Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes how to improve the stealthiness of backdoor attacks. To explain, the distribution of latent vectors has been an effective method to defend against backdoor attacks. However, this paper claims that an adversary can intentionally make backdoor attacks sneakier so that adding backdoor noise does not change the latent vector distribution too much. As the result, the authors propose a new attack method, Wasserstein Backdoor (WB), that has an imperceptibly small trigger and shows small differences in the latent vector distribution.
main_review: Originality: The authors detailed enough about their contribution to improving existing backdoor attacks. This paper seems to be the first work that tried to generate an imperceptible backdoor attack from both the input and latent space.

Quality: This is a very well-written paper, containing both formal discussions and experimental supports.

Theoretically, the paper mostly focuses on how to estimate the regularization constraints efficiently, using the sliced-Wasserstein distance (SWD). The problem of this approach is again pointed out and the remedy is proposed.

Experimentally, the authors first evaluate WB with an existing method with a comparison to an existing method (WaNet). Then, the desired property (WB should generate a backdoor that is not detected by defenses utilizing latent space) is verified against two different defenses: Spectral Signature and Neural Cleanse. In my opinion, the paper could be improved further by comparing its attack performance to other backdoor attacks. For example, does the additional constraint (that the generated backdoor should not change the latent representations from that of the clean input) degrade the attack performance compared to the backdoor attack without such constraint? If so, how much is the performance degradation? Is there some tradeoff between attack performance and recognizability in the latent space?

Clarity: The writing is very clear and understandable. I suggest the authors check all notations being correct once again (e.g., subscript in equation 4).

Significance: The topic (backdoor attack) is an important field of research 1. to understand the machine learning behavior in an adversarial setting, 2. to construct safer real-world ML applications against potential threats. The fact that a backdoor can be imperceptible even from the latent space throws more challenges to the research community working on defenses.

limitations_and_societal_impact: As most attack-related papers do, this paper contains research on attacks that may have negative societal impacts. However, such societal impacts are discussed well by the authors in the conclusion.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper considers the backdoor attack settings, where the adversary has full control over the training process and tries to encode a trigger function into the classifier such that the classifier fails at test time when the trigger function is activated. They propose a new algorithm that trains a parameterized trigger function at the same as the classifier in a min-max fashion. To ensure that the trigger function is not detected, the paper add a regularization term that ensures that the latent representation of the modified samples and the clean samples have the same distribution, they propose to use a sliced wasserstein distance to do this.
main_review: **Originality**: 

The idea of parametrizing the trigger function as a generative model is new in the context of backdoor attacks. However, using an autoencoder to learn an attack patterns is not entirely new and has been proposed in the context for example of the No-Box threat model, I think this should be mentioned and consider as related work. The most related work also using a min-max formulation is (Bose et al. 2020).

Another issue with the related work is L111-113 which are slightly incorrect. [47] doesn't assume they have access to the parameters and [7] assume they have no knowledge and access to the model.

The rest of the related work is well documented, and the contributions are put into the context of existing work on backdoor attacks and defense.

**Quality**:

Overall the claims are well supported, I only have two minor comments:
1. Theorem 1 is slightly incorrect, in the appendix you only prove that the proposed distance is a pseudometric. You also need to prove $\mathcal{R}_\phi(\mathcal{F}_1, \mathcal{F}_2) = 0 \Rightarrow mathcal{F}_1 = mathcal{F}_2$, in order to prove that it is a proper distance function.
2. It would be nice to have confidence interval for the experiments. In particular for Table 1 and 2, right now the difference between WaNet and WB is pretty small, and it's hard to make any significant claim without the confidence interval. I'm also wondering why you don't compare to other attack strategies in this table, in particular against Adversarial Embedding which also seems to be effective against latent-space defense.

I really enjoyed the Figure 1, that clearly shows the efficiency of DSWD. I'm not very surprised by this and think the regularizer act similarly to an entropy regularizer that prevent the attacker from being "too good" but instead force the attacker to be just good enough to fool the classifier.

**Clarity**:
The paper is really well written and the contributions are nicely explained. I was not familiar with backdoor attacks so this part was difficult to understand at first, but once familiar the rest of the paper was very clear.

**Significance**:
The proposed approach seems like a viable approach to generate backdoor attacks that are hard to detect with current defense techniques. I believe this will force people to look into more robust defense against backdoor attacks.

**Additional references**:
- Bose et al. "Adversarial Example Games." ( NeurIPS 2020).
limitations_and_societal_impact: Yes
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a novel backdoor attack that is stealthy in both the input and latent spaces. It argues that the previously proposed backdoor techniques leave tangible footprints in the latent space, thus being easily detected. The authors propose to remove that weakness by adding a regularization term that minimizes the Wasserstein distance between the clean and backdoor embeddings when joint training the trigger function and the classification network. The complex Wasserstein distance is approximated with the sliced-Wasserstein distance (SWD). The authors consider the latent representation at the penultimate layer, thus further simplify SWD computation. The proposed backdoor attack has a high clean and attack accuracy while being stealthy under both input/latent space inspection and backdoor defenses, verified on various benchmark datasets.
main_review: * Originality: The proposed method is new. It addresses a problem that is not considered in the previous backdoor attacks. It designs imperceptible backdoor attacks both in latent and input space. A simplified version of the sliced-Wasserstein distance is employed for that purpose. It cites a good amount of related works.

* Quality: The submission is mostly technically sound. The proposed backdoor attack has a high clean and attack accuracy while being stealthy under both input/latent space inspection and backdoor defenses, verified on various benchmark datasets. The experiments were done thoroughly to support the claims. It is a complete piece of work. 

* Clarity: The submission is well written and organized.

* Significance: This work is significant to the security research community.
limitations_and_societal_impact: ## Limitations
* The proposed method only protects the latent representations at the penultimate layer, which is a bit disappointed. I wonder if removing the backdoor footprint in the penultimate-layer features could eliminate the footprints in other-layer features. If not, how to extend the proposed method to the other layers?
* The cost function in Equation 3 only regulates the penultimate-layer features (Fc, Fb) but not the inputs (x, T(x)). How can the proposed method achieve imperceptible backdoor in the input space, as shown in the Supplementary PDF?
* In Equation 7, is the projection of a penultimate-layer feature via a row of the normalized parameter matrix of the last layer the corresponding logit? If yes, this equation can be further simplified.
* The mismatching between SWD and DSWD in Fig. 1b is concerning. The discussion in L212 seems to be wrong. DSWD is computed with only one direction while SWD is averaged over many directions; thus, SWD should be more accurate and lower.
* Minor comments:
- L286: The improvement, if exists, is very subtle. I would say two methods have similar performance.
- L309: Better move that result from the  appendix to Table 3.
- L109: "... can **pass** visual inspection".

## Societal Impacts
I agree with the discussion at the end of the paper. This paper helps increase awareness of potential backdoor attacks and facilitates the further development of secure and trustworthy DNN models and powerful defensive solutions.
review_title: null

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: This paper proposes a backdoor attack approach for image classifiers. The generated backdoor examples are imperceptible in both input space and the latent space. To do this, the paper optimize the noise to matching the latent representations of the clean and manipulated inputs via a Wasserstein-based regularization of the corresponding empirical distributions. The effectiveness of the method is evaluated on MNIST, CIFAR10, GTSRB, and TinyImagenet, and bypassing spectral signature defense and model mitigation defense.
main_review: Pros:
1. The paper is overall clear written.

2. The paper measures performance on four datasets MNIST, CIFAR10, GTSRB, and TinyImagenet.

3. It is good to see the attack is measured on two defense method and bypass them.

Cons:
1. Marginal Gain. The paper mainly compares with WaNet, and from Table 2, the performance is almost the same. For example, for GTSRB and TinyImageNet, the number is exactly the same. For the MNIST and CIFAR-10, WB is only 0.01 better than WaNet. As MNIST and CIFAR-10 are small datasets, where baselines are already very high, the author should consider using more complex dataset such as ImageNet. On the other hand, on the larger Tiny ImageNet dataset, the gain is 0. Why the method performs worse on All-to-all attack than all-to-one attack? 

2. In Figure 5, it seem both the baseline WaNet and the proposed can pass the detection. What is the special advantage of the proposed method compared with WaNet then?

3. Given that WB's performance is close to WaNet in numbers. What is the motivation of this paper? What is the challenge the addressed by this paper but not the others?

4. Figure 2,3, the author should show t-sne for WaNet too.


limitations_and_societal_impact: Yes.
review_title: null

Meta-review: This paper extends the notion of stealthy backdoors to the latent space (the authors focus on the penultimate layer). The manuscript shows how the proposed attack is able to evade prior defenses for backdoors. Optimizing an objective in the latent space is not completely novel to the adversarial ML area - it has been done in adversarial examples research (e.g., https://arxiv.org/abs/1511.05122) - but it is here demonstrated in the context of backdoors attacks which creates its own sets of challenges. Thus, there is merit to the work proposed here. In particular, experiments show how the proposed attack is able to obtain similar performance to prior approaches while also improving the stealthiness in latent space. I encourage the authors to take into account discussions from the reviews while preparing the camera ready of their manuscript, and to open-source their code. 
Decision: Accept (Poster)