Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This paper tackles vulnerability to poisoning. An important subtopic of adversarial ML.
The authors propose using a GAN to generate poisoning data points, as an alternative to existing methods.

While most (or all) of the paper is devoted to illustrate the effectiveness of the approach against *non-protected* ML. My only and biggest concern with this paper is that no defense mechanism has been tested against, and there are many in the literature. (see e.g. Diakonikolas et al ICML 2019).

Thus my question for the rebuttal period: How would pGAN perform when defense mechanisms are deployed during the learning phase? (ideally, a thorough experiment illustrating the strength of pGAN against a few defense mechanisms would help re-evaluating the score)
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: This paper introduces a new generative poisoning attack method against machine learning classifiers. The authors propose pGAN with three components to maximum the error of classification and guarantee undistinguished poisoning data for the discriminator. The experimental results show that the hyperparameter \alpha significantly affects the poisoning data distribution and pGAN leads to specific error in a classification task.

This paper should be weekly accepted, considering the following aspects.

Positive points: (1) The experiments seem solid. The overall performance with different parameters and the corresponding error type have been evaluated. (2) The error-specific and performance-control characteristics of pGAN seem to be interesting. (3) The paper is well organized.

Negative points: (1) The authors should provide more justification on equation-3. Why do the authors directly average different loss for the discriminator and the classifer? (2) The function of the discriminator is not very clear, especially for the classification error test. Does the discriminator exclude the poisoning data according to certain rule? It would make more sense if the classification error measured from the data the discriminator selects. (3) pGAN can produce error-specific attack without sufficient justifications. Why can pGAN lead to the inclination? Is it possible for pGAN to control the specific error tendency? (4) For the error-specific attack task, it would be better to provide an ablation experiment. For example, authors could implement pGAN by ignoring the detectability of the discriminator (i.e. \alpha=0) or typical pGAN when they compare with the label-flip operation. Please explain which component contribute to the error-specific inclination.

review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: 
This paper proposed a method pGAN based on Generative Adversarial Networks to generate poisoning examples in order to degrade the performance of classifiers when trained on the poisoned training data. The authors evaluated pGAN on both synthetic datasets and commonly used MNIST and Fashion MNIST datasets in machine learning.

The paper is self-contained and easy to read. My main concern is on the experiment results. The detailed questions are as follows:

Q1: Has the authors tried more complicated datasets such as CIFAR-10 to evaluate the pGAN method? It would make the paper more convincing to add results on more complex datasets.

Q2: Can the authors structure the experimental results with different sections? Currently it is just a single section which is difficult to read. 

Q3: The authors noticed that “But, as we decrease the value of α, the distribution of red points shifts towards the region where both green and blue distributions overlap”. This observation is interesting as it finds that the poisoned input tends to lie on the overlap of two classes. But this can easily lead to a defense method: remove those training examples that are close to the other class. This defense mechanism can be used together with other sanitization approaches. So I would like to see how would pGAN perform in this case?

Q4: The authors mentioned “Comparison with existing poisoning attacks in the research literature is challenging: Optimal poisoning attacks as in Munoz-Gonzalez et al. (2017) are computationally very expensive for the size of the networks and datasets used in our experiments in Fig. 2.”. 
However, I can not agree because you can simply generate poisoned data and train the neural networks on the poisoned data regardless of the underlying approach that is targeted in generating the poisoned data. This would be an effective baseline to compare. (Correct me if I am wrong here.)

I will change my score if the authors can address my concerns here.

================================================================
Thanks for the rebuttal. I am more convinced now.
review_title: Official Blind Review #2

Meta-review: This paper proposes a GAN-based approach to producing poisons for neural networks.  While the approach is interesting and appreciated by the reviewers, it is a legitimate and recurring criticism that the method is only demonstrated on very toy problems (MNIST and Fashion MNIST).  During the rebuttal stage, the authors added results on CIFAR, although the results on CIFAR were not convincing enough to change the reviewer scores; the SOTA in GANs is sufficient to generate realistic images of cars and trucks (even at the ImageNet scale), while the demonstrated images are sufficiently far from the natural image distribution on CIFAR-10 that it is not clear whether the method benefits from using a GAN.   It should be noted that a range of poisoning methods exist that can effectively target CIFAR, and SOTA methods (e.g., poison polytope attacks and backdoor attacks) can even target datasets like ImageNet and CelebA.
Decision: Reject