Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper proposes adversarial attacks by modifying semantic properties of the image. Rather than modifying low-level pixels, it modifies mid-level attributes. The authors show that the proposed method is effective and achieves stronger results than the pixel-level attack method (CW) in terms of attacking capability transferring to other architectures. Importantly, the authors show results on a variety of tasks, e.g. landmark detection and segmentation in addition to classification/identification. The most related work is Joshi 2019 and the authors show that the method used in that work (modification in attribute space) is inferior to modification in feature space still via attributes, as the authors proposed. However, I have a few comments and concerns:
1) The authors mention on page 3 they assume M is an oracle-- what is the impact of this?
2) The results in Table C don't look good-- the proposed method can *at best* (in a generous setup) equal the results of CW-- maybe I missed something but more discussion would be helpful.
3) Is there a way to evaluate the merits of semantic modification (beyond attack success) in addition to "does it look reasonable"? The authors mention attribute-based modifications are more practical, how can this be evaluated? If attribute-based attacks are better, is there a cost to this? How easy is it to make attribute-based attacks compared to low-level ones?
4) The authors mention that for their transferrability results, they "select the successfully attacked..." (page 7). What is the impact of this, as opposed to selecting non-successfully attacked samples?
5) Re: behavior with defense methods, is the advantage of the proposed method a matter of training the defense methods in a tailored way, so they're aware of attribute-based attacks?
review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: The authors describe a method for adversarially modifying a given (test) example that 1) still retains the correct label on the example, but 2) causes a model to make an incorrect prediction on it. The novelty of their proposed method is that their adversarial modifications are along a provided semantic axis (e.g., changing the color of someone's skin in a face recognition task) instead of the standard $L_p$ perturbations that the existing literature has focused on (e.g., making a very small change to each individual pixel). The adversarial examples that the authors construct, experimentally, are impressive and striking. I'd especially like to acknowledge the work that the authors put in to construct an anonymous link where they showcase results from their experiments. Thank you!

Overall, I think that this is interesting work that can help to broaden the study of adversarial examples and make them more applicable even in non-adversarial settings (e.g., by making models more robust to the changes in semantic attributes that the authors consider). There has been quite a bit of interest in the community in adversarial examples that are not just $L_p$ perturbations, and I believe that the authors' approach will encourage a good deal of follow-up research. 

However, my main concern with the paper is that in my opinion, it does not sufficiently address why it is important to generate adversarial examples in the way they do. For example:

1) Is the argument that this is a more powerful attack surface, so adversaries should take note (and defenders should figure out how to defend against this)? If that is the case, what is the attack model under which these attacks are realistic? For example, the original $L_\infty$ attacks are motivated in the sense that the adversarial examples are visually imperceptible, so they might not be noticed by the end-user. What is the equivalent argument for these semantic attacks?

2) Is the argument that these semantic attacks somehow capture a more realistic part of the data distribution over all natural images, and therefore it is good to have models that perform well on these semantic adversarial examples even if we're not concerned about an adversary (e.g., because the model might generalize better to other tasks or be more causally correct)? If that's the case, then I think this needs to be explored more. For example, what about the following straw man baseline: use a controllable semantic-attribute-based generator to generate semantically different images without any notion of an adversarial attack, and then do standard $L_p$ attacks on that generated image? How would that be better or worse than the proposed method?

3) Or is the argument that it is just good to be able to generate examples that models get wrong? If so, why, and why is this method better than other methods?

I think the paper would be significantly stronger if the importance and implications of their work were explicated along the above lines. For this reason, my current assessment is a weak reject, though I'd be open to changing this assessment.

=== Less critical comments, no need to respond or fix right away ===

While the overall concept and approach was clear, I generally found the notation and mathematical exposition difficult to follow. Please be more precise. Here is a non-exhaustive list of examples from section 3:

a) I'm not sure what's the difference between $x^\text{tgt}$ and $x^\text{adv}$, or between $x^\text{new}$ and  $x^*$. These seem to be used somewhat interchangeably?

b) Equation 3 is the central optimization problem in the paper, and should be written out explicitly using $\alpha$ as the optimization variable, instead of referring to equations 1 and 2 (in which $x^*$ doesn't even appear).

c) I didn't understand equation 4. What does assuming $M(x^\text{tgt}) = y^\text{tgt}$ mean? What happens when that is not true?

d) Equation 5: Why is $y$ in the right hand side by not in the left?

e) Equation 6: $L_\text{smooth}$ is missing an argument.




review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: Summary:
This paper proposes to generate "unrestricted adversarial examples" via attribute-conditional image editing. Their method, SemanticAdv, leverages disentangled semantic factors and interpolates feature-map with higher freedom than attribute-space. Their adversarial optimization objectives combine both attack effectiveness and interpolation smoothness. They conduct extensive experiments for several tasks compared with CW-attack, showing broad applicability of the proposed method.

The paper is well written and technically sound with concrete experimental results. I'm glad to suggest accepting the paper.

With the help of attribute-conditional StarGAN, SemanticAdv generates adversarial examples by interpolating feature-maps conditioned on attributes. They design adversarial optimization objectives with specific attack objectives for identity verification and structured prediction tasks. They provide experiments showing the effectiveness of SemanticAdv; analysis on attributes, attack transferability, black-box attack, and robustness against defenses; as well as user study with subjective. The qualitative results also look nice and the code base is open-sourced.

A question out of curiosity, the last conv layer in the generator is used as the feature-map. How is the attack effectiveness of using other layers?
review_title: Official Blind Review #2

Meta-review: I had a little bit of difficulty with my recommendation here, but in the end I don't feel confident in recommending this paper for acceptance, with my concerns largely boiling down to the lack of clear description of the overall motivation.

Standard adversarial attacks are meant to be *imperceptible* changes that do not change the underlying semantics of the input to the human eye. In other words, the goal of the current work, generating "semantically meaningful" perturbations goes against the standard definition of adversarial attacks. This left me with two questions:

1. Under the definition of semantic adversarial attacks, what is to prevent someone from swapping out the current image with an entirely different image? From what I saw in the evaluation measures utilized in the paper, such a method would be judged as having performed a successful attack, and given no constraints there is nothing stopping this.

2. In what situation would such an attack method would be practically useful?

Even the reviewers who reviewed the paper favorably were not able to provide answers to these questions, and I was not able to resolve this from my reading of the paper as well. I do understand that there is a challenge on this by Google. In my opinion, even this contest is somewhat ill-defined, but it also features extensive human evaluation to evaluate the validity of the perturbations, which is not featured in the experimental evaluation here.

While I think this work is potentially interesting, it seems that there are too many open questions that are not resolved yet to recommend acceptance at this time, but I would encourage the authors to tighten up the argumentation/evaluation in this regard and revise the paper to be better accordingly!
Decision: Reject