Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: The authors emphasize in this work that a simple logit loss attack may achieve competitive results as a targeted attack assuming a high number of iterations. The authors aim to alert the community in common attacks evaluation practices weakness.
main_review: The paper is very clear, easy to follow, and introduces relevant related work. To the best of my knowledge, their contribution is original as it highlights the transferability potential of attacks with various loss functions (including author proposal) in the context of 100 (and above) iterations.
limitations_and_societal_impact: Authors provide experiments results. However, as often in this field, they do not document any theoretical proof. Also, the authors claim: “directly using the C&W loss performs worse than [proposed] logit loss. For example, in the single-model transfer setting with the ResNet50 as the white-box source model, the C&W loss yields 20% worse performance on average” I would suggest documenting this further.

The author’s experiments are under an epsilon value of 16/255; I encourage them to provide some results with a lower value (e.g 8/255) as transferability may be more challenging with a less noticeable perturbation.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This work introduces techniques to improve the targeted transferability of adversarial examples. The authors mainly propose to use the simple logit loss for this purpose. The transferability is evaluated in three scenarios, including a real-world attack against the Google Cloud Vision API. The technique is also shown in the context of universal adversarial perturbations.
main_review: ## Originality
The originality of this work is rather limited and it is not clearly distinguishable from previous works. I will elaborate in the following:

### Increased number of attack iterations increases targeted transferability
To the best of my knowledge, this is the first work pointing out this phenomenon. But in the end, this is “just” a hyper-parameter choice, and therefore not much of a novelty. As the authors correctly noted, each work should verify the correct choice of hyperparameters [30]. Hence, it is less a merit of this work, but more of a fault of previous works. Anyway, this message should be communicated to the community, and I appreciate the author's effort in doing so, but I would not consider this a major novelty or contribution of this work. 

### Logit Loss
The introduced logit loss is indeed not new and similar to the C&W loss. The authors describe that the C&W is less efficient than the used logit loss, however, they fail to provide qualitative results and to describe their exact setup. It is therefore difficult to judge their assessment (line 192). The C&W loss has a parameter c manipulating the “overshoot” of the highest logit in the targeted scenario, which was initially introduced to limit the perturbation magnitude. This parameter, therefore, introduces a trade-off between the attack strength (or worse-case performance similar to Table 3) and the perturbation magnitude. Setting c to large values (ideally infinity), lets the targeted logit increase in an unbounded manner, very similar to the used logit loss. The main difference remains that the second-highest logit is still taken into account in the optimization process in the C&W loss. I would have valued a more in-depth analysis and discussion of the loss functions: For example, testing the targeted transferability and resulting perturbation magnitude with the C&W loss over increasing c-values, compared to the used logit loss.

### Evaluation scenarios 
I appreciate the thorough evaluation of the different scenarios in Sec. 4.1. Especially the worse-case transfer setting with low-ranked target classes is insightful. Also, a real-world attack on the Google Cloud Vision API is interesting and emphasizes the need for research on adversarial examples. I value this as a contribution of this work, which can be a good evaluation template for future works. 

### Data-free and training-free targeted UAPs
I do not agree with the authors' claim that their approach is training-free since an optimization (training) for “300 iterations“ (line 340) is still required. [19] also optimizes the perturbation directly, without training a separate network. [19] also tested a logit loss (see [19] Table 2). In fact, I can not distinguish the proposed approach from [19], and the authors failed to provide such a distinction and in which sense the shown approach is novel. The authors should clarify that, and ideally, provide a direct comparison with [19].

## Quality
Overall, the quality of this work is good. As mentioned above, a few claims are not well supported, such as the inferior performance of the C&W loss or the training-free statement of UAPs. 

## Clarity: 
Overall, this work is well written and organized and includes supplementary material.  

## Significance: 
The results are somewhat important. For one, this work notes again that researchers should follow common guidelines when testing attacks. I believe that future researchers might use the logit loss and an increased number of iterations for targeted attacks. 

Overall, this paper is difficult to judge. On the positive side, the paper is well written with a good evaluation of the targeted attacks. However, the technical contribution is rather limited and the paper is vague at some points (Evaluation of the C&W loss) or makes wrong claims (training-free). Hence I am judging this paper as marginally below the acceptance threshold, but am looking forward to the author's rebuttal to address my concerns and the other reviewers' opinions. 
limitations_and_societal_impact: The authors did not properly state the limitations of their work, nor provided a paragraph about the social impact.
review_title: null

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: For the targeted attack in transferable and universal settings, this work has two major findings: (1) longer iteration is beneficial for improving the performance; (2) logit loss is more powerful than common CE loss.

main_review: Originality: limited. The two contributions in the summary have already been widely known. Longer iteration is useful for improving performance. For example, in most UAP related papers, they use longer iterations to either directly optimize the UAP or training a generative network. In the specific task of transferable attack, [1] has shown the same effect. Even we assume that no one has reported this phenomenon, this is no more than a parameter-tuning. Longer training increases the performance, which is well expected. Regarding the second contribution, logit loss and other loss has been proposed in [2,3]. It is suggested that the authors clearly discuss these losses in previous works unless the authors intend to claim logit loss is first proposed in this paper and no other works have attempted to propose similar losses.

Quality: The writing quality is excellent.
Clarity: Very clear. Easy to understand
Significance: At least not very significant to me but it is also not a weakness because this work attempts to solve an interesting problem with solid results

[1] Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks. Link:https://arxiv.org/pdf/2107.01809.pdf
[2] Understanding adversarial examples from the mutual influence of images and perturbations. CVPR2020
[3] Cross-domain transferability of adversarial perturbations. 

limitations_and_societal_impact: Overall, this paper is written well and easy to understand. The main limitations of this work are as follows:
(a) low novelty. Neither longer iteration or logit loss is novel to me (I might be biased).
(b) claiming logit loss as the main technical finding without clearly discussing similar losses in previous works. If logit loss is not first proposed in this work, the authors should be clear on it. 
(c) What about results on other benchmark datasets, such as MNIST, SVHN? Since the proposed method works well on ImageNet, it is only a minor concern.
(d) Comparison with recent work [1]? For this review, the authors do not need to compare with [1] because it is not published yet. My review is not influenced by [1]. But I suggest the authors cite and compare with it in the future revision if possible. Especially, [1] also uses long iterations and propose/discuss other losses.

I enjoy reviewing this paper. My concern (a) can be biased and the authors should not be discouraged by it. Since
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper argues that the common practice of limiting the attack iteration in transferable attack research unreasonable, which is proved by the fact that simple transferable attasks with logit loss can achieve high targetted transferability if the attack can be optimized to a much larger number of iterations. The proposed attack can achieve competitive performance to SOTA resource-intensive attacks under various settings, and can be extended to a effective way of geerating targetted universal adversarial perturbations.
main_review: This paper provides an interesting yet inspiring observation on simple transferable attacks. I like the argument that it's misleading to compare methods that are not fully converged, and find the claims of the paper well supported by experiment results. Although this paper does not provide much novel methods or theortical analysis, I believe the findings in the paper can have large impact to the field and encourage people to test transfer attacks with a larger attacking iteration in future works.

As the paper is overall well written, I do have some questions:
1. In Table 5 its interesting to see that logit attack performs significantly better in ensemble transfer setting than in a single model. Is this a coincidence? Any explaination on this?
2. The author mentions when discussing Fig 5 that logit attack will "attack the robust feature" to boost transferability. As this may hold in unbounded attack, in practical bounded setting the small purterbation allowed may not be enough for the attack to capture the targetted robust feature, as the reason why robust feature are robust is that they will not be easily changed under small perturbation. A more careful discussion/experiment is needed for this argument.
3. The discussion on the exact attack complexity is not adequate. As the author mentions the logit attack as "simple attack", it do need much more optimization steps for each attacking image comparing to other methods like TTP or FDA. In the case of attacking a large amount of images, this difference in attack generation cost will gradually fill in the gap of the cost setting up other attacking algorithms. A more detailed discussion is needed on what's the cost of setting up attacks like FDA, what's the difference in the cost of attacking a single image, under what condition will the overall cost (setting up and attack) of the logit attack is smaller. This will help readers understand if the logit attack is practically appliable.
4. The paper discusses UAP generation based on the logit attack, yet does not show what the final UAP looks like and what's its strength comparing to the range of the image.

In summary I believe the paper is worth accepting given its potential large impact on the field, yet the outstanding concerns may undermine the quality of the work. I would love to increase my score if th author can comment on my concerns.


## Edit after rebuttal

After reading the rebuttal and other reviewers' review, I find the main concern lies in the novelty and significance of this work. On this point personally I agree with the point raised by the author in their reply to Reviewer 1r48 and their public comment, that even this seems like a simple fix it still opens a new and important aspect that future researchers can reflect on previous works and evaluate their own work in a more complete manner. With this being said I don't think this should be a reason of rejection.

As for my own concerns in the initial review, I think they are well responded by the author in the rebuttal. I would suggest the author to include those points mentioned in the rebuttal into the paper if accepted. Namely, logit attack enables the further improvement on attack success rate than TTP, and the fact that logit attack not only require less set up time but also require no additional training data and hardware.

With my concerns resolved, I would like to increase my score to 7 and argue for acceptance of this work.
limitations_and_societal_impact: The discussion on the attack generation cost is inadequate. See my question 3 in previous section for detail.
review_title: null

Meta-review: The paper shows a simple logit loss can yield competitive results with the state of the arts for transferable targeted attacks. Some reviewers had concerns regarding the contributions and the originality of this work. One reviewer suggested that the main contribution of the paper feels like an improved hyper-parameter tuning. Reviewers were happy with authors' responses during the rebuttal. Overall, I feel the paper lacks depth in the contributions. I'd suggest authors to include more analysis/experiments in the revised draft.  
Decision: Accept (Poster)