Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: The paper proposes AT-GAN (Adversarial Transfer on Generative Adversarial Net) to train an adversarial generative model that can directly produce adversarial examples. Different from previous works, the study aims to learn the distribution of adversarial examples so as to generate semantically meaningful adversaries. AT-GAN achieves this goal by ﬁrst learning a generative model for real data, followed by transfer learning to obtain the desired generative model. Once trained and transferred, AT-GAN could generate adversarial examples directly for any input noise, denoted as non-constrained adversarial examples. Some experiments and visualizations show that AT-GAN can generate some diverse adversarial examples that are realistic to human perception, and yields higher attack success rates against adversarially trained models. 

Overall, the idea seems straightforward. Benefiting from the GAN, the proposed model could learn the distribution of adversarial examples to attach the target models. The paper is clearly written and some experiments are conducted. However, I have some concerns as below:

1. In the loss function, $\rho$ controls the difference between the outputs of the original and attach GANs, it is expected to see the performance and generated examples with different $\rho$. 

2. The idea seems incremental. The main contribution is to transfer a pre-trained GAN to attach GAN to fool the classifiers. The novelty could be further summarized by highlighting the difference with most related works including but not limited to the aforementioned ones. The current manuscript makes the work seem like a straightforward combination of many existing approaches. 

3. Some experiment settings are not clear. A brief introduction to Model A to B should be given in the main paper, though the details is provided in Appendix.

As most concerns of mine are addressed by the rebuttal and I would like to rise my score. 
   



review_title: a straightforward idea

final_score: rating: 7: Good paper, accept
review_content: This paper proposed the adversarial transfer on generative adversarial net (AT-GAN) to train an adversarial generative model that can directly produce adversarial examples. In the other way, AT-GAN could generate the adversarial examples directly for any input noise. Such a generative model was able to draw non-constrained adversarial examples.

Pros: 
This paper is clearly written with reasonable paper organization covering background, model design, mathematical formula and experiments. The goal of this work is obvious with experimental justification. Mathematical description and experimental illustration are desirable to show the merit of this method.

Cons: 
The reasons of using AC-GAN and WGAN-GP as the pre-train stage are missing.
review_title: A meaningful solution to find non-constrained adversarial examples by using adversarial transfer on generative adversarial net

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper is to train a generative neural networks that can output adversarial examples. The main idea is to first train a normal GAN and then use the idea of transfer learning based on adversarial examples. The aim sounds good but the authors fail to clearly distinguish the idea with the exiting related methods theoretically or numerically. The idea of transferring is good (although not new), but after checking the implementation details, I have to say in the current version, the fact of transferring is quite limited.  

Details:
+ the idea of generating adversarial examples by a trained GAN is interesting.
+ the writing is quite clear.
-  lack of comparison with existing related methods. 
   Consider the core formulation, namely (2), which well describes the idea of this authors. But it is necessary to consider the following ideas: 

   1). generating adversarial permutation (AdvGAN, AI-GAN):  min_G \| G(z,y) \|_p, s.t., f(z+G((z,y)) = y_t \neq y_s.
   It is to train the difference of G_original and G_attack and I think in the training aspects, this is almost equal to the proposed idea. The authors try to argue that the proposed model does not require an input. But in my opinion, no input is a disadvantage:  if only adversarial examples are needed, AdvGAN etc. can feed an random input to original GAN and then add perturbations; but if one wants to attack a specific image, the proposed method will fail.  

   2). attack a GAN to generate adversarial examples (Song's): min_z' \|z - x\|, s.t., f(G(z,y)) \neq f(G(z'),y). 
   The author may argue the Song's attack procedure takes longer time. However, the there is no training time additionally needed . Moreover, I guess the generating capability of Song's idea, which relies on the GAN and there are many well-designed ones, is better than the proposed one.  I would like to see the generating performance of the proposed method on more complicated datasets, e.g., on CIFAR or other HIGH-RESOLUTION images. Another good point of Song's idea is that almost all the attacks on images could be parallelly used. I do not know whether its ASR could be easily improved. 

- The idea of transferring the original GAN to the attacking one is interesting. However, except of using the original GAN as the starting point, I cannot find other facts of "transferring". I would like to know if transferring learning technique could be used to reduce the number of required adversarial examples. 

- The attack transferbility has not been tested. Since there is adversarial samples involved, the obtained GAN is expected to be related to the victim model. 

Additional questions, mainly for the experiments' result 
1. It is good that attack performance on adversarial trained NN is included. But where the adversarial examples come from? Are the examples are generated by AT-GAN?

2. How many examples and time are needed to train the AT-GAN?

3. Since the GAN has been changed, how about the generating capability, i.e., generating failure ratio of the AT-GAN should be reported. 
review_title: AT-GAN: An Adversarial Generative Model for Non-constrained Adversarial Examples

Meta-review: I thank the authors and reviewers for their discussions about this paper. The proposed AT-GAN is a GAN-based method to generate adversarial examples. Similar methods (e.g. Song et al) have been proposed to use GANs to generate adv. examples more efficiently. Authors show their method has some numerical benefits. However, more experiments are needed to further justify it. Also, creating "unrestrictive" adv. examples can cause a risk of generating samples where the true label is flipped. Authors need to clarify it. Given all, I think the paper needs a bit of more work to be accepted. I recommend authors to address the aforementioned concerns in the updated draft.   

-AC
Decision: Reject