Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors propose DISCO to remove adversarial perturbations by localized manifold projections. They aim to output the clean RGB value for an adversarial image and a pixel location. Their method is built upon the assumption that the manifold projection required for adversarial defense is conditioned on the synthesis of a natural image given the perturbed one which can be defined as a function of local image patches instead of a the whole image.
strengths_and_weaknesses: Strengths:
1-- The paper is well-written,
2-- The studied problem is an interesting problem,
3-- Extensive experimental analysis.

Weakness:
1-- Lack of sufficient novelty,
2-- Lack of theoretical analysis 
questions: 1-- Can the performance be compared to these works?
a) Xu et al. "Adversarial defense via local flatness regularization"
b) Li et al. "Semi-supervised robust training with generalized perturbed neighborhood"
c) Bai et al. "Clustering effect of adversarial robust models"
limitations: The authors have included an important limitation for their work and it an interesting problem to study.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: DISCO is a test-time defense against adversarial attack that removes perturbations from inputs by projecting them onto a local implicit representation.
The local implicit representation of an input pixel is encoded by a convolutional network then decoded by an MLP given the coordinates of the pixel and its nearest convolutional features.
This approach to image encoding and decoding follows LIIF, which proposed implicit representations for tasks like super-resolution, but not adversarial defense.
The representation is trained on paired data of clean and adversarial inputs, where the adversarial inputs are generated by a standard attack such as PGD, by sampling matching patches from the clean and adversarial inputs and minimizing the L1 distance between the decoded adversarial patches and the clean patches.
By operating on local patches and their corresponding convolutional features, DISCO is able to generalize without excessive amounts of training data or iterations, and do so with a much reduced total number of parameters compared with other defenses.
Since DISCO takes input images and makes output images, it can be composed into a cascade to leverage more computation for more robustness.
Experiments cover standard benchmarks like RobustBench, the usual datasets of CIFAR-10 and ImageNet, and a variety of defense baselines with adversarial training and older test-time transformation-based defenses.
DISCO achieves state-of-the-art robustness against the standard attacks like AutoAttack, and more distinctly shows transfer across attacks, datasets, and architectures, which distinguishes it from the dominant adversarial training approaches to defense.


strengths_and_weaknesses: Strengths

- Robustness: DISCO achieves state-of-the-art robustness across datasets (CIFAR-10, ImageNet), norms (L_inf, L_2), and architectures (ResNets, Wide ResNets, different training methods).
  Furthermore, test-time defense with DISCO complements train-time defense by adversarial training, and composing the two is more robust still (Table 4).;
- Efficiency: DISCO is efficient to train and test in terms of computation, data, and parameters. As a spatially-local defense, its computation by convolution is efficient, and its generalization is improved by its smaller input dimensions (of small patches, rather than whole images).
  As a local convolutional/implicit model, DISCO only needs <0.1x the parameters of current classifiers and generative models deployed for defense, and it may be computed incrementally across pixels, so its memory usage is minimal.
  Generalization is shown by training on <1% of the training data (as patches), as opposed to the 100% normally used for adversarial training (as images), while still achieving improved robustness.
- Transferrability: DISCO is trained against PGD but evaluated on the standard RobustBench suite as well as a collection of other (generally weaker, but still diverse) attacks like BIM and FGSM. This sort of transferrability is not easily achieved for adversarial training, and such methods generally re-train the model against different attacks, which requires great computational expense.
- Attack/Defense Resource Asymmetry: DISCO requires more computation of the attacker than the defender, which may hinder the practicality of attack. This is demonstrated for gradient-based attack (Figure 10) in computation time and is also true of memory if doing full BPDA.
  However, this is not necessarily true of black-box attacks, which do not scale in the same way. That said, this point is softned by DISCO's robustness to the black-box Square attack.

Weaknesses

- The method is essentially LIIF [13], and its technical contributions w.r.t. to LIIF need to be highlighted, with credit given to LIIF for the foundation.
  While LIIF is cited in passing in the related work, this is not a sufficient or appropriate amount of acknowledgement, when Sections 3.1, 3.2, and 3.3 generally follow from it.
  One difference is that DISCO is trained for adversarial denoising, with paired clean/attacked images, but the architecture, inference, and general scheme of local implicit image functions are all due to LIIF.
  DISCO resembles LIIF all the way down into its specific implementation, with an EDSR-like architecture, and input patch size of 48x48, for example.
- DISCO harms standard accuracy by 4-5 points absolute, while competing adversarial training defenses can lose less (~2% points, for Rebuffi et al. [81] for example.)
- The related work and experiments exclude a whole wave of more recent test-time defenses some of which are also agnostic to the classifier, as DISCO is.
  Please see references [A-D] below (in chronological order of first appearance). This gap in scholarship is significant, and would be a reason for rejection if it were to go unaddressed.
- Note that many test-time defenses have claimed large boosts in robustness, but further evaluation showed the gains to be exaggerated [E].
  While the experiments in this work broadly cover different datasets, architectures, and attacks, there are nevertheless gaps.
  1. There is no decision-based attack. Square is black-box, but still depends on confidence, and RayS or Boundary have been found to succeed in cases where Square fails.
  2. There is no transfer attack from the trained classifier (without the defense) to the composition of DISCO and the classifier. Such transfer attacks, which are valid in the white-box setting, can succeed against input purification defenses like DISCO.
- (Minor) Cascade DISCO is not clearly described, though a reader may guess that it is the iterated composition of DISCO with itself, where the decoded output of one step is re-encoded as the input to the next step.

[A] Adversarial Purification with Score-based Generative Models. Yoon et al. ICML'21.

[B] Combating Adversaries with Anti-Adversaries. Alfarra et al. AAAI'22 (arXiv'21).

[C] Adversarial Attacks are Reversible with Natural Supervision. Mao et al. ICCV'21.

[D] Diffusion Models for Adversarial Purification. Nie et al. ICML'22.

[E] Evaluating the Adversarial Robustness of Adaptive Test-time Defenses. Croce et al. ICML'22 (arXived three months before the deadline, in February).


questions: Questions

- Is DISCO robust to a transfer attack on the underlying classification model? That is, if AutoAttack is applied to the nominally or adversarially trained classifier without DISCO, and then these attacked inputs are presented to DISCO + the classifier, do the attacks succeed?
  This is a valid attack under a white-box threat model, and the possibility of training surrogate models. (Note: AutoAttack by default returns the original input, and not the perturbed input, so make sure to nevertheless use the perturbed inputs for this transfer attack, as near-failures may succeed when transferred.)
- How is the DISCO cascade computed? Is it simply the iterated application of the DISCO encoder and decoder on their outputs?
- Please discuss the contribution relative to LIIF [13]. It seems that DISCO should be given the empirical credit for the application of local implicit functions to defense, but much of the technical contribution was established by LIIF. (This can be fine, but clear credit attribution is a part of good scholarship.)
- Please explain how additional attack iterations are _worse_ in Figure 9. Is this not a symptom of an issue with the chosen attack? More steps should not hurt, unless the unrolling is in effect resulting in vanishing gradients, causing a kind of obfuscation that is not actually strongly measuring the defense itself.
- (Minor) What should we conclude from the sensitivity of DISCO to the number of classes for training (Table 5)? Does this suggest that DISCO requires class-comprehensive and class-balanced data if it is to be effective? Could there be way to make it more class-agnostic?

Other Feedback

- As DISCO is a test-time defense, these related strong and recent test-time defenses could be of interest:  DiffPure [F] and LINAC [G].
  To be clear this is just an FYI, and the existence of these concurrent papers publshed after the deadline at ICML'22 have no bearing on this review.
- The claim about relative complexity on lines 205-206 holds not just for adversarial training, but any defense (including test-time defenses) that take model gradients (such as self-supervised input purification, SOAP).
- Figure 2 makes an important point about local representation, but does so confusingly. Consider re-captioning the figure to highlight the point that DISCO is spatially local, and so can defend different content in the same image, and learn to defend many images by training on patches from a single image.
  Rather than pasting one image into the corner of another, why not just concatenate the images side-by-side in width? By the way, does DISCO actually fix these inputs? How is each classified?
- Figure 5 has unclear elements. What do the arrows mean in orange and red? Are they simply an ordering of the input pixels? Consider placing a box around the loss to indicate the training phase, since inference only queries the implicit module without a loss. Consider depicting the implicit module as an MLP (visualized as some stack of layers, or however) to more fully summarize the architecture of the defense.

[F] Diffusion Models for Adversarial Purification. Nie et al. ICML'22

[G] Hindering Adversarial Attacks with Implicit Neural Representations. Rusu et al. ICML'22


limitations: Empirical limitations and societal impacts are discussed. The main empirical limits are the need to try different attack families, with sparse spatial attacks suggested in this work and decision-based attacks suggested in this review, and the need to experiment on more classifiers, datasets, etc.
This amount of discussion is adequate, but it would be better still to acknowledge that the evaluated attacks (like AutoAttack) were primarily designed for train-time defenses, not test-time defenses, and so more work is likely needed to design adaptive attacks on implicit representations and other test-time methods.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper proposes an implicit function-based method for adversarial defense. It consumes an attacked image as input and predicts a clean image. The proposed `implicit module` uses the context information around a query pixel to reason the center pixel.

The experimental results on CIFAR10, CIFAR100 and imagenet datasets are in favor of the proposed methpd.
strengths_and_weaknesses: +. the method is clean, simple and seems effective.
+. the experimental results are in favor of the method.

- the novelty of the method is limited. there are a lot of similar methods in the field of denoising which also use similar strategy of denoise with context around. The author should clearly identify the difference between the proposed method and those denoice methods like [1, 2].
- the proposed method is tedious compared with adversarial training methods because the proposed method requires two forward passes, one for obtaining the clean image and the other for classification. While adversarial training methods requires only a single forward pass.
- The writing quality is somehow unqualified, the overall method is simple and clear, but some the writing doesn't follow a good standard. For example, in L126, you can ether remove the section description, or give more detailed one like"in this section, we xxxx, we first xxxx, then we xxxx, finally we xxx", rather than just a single sentence.


[1] Batson, Joshua, and Loic Royer. "Noise2self: Blind denoising by self-supervision." International Conference on Machine Learning. PMLR, 2019.
[2] Laine, Samuli, et al. "High-quality self-supervised deep image denoising." Advances in Neural Information Processing Systems 32 (2019).
questions: NA
limitations: - Novelty
- not clear the difference with denoise methods
- writing quality
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The authors propose the use of local implicit functions to undo adversarial perturbations. This is inspired by related works on image manifolds, specifically image synthesis, as well as recent progress on implicit representations for 2D/3D data. Namely, instead of processing the entire image, the authors propose to process individual pixels conditioned on local information from a small patch which is projected by an MLP to a corrected value in the spirit of implicit neural representations. Training is based on minimizing the L1 distance of the MLP output against the clean pixel RGB. An extensive set of experiments show that the proposed approach outperforms prior defenses in a number of settings, with superior transferability.
strengths_and_weaknesses: Strengths:
- Disentangle the training of the defense modules from the base classifier.
- A significant saving in the number of parameters in the defense network.
- Considering the relative cost of training the defense vs attack modules, which can be magnified by repeating the projection up to K times.
- Improved robustness and transferability over known defenses.

Weaknesses:
- This is essentially an image smoothing approach which comes with the following drawbacks:
- - Each pixel-patch is passed through the MLP which is likely to slow down the inference process.
- - It assumes norm-bounded attacks leaving it susceptible to other forms of attacks as the authors mention (e.g., 1-pixel, patch) in addition to e.g., functional attacks [2].

[1] Laidlaw, C., & Feizi, S. (2019). Functional adversarial attacks. Advances in neural information processing systems, 32.
questions: 1. Mainly, I disagree with the high level description of the approach as a projection on the "image" manifold while it is more of a "patch" manifold [2]. Similarly, barely outliers as used to refer to perturbed inputs is not the same thing as manipulating individual patches. This contrast is also made more apparent due to the repeated references and comparison to image synthesis and GANs. Taken together, it is not clear how global information is incorporated in the encoded features used by the implicit module, so I feel that more work is needed to explain the improved performance of the proposed model.

2. I would like to see some timing statistics. L174 ("Note that this is not computationally intensive because the encoder feature map f = E(x) is computed once and used to the predict the RGB values of all query pixel locations.") does not tell the whole story.

3. The references are somewhat excessive. While this is an appreciated effort, it is difficult for readers to trace the important ideas. I would encourage the authors to revisit the long sequences of references leaving only 2-3 in the main text and perhaps move the rest to a "see also ..." add-on remark.

4. There is quite a bit of simple language glitches. Please double-check. For example:
L128: lie a
L140: trained projecting
L144: is the generated by
L154: for each pixel locations

[2] Peyré, G. (2009). Manifold models for signals and images. Computer vision and image understanding, 113(2), 249-260.
limitations: The main limitation is the assumption of norm-bounded perturbations.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper provides a way, named aDversarIal defenSe with local impliCit functiOns (DISCO), to protect classifiers from being attacked by adversarial examples. DISCO is composed of two parts: an encoder and a local implicit module. For inference, DISCO takes an image (either clean or adversarially perturbed) and a query pixel location as input and outputs an RGB value that is as clean as possible. After the process, the new output image is expected to wipe out all the adversarial perturbation on it, making the classifier predicts with high accuracy. In summary, I think that DISCO is one type of denoising model that aims to be adversarially robust.
strengths_and_weaknesses: Strengths:

1. The experimental results are rich. Moreover, it seems that the robust accuracy of DISCO outperforms other existing methods, even for adversarially trained or transformation-based methods.
2. Transferability of DISCO: In the experiment section (Section 4), the authors assert that even though the use of datasets/classifiers/attack methods in training and testing phases are different, DISCO outperforms listed robust methods. As shown in Table 7. This particularly shows that, unlike adversarial trained, the robustness of the proposed model is independent of which attack/data be considered.


Weaknesses:

1. In lines 153-155; and lines 165-170: This should be a core part of the proposed method. However, the notations and interpretations are not clear. For example, what does "the pixel shape as input" mean? How does the local implicit module $L$ takes the three parts into consideration, to predict a clean RGB value? Moreover, I can't see any notation in Figure 5 that is used in the text. Like $E$, $L$, $\hat{f}_{i^\ast j^\ast}$, etc. So it seems like the figure does not help readers to understand the main method in this paper, but rather than making them more confused.
2. The novelty is not enough: Since the heuristic idea about adversarial removal has been developed for several years, it seems that the proposed method is mainly followed by this idea; with a slight modification.
3. Few typos listed here:

    a. In the main paper, line 144: is the generated by… → is generated by…

    b. In Supplementary, Table H, the last row: Cifar10 → Cifar100 (maybe?).


questions: 1. What is the benefit of the local implicit module? Is it better than a global module only for efficient computation time?
2. What are the iterations of your PGD attack during training and testing?
3. In Table 9, why K only has 3 values for defense and attacks have 5 values?

limitations: Yes. The authors of this study addressed the limitations and potential negative social impact of their work.
review_title: null

Meta-review: metareview: In this paper, DISCO, a test-time defense against adversarial attack, is proposed based on prior concents of adversarial denoising, manifold modeling, and implicit function.
The authors show promising efficiency and experimental results in DISCO.

However, a large concern raised by some reviewers is the limitied novelty but the authors claimed that the perspective of modeling local statistics and the introduction of the local implicit function for adversarial defense are important contributions.
Another limitation is that some reviewers concern robustness evaluation on norm-bounded attacks only, but the authors claim that many baselines in RobustBench [25,26,32,33,81,87,99,110,116,119,116] are evaluated only on norm-bounded attacks.

Since most reviewers are satisfied with authors' responses, this work is suggested to be accepted but the AC hopes the authors continue to clarify the limitations and consider taking recent publications into consideration to further revise the paper.
confidence: Certain
Decision: Accept