Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper extends the compressive recovery defense framework introduced by Bafna et al. (2018), which is mainly against l_0 attacks, to l_2 and l_∞ attacks. They provide guarantees for some recovery algorithms in the case of different kinds of norm bounded noises. The difference between their work and the previous work is clearly clarified. 

Overall, this paper is a follow-up work towards Bafna et al. (2018) but with better theoretical guarantees and ample experiment results to support their robustness against various popular attacks. Given their contribution and inspiration for future work, I think this paper could be accepted to the 2020 ICLR conference. 

In Section 3.2 Recovery Algorithms, the author clearly states three algorithms including IHT, BP, DS, and their modification from the standard ones, but fails to compare the differences between these algorithms. It is not clear about the author’s motivations to proposes these different recovery algorithms and whether their performance varies from each other also remains unknown. Maybe some analysis about their disadvantages and advantages in varied conditions of attacks could be necessary. 

In the Section 3.4 Comparison to Related Work, the author mentions many works aiming at defending against adversarial inputs. However, Bafna et al. (2018) is the only work here that has something to do with compressive sensing. I think maybe the paper should involve some related work here regarding theory of compressive coding besides Bafna et al. (2018). And how they are combined to the defense against adversarial inputs. It would help the readers to have better understanding towards the novelty and breakthroughs in this aspect. 

For the experiments, it would be better to have the comparisons between the proposed algorithm and related methods. Also, the proposed IHT and DS are modified versions. What are the differences in experiments? 

Minor comments:
- Page 2: the line above the equation 1 ‘meaning that x_t (k)…..’, it could be (x_t ) ̂(k)
- Page 6: in the explanation of figure 2, the adversarial inputs are second column and fifth column not fourth column. 

review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: This paper extends the compressive sensing framework introduced in Bafna et al. to handle l1 and l2 attacks. The authors provide theoretical analysis for several recovery algorithms (IHT, BP, DS) and provide experimental result on CIFAR-10, MNIST and Fashion-MNIST. 

My major concern is how significant the provided results are. It is indeed interesting to extend the compressive sensing framework to handle l1 and l2 attacks. However, the proposed recovery algorithms are all classical ones, and it is unclear how novel the analysis is, since the authors do no discuss the technical challenges they overcome or the difference between their proof techniques and the previous ones. Also, it would be nice if the authors could discuss the theoretical results in more detail, e.g., how to interpret them and new insights it brings to us. 

Moreover, some experimental details are missing. In last paragraph in Section 3.1, the authors say ``We then use both x and x′ to train the network''. How do you do so? Just add both x and x' to the training set? 
review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: The paper studies the problem of the robustness of the neural network-based classification models under adversarial attacks. The paper improves upon the known framework on defending against l_0, l_2 norm attackers. 

The main idea of the algorithm is to use the "compress sensing" framework to preprocess the image: Using F, the discrete Fourier transformation matrix, and the algorithm tries to reproduce on every given input x, a vector y with the smallest number of non-zero coordinate such that Fy approximates x. The main algorithms proposed in this paper are sparse iterative hard thresholding (IHT) or base pursuit (BP) which are all quite simple and standardized. 

The intuition of the approach is that l_0, l_2 attackers on the original input x can not allude the sparse vector y by too much, thus the recovered vector Fy could have better robustness property comparing to the original input x. 


The main concern for me is the experiment in this paper. The author does not provide enough details about how the attacker is trained in their task. It seems that the authors only use the attacker trained on a standard neural network. However, since the authors have a preprocessing algorithm (IHT, BP) on top of the given input, the attacker should in principle tries to attack this pre-processing process as well. Since the pre-processing process is not differentiable, it is, therefore, unclear to me how to define the true robustness of the approach of the authors. 

An analog of my argument is if we create an artificial network that has a pre-processing layer that zeros out most of the input pixel, however, if we train an attacker without this knowledge (so it tries to attack a network without this pre-processing), the l_2, l_0 attacker might not be very good for the true network. 


After Rebuttal: I have read the authors' responses and acknowledge the sensibility of the statement. However, I still think the algorithm in this paper is merely a "clever" version of gradient masking, which does not give the neural networks real robustness, it is just harder to design attacks on all these discrete operations.


review_title: Official Blind Review #3

Meta-review: After reading the author's response, all the reviwers still think that this paper is a simple extension of gradient masking, and can not provide the robustness in neural networks.
Decision: Reject