Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper introduces a new backdoor attack that exploits neural tangent kernels to optimize the perturbations of the poisons introduced in the training set in a more efficient way. The attack comprises of three elements: modeling the training dynamics with the neural tangent kernel, a greedy initialization strategy to select the initial set of poisons and optimizing the perturbations of the poisons. The empirical results provided by the authors show that the proposed attack allows to achieve a high success rate with a few number of poisoning points in the training set when compared to a baseline. 
strength_and_weaknesses: Strengths:
+ The use of neural tangent kernels for solving the bilevel optimization problem to learn the poisons perturbations looks interesting and can help to improve poisoning attacks relying on this methodology. 
+ The authors show how the combination of the three steps in the attack is necessary to achieve a high success rate. 

Weaknesses: 
+ The experiments just compare the performance of the proposed attack against a baseline, but it does not compare its performance against other state-of-the-art attacks to provide a more comprehensive view of its benefits and limitations. For instance, the authors could compare with Turner et al. 2019, which also optimize the values of the poisons. Similarly, different strategies for solving bilevel optimization-based attacks could be compared to analyze the possible benefits in the use of the neural tangent kernels. 
+ The paper is difficult to follow as it often refers to information in the appendix that is important to understand the paper. In this sense, the authors, perhaps, abuse on the use of the appendices and could rethink of a better organization of the paper to make it more readable. 
+ Similar to the previous point, the authors do not provide many details about the attack in Section 2. For instance, the authors just refer to the appendices to clarify the 3 main steps in the attack. On the other side, the derivation of the attack by using equation (2) is not very well justified and detailed: For instance, does this attack provide an exact or an approximate solution to the bilevel optimization problem? How does this differ from other approximate techniques to solve this type of problems? 
+ The attack is not tested against existing defenses. This can be a key point to validate the usefulness of the attack. In this sense, the attack can be very strong compared to the baseline when attacking undefended systems. However, the strength of the attack could make it more detectable. Thus, it is necessary to explore its effectiveness against existing defenses. 

clarity,_quality,_novelty_and_reproducibility: The writing style is good, but the organization of the paper can be improved and the use of the appendices is not very adequate. Important information that is key to understand the paper is often described in the appendices and the flow to read some of the sections in the main paper is not very good. 
In terms of novelty, the authors propose to use neural tangent kernels to craft a backdoor poisoning attack relying on a formulation based on bilevel optimization. This technique has been used in similar settings (e.g. meta-learning), but its application to poisoning/backdoor attacks is novel. However, there is a lack of discussion and comparison with existing state-of-the-art attacks using similar formulations to validate the method proposed by the authors. 
In terms of reproducibility, although the authors provide some information about the experimental settings at the beginning of Section 3. Throughout the paper it is not really clear the settings used for all the experiments. For instance, the ablation study in Section 2.1 does not say anything about datasets or models used for the experiments. The way it is presented, the information provided in that section cannot be reproduced and the results cannot be properly assessed. 

summary_of_the_review: The idea of using neural tangent kernels is interesting and I think that the paper has potential and I really encourage the authors to follow this research direction. However, I think that the paper requires more work on the following points:
1) The experimental evaluation: it would be necessary to compared to other state-of-the-art attacks, especially those relying on approximate techniques to solve bilevel optimization problems. Similarly, it is necessary to analyze the behavior of the attack against existing defenses and analyze if there is a trade-off between attack effectiveness and detectability. 
2) The organization of the paper (see my previous comments).
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes to reduce the number of poisoned samples (i.e., few-shot) in backdoor attacks. The paper formulates backdoor-attacks as a bi-level optimization problem, which is approximated with a NTK objective to trace training dynamics. The paper also proposes a greedy algorithm to gradually reduce the number of poisoned samples. Experiment results show: (1) the proposed method makes attacks more efficient; (2) it is enough to know partial training data; (3) the attacks on other kernels; (4) deeper understanding of backdoors from the perspective of NTK.
strength_and_weaknesses: Strengths:
(1) The idea of using NTK to approximate the training dynamics is interesting in backdoor attacks.
(2) The paper provides deeper analysis of backdoor attacks from the NTK perspective.

Weakness:
(1) The introduction of the proposed method is not self-contained. Too many details are given to the theoretical analysis, while it is actually not very clear to me how exactly the attack is conducted. The three items in Page 3 are far from being enough. I do not think it is a good idea to put these contents in Appendix.
(2) I have doubts whether "few-shot backdoor attack" it is a valid problem. I do not think human beings will check each training sample. Automated detection methods will be applied, where the poisoned set size is not important (anyway the detector will go through each of the samples).
(3) Experiments: First, I feel Section 3.2 is not necessary. Having 100% of training samples or 50% does not matter that much. Second, in Sec 4, what does "strong attack" or "attack strength" mean? Does it refer to the backdoor sample with more clear trigger pattern or more stealthy pattern? Third, a flaw of experiment is that no defense method is applied to evaluate the effectiveness of the proposed backdoor attack method.
clarity,_quality,_novelty_and_reproducibility: The technical quality and novelty of the papre is good.
The presentation clarity is OK, but could be improved.
The codes for implementation are provided.
summary_of_the_review: Technically speaking, the paper tackles the challenge of tracing model training process with NTK methods, which is used for more efficient backdoor attacks. Some interesting analysis is conducted. However, there are several major problems for this paper. First, I am not fully convinced by the motivation of "few-shot backdoor attacks". Second, the experiment design has some flaws, especially the defense method based evaluation is missing. Third, the paper presentation is not self-contained. Based on these reasons, I think the paper is slightly below the acceptance threshold.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a theoretical analysis of backdoor attacks from the perspective of neural tangent kernels (NTK). It uncovers that NTK is more prone to backdoor attacks than other kernels, e.g., the Laplace kernel. A new poisoning method, NTBA, is proposed based on the analysis. NTBA optimizes the poisoning examples, producing stronger backdoors than previous methods. Experiments are performed on subclasses of CIFAR-10 and ImageNet with WideResNet-34 and ConvNeXt with periodic and patch trigger attacks, showing that NTBA only requires few poisoned examples.
strength_and_weaknesses: Strengths:
- Novel analysis of poisoning attacks linked to neural tangent kernels.
- Novel poisoning attack strategy, that is principled and based on theoretical analysis, resulting in stronger poisoning capacity.
- Comprehensive state-of-the-art analysis on poisoning and backdoor attacks and defenses (unfortunately pushed to the appendix).
- The code for experiments was provided.

Weaknesses:
- It is not fully clear to me what are the practical implications and applicability of the analysis and NTBA method.
- A more extensive discussion of assumptions and limitations of the proposed approach would be welcome.

See more details below.
clarity,_quality,_novelty_and_reproducibility: Novelty:
- The work in the paper seems novel.
- However, neural tangent generalization attacks [Yuan&Wu, 2021] seem closely related to the present work. While the paper cites this reference, it is unclear how they are related.

Quality:
- The paper seems to lack a section stating explicitly what assumptions are being made about the threat model and attacker / defender capabilities.
  * E.g., Appendix (A.1) states that "the attacker has information about the network’s architecture and training data", which seems like a strong assumption. This should of course not prevent one from deriving novel theoretical analyses, but should be addressed from the beginning in the threat model.
  * A commentary on the realism of these assumptions would also be welcome.
- Addressing technical or principled limitations of the method in one place would help.
  * E.g., we learn that batch normalization cannot be applied due to an implementation limitation.
  * The conclusion briefly mentions the lack of scalability of the method.

Clarity:
- The paper is well-written, but sometimes a bit hard to follow, due to main important parts of the paper being deferred to the appendix. While I appreciate the effort that has gone into fitting this amount of content into the ICLR format, my impression is that clarity has been impacted.
- It would help to mention at the beginning of the ablation study (Sec 2.1) that the number of method components (mainly 1, 2, 3) is the one introduced at the beginning of Sec. 2.

Reproducibility:
- The paper mainly contains small experiments. The code for reproducing them has been provided.

References:
* [Yuan&Wu, 2021] Yuan, Chia-Hung and Wu, Shan-Hung. Neural Tangent Generalization Attacks. ICML 2021.
summary_of_the_review: Paper with novel and thorough analysis of backdoor attacks, which uncovers new insights into the vulnerability of neural networks to poisoning. Principled, effective attack method developed based on the theoretical analysis.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: Summary: The paper introduces a new backdoor attack that exploits neural tangent kernels to optimize the perturbations of the poisons introduced in the training set in a more efficient way. The attack comprises of three elements: modeling the training dynamics with the neural tangent kernel and kernel ridge regression, a greedy initialization strategy to select the initial set of poisons and optimizing the perturbations of the poisons. The empirical results provided by the authors show that the proposed attack allows to achieve a high success rate with a few number of poisoning points in the training set when compared to a baseline.

The three reviewers thought that the use of neural tangent kernels for approximating the solution of the bilevel optimization problem to learn the poisons perturbations looked interesting and combined with the other proposed techniques in the paper, provided good empirical performance. They had originally expressed concerns about the paper organization and clarity of writing, but this was addressed appropriately by the rebuttal and the paper revision -- they all have updated their score accordingly. Two reviewers now recommend acceptance; while reviewer yTWS have updated their recommendation from 3 to 5 after the rebuttal and discussion. While the AC agrees with yTWS that empirical comparisons with other ways to solve the bi-level optimization problems would strengthen the paper, they still think that the current version makes an interesting sufficient contribution to ICLR.
justification_for_why_not_higher_score: Not enough support from reviewers.
justification_for_why_not_lower_score: See meta-review.
Decision: Accept: poster