Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper defines a new problem, Reverse Engineering of Deceptions (RED), that aims to reconstruct the adversarial perturbation applied to a clean image based on the adversarial image. Their contributions are the following:

* RED problem formulation
* Series of "principles" to estimate the perturbations (such as class-discriminative ability and data augmentations)
* Empirical study that demonstrates the effectiveness of the authors' solution across various evaluation metrics and adversarial attacks
main_review: Strengths:

* Paper is easy to understand
* Problem and threat model are well-formulated
* Comprehensive evaluation metrics
* Evaluations on adaptive attacks

Weaknesses:

* From figure 7d, it looks like DO is actually closer to groundtruth than RED is for p < 0.5 -- I may have missed it, but this is not really acknowledged or discussed in the paper
* It's unclear how much more computationally expensive the RED model is, compared to the DO or DS approaches
* How does one practically use this CDD-RED method? Run it on every image in the test-time / live data? In practice, Lp norm adversarial examples comprise of a small fraction of the test-time data/live, and we don't know which examples are the Lp norm adversarial examples. In this study, there are no "control" evaluations -- e.g., on images with random or no perturbations -- so it's unclear that CDD-RED will work better than baselines in the global setting.
summary_of_the_review: This paper clearly defines the RED problem and conducts experiments to show that a classifier optimized for extracting adversarial perturbations can extract such perturbations better than 2 other baselines for a variety of adversarial attacks. A main concern is that the problem setting does not seem well-motivated: in what case will we _know_ whether an image is an Lp norm adversarial image and need to extract the adversarial perturbation? What could these perturbations be used for? Does the authors' proposed method work better than performing some PGD to go back to that true class? Finally, in table 2, the d(x, x_{RED}) is actually lowest for the DO baseline, and the DO baseline has comparable PA to CDD-RED. The results for CDD-RED do not seem significantly better.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a methodology for reverse engineering adversarial perturbations. This allows a defender to recover the original image used to produce an adversarial example and may be an effective tool to mitigating adversarial example attacks.  The paper introduces the concept of reverse engineering adversarial perturbations, defines metrics that quantify reverse engineering performance, creates a framework for training a denoising model to find the adversarial perturbations, and compares the resulting model against adversarial denoising techniques.
main_review: The proposed reverse engineering topic is interesting and novel. The objective seems to be a strong step beyond denoising and could be a strong tool for better understanding and defending against adversarial examples. The evaluation metrics provide a good starting point for understanding the objectives of reverse engineering adversarial perturbations. The overall methodology is straight-forward and would be practically available to both researchers and the industry.

However, the experimental results are limited to the ImageNet dataset, it is difficult to be confident that the experimental results would generalize beyond that dataset without incorporating more datasets. Adversarial examples are inputs specifically designed to fool deep learning models, if an attacker is aware of the use of this methodology would they be able to craft adversarial example to fool both the original and this model?

summary_of_the_review: The major strengths of this paper are:

•	The paper is novel and could be have a considerable impact.

•	The paper provides a strong background that establishes a foundation for reverse engineering adversarial perturbations.

•	The ability to reverse engineer adversarial perturbations could be a powerful tool for understanding adversarial examples better.

•	Because the methodology is demonstrated to be able to handle benign inputs well the methodology could lead to effective defenses against adversarial examples.

The major weaknesses of the paper are:

•	The work only evaluates the ImageNet dataset. And so, it is not clear how it would generalize to other scenarios.

•	While the work compares against attacks it wasn’t trained to recognize, it appears that these methodologies represent similar attacks. (L2 or Linf) attackers It is not clear from these results that the methodology would extend to other types of attackers including L0 or Wasserstein minimized attackers.

Additional Comments:

•	The Adaptive Attack does not appear to be cited in the text.

•	The Interpretation function in the second sentence of the “Attribution alignment” subsection appears to be formatted differently than the rest of the text.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper considers the problem of automatically reconstructing adversarial perturbations from examples in a post-hoc manner. The authors argue that for an effective reconstruction, it is not sufficient to only minimize the reconstruction error but also it is essential to align the predictions of the original and their reconstructed versions. To achieve these goals, the authors combine a denoising network, with a prediction alignment network via a standard combination of their respective losses. The authors incorporate data augmentation to further improve the performance of their approach. The empirical result indicates that the new architecture is able to better balance the prediction alignment and the reconstruction error than the baselines.
main_review: Strengths:
1. The problem considered here is relatively less explored. The paper is well-organized, easy to read, and the algorithmic approach is sound. Overall the paper should be accessible to a wider audience.

2. The experimental results show that the new architecture is more effective than the baseline approaches for the RED problem considered in this paper. 

Weaknesses:

1. The authors do not provide any concrete applications of RED. They mention that the estimated REDs can be used for diagnosing the model in a forensic manner. But it is not clear what one can get out of such type of analysis. One natural application is using REDs for defending against adversarial examples. Given that one of the baselines Denoised Smoothing (DS) that the authors compare against can be used for constructing a provable defense, I am not sure why the RED approach cannot be leveraged to build some sort of defense. Another application can be using REDs for explainability,i.e., to perhaps locate blind spots/missing data in the training set.

2. While the problem studied here is now, the method is somewhat straightforward and consists of combining two architectures via adding their respective losses. Further, unlike DS it appears that estimating the REDs cannot provide any theoretical guarantees.
 

More questions:

1. Have you seen any significant differences in the distribution of the REDs generated by the different attacks, e.g., if certain perturbations can be "only" generated by a certain attack?

2. How does the method compare with the baselines on estimating the REDs on smoothed classifiers?

3. Will the method perform as well on smaller datasets, e.g., MNIST or CIFAR10? Similarly, can REDs be generalized to non-image domains?

4. The text mentions that "Based on the correlation screening, it can infer the properties of the new attack type based on its most similar counterpart in the existing attack library", what can a user gain from inferring these properties?

5. Given that many adversarial attacks are sensitive to the hyperparameters, e.g., initialization, step size for PGD etc., how does the alignment and reconstruction error vary on the different examples created by the same method on the same image wrt the same classifier?

6. Can one build a library of adversarial perturbations collected from different sources and then to test a new model use those instead of running adversarial attacks? Will that provide some sort of reliability?

summary_of_the_review: I believe that the paper explores an interesting problem but does not show any relevant practical applications for an end-user who might be interested in improving the robustness, interpretability, or fairness of their models before/as they are deployed in the real world. I encourage the authors to study which parts of the deployment pipeline can benefit from the estimated REDs.
review_title: null

Meta-review: The manuscrupt studies an unexplored problem: How to reverse-engineer adversarial perturbations from an adversarial image? This leads to a new adversarial learning paradigm—Reverse Engineering of Deceptions (RED). The authors formalize the RED problem and identify a set of principles crucial to the RED approach design. By integrating these RED principles with image denoising, they propose a new Class-Discriminative Denoising based RED framework, termed CDD-RED. 
The reviewers recognize that this topic is important and a promising research direction.
The reviewers are also satisfied with the respones from the authors.
In summary, this paper is recommended to be accepted as it is well-formulated, easy to follow, and has some merits, despite that it needs to be evaluated further.
Decision: Accept (Poster)