Venue: ICLR 2017 conference

Reviews:

final_score: rating: null
review_content: The submission says, "The most similar work to this paper is Sharif et al. (2016), which appeared publicly after our work but had been submitted to a conference earlier." Can you provide more details about this timeline? Other than the three-point description of differences, how does this work differ from the earlier conference submission?
review_title: expanding on the Sharif et al. connection

final_score: rating: 6: Marginally above acceptance threshold
review_content: Description.
The paper investigates whether adversarial examples survive different geometric and photometric image transformations,
including a complex transformation where the image is printed on the paper and captured again by a cell-phone camera.
The paper considers three different methods to generate adversarial examples — images with added small amount of noise that changes the output of a classification neural network.  In the quantitative experiments the paper assumes available access to the neural network and its parameters. Qualitative results are shown for a set-up where the network used to generate adversarial images is different from the test network.   

Strong  points.
- adversarial examples are an interesting phenomenon that is worth detailed investigation.
- the paper is well written and presented.
- Results showing (and quantifying) that adversarial examples can survive a complex image transformation such as printing and re-capturing are interesting.
- Experiments are well done and solid.

Weak points:
- Probably the main negative point is the amount of novelty and contribution. The paper essentially presents a set of experiments evaluating whether adversarial examples survive different image transformations. Apart from that there is no other main contribution / novelty. While the experiments are solid and well-done, this seems borderline.

Detailed evaluation.
Originality:
- the main contribution of this work is the experimental evaluation showing (and quantifying) how adversarial examples behave under various image transformations.  

Quality:
- The shown experiments are solid and well done.

Clarity:
- The paper is well written and clear.

Significance:
- The findings and shown experiments are interesting, but I not sure if the scale and amount of contribution is significant enough for the main conference track. 

Overall:
Experimental paper. Well written. Solid experiments. Not sure if contribution is significant enough.
review_title: Experimental paper. Well written. Solid and interesting experiments. Not sure if contribution is significant enough.

final_score: rating: null
review_content: Based on my understanding, no matter how large \epsilon is, the method proposed in section 2.3 can not guarantee that the adversarial sample will be misclassified as y_{LL}. Actually, it can't even guarantee that the image will be misclassified, no matter how large \epsilon is. See the discussion in Proposition 2 of the paper of Huang et al. [1] I am wondering if the target label actually appears in your experiments. Also, is this effect taken into account in the experiment settings? On the other hand, if the motivation of the LL method is to find a strong adversarial method (as shown in Figure 2), the alpha method in [1] may be a better one.

Also, what is the actual perturbation of the basic iterative method in the results of Figure 2? When \epsilon is large, the actual perturbation may be much smaller than \epsilon. 

[1] Huang, R., Xu, B., Schuurmans, D., & Szepesvári, C. (2015). Learning with a strong adversary. CoRR, abs/1511.03034.
review_title: About the least-likely class method and the basic iterative method

final_score: rating: 6: Marginally above acceptance threshold
review_content: In some sense, the Sharif et al. work "scooped" this paper, but as the authors indicate, the spirit of the work remains somewhat different. Sharif's approach was constrained in an interesting way (usable surface area limited to front portion of glasses frames) and also a bit gimmicky (focused on fooling a small scale face ID system to select among a set of celebrities). The present work is less sensational and more methodical in its study of physical manifestations of adversarial patterns for standard benchmark objects. I think the paper is at least a little above the bar since it poses an interesting question and carries out an informative empirical study.
review_title: incremental but still good to know

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper is well motivated and well written. The setting of the experiments is to investigate a particular case. While the results of experiments are interesting, such investigation is not likely to systematically improve our understanding of the adversarial example phenomenon. Overall, the contribution of the paper seems incremental. 

Pros:
1. This paper proposes the iterative LL method, which is efficient in both computation and success rate in generating adversarial examples. This method could be useful when the number of classes in the dataset is huge.
2. Some observations of the experiments are interesting. For example, overall photo transformation does not affect much the accuracy on clean image, but could destroy some adversarial methods. 

Cons:
1. As noticed by the authors, some similar works exist in the literature. According to the authors, what differs this work from other existing works is that this paper tend to fool NN by making very small perturbations of the input. But based on the experiments and the demonstration (the real pictures), it is arguable that the perturbations in the experiments are still small.
2. Some hypotheses proposed in the paper based on one-shot experiments seems too rushy.
3. As mentioned above, the results of this paper seems not really improving the understanding of the adversarial example phenomenon.
review_title: Experimental paper with some interesting observations. Overall its contribution is incremental

Meta-review: This paper studies an interesting aspect of adversarial training with important practical applications: its robustness against transformations that correspond to physical world constraints. The paper demonstrates how to construct adversarial examples such that they can be used to attack a machine-learning device through a physical interface such as a camera device. 
 
 The reviewers agreed that this is a well-written paper which clearly describes its contributions and offers a detailed experimental section. The authors took into account the reviewer's concerns and the rebuttal phase offered interesting discussions. 
 
 In light of the reviews, the main critique of this work is its lack of significance, relative to existing works in adversarial examples. The authors, however, did a good job during the rebuttal phase to highlight the empirical nature of the work and the potential practical significance of their findings in the design of ML models. The AC concludes that the potential practical applications, while not significant enough to be part of the conference proceedings, are worthy to be disseminated in the workshop. I therefore recommend submitting this work to the workshop track.
Decision: Invite to Workshop Track