, in the experiment, the authors mentioned that defense performances are unaffected by choice of architectures, and hence use the victim architecture for the stolen model. If possible, could the author provide results on different architecture choices for the stolen model as well as the surrogate model?

############## Post-feedback ################
I am satisfied with the authors' response. Thus, I would like to keep my positive comments on this paper. Although the paper is between 6 and 8, I finally decide to increase my score to 8 due to its novelty in formulation and extensive experiments. 
review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: This paper aims at defending against model stealing attacks by perturbing the posterior prediction of a protected DNN with a balanced goal of maintaining accuracy and maximizing misleading gradient deviation. The maximizing angular deviation formulation makes sense and seemingly correct. The heuristic solver toward this objective is shown to be relatively effective in the experiments. While the theoretical novelty of the method is limited, the application in adversarial settings may be useful to advance of this research field, especially when it is relatively easy to apply by practitioners.I recommend toward acceptance of this paper even though can be convinced otherwise by better field experts.


review_title: Official Blind Review #3

Meta-review: The paper proposed an optimization-based defense against model stealing attacks.  A criticism of the paper is that the method is computationally expensive, and was not demonstrated on more complex problems like ImageNet.  While this criticism is valid, other reviewers seem less concerned by this because the SOTA in this area is currently focused on smaller problems.  After considering the rebuttal, there is enough reviewer support for this paper to be accepted.
Decision: Accept (Poster)