Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This paper proposes an adversarial defense method that is a saliency-based adversarial example detector. The method is motivated by the well-known fact that saliency maps and adversarial perturbations are having similar mathematical formulations and derivations. By using model-based saliency maps rather than gradient-based ones, it seems to detect hard attacks with smaller perturbation size as well. As far as the authors mentioned, the proposed method is simply using different techniques to derive saliency maps compared to the previous methods.

Overall, the intuition and motivation of this paper are from the previous works and the main contribution is to use another (powerful) saliency map extractor for learning an adversarial detector. Although the overall results are improved from the previous methods, the proposed method is lack of novelty. 

- For SMD (Saliency Map Defense), what is the reason that the input image is not used together? computational issue? performance degradation? 
- Is it possible to train a single detector that can handle all different adversarial attacks?
- Would the distance between saliency maps from different attacks be small? How does the saliency map change under different attacks?
- Have you tried any other powerful saliency maps other than Dabkowski & Gal (2017)?
review_title: Official Blind Review #1

final_score: rating: 1: Reject
review_content: The paper studies methods for detecting adversarial examples using saliency maps. The authors propose using the method of Dabkowski and Gal (2017) to generate saliency maps and then train a classifier on these maps (or their dot product with the input image) to distinguish natural from adversarial examples. They perform experiments evaluating the white-box and black-box robustness of their detection scheme.

From a technical perspective, the contribution of the paper is rather incremental. The detection of adversarial examples by training a classifier on saliency maps has already been studied in prior work. The only modification proposed in this work is using an (existing) alternative method for producing the saliency maps and utilizing the dot product of maps with images.

From a conceptual perspective, the impact of detecting specific adversarial attacks is not clear. In a realistic setting, an adversary could use a very different attack or even utilize a different set of transformations (e.g. image rotations). Thus, in order to demonstrate the utility of their method in a black-box scenario, the authors would need to evaluate the defense in a variety of different scenarios. At the very least, they should consider generalization to difference attacks (e.g., train against FGSM and BIM, and test against DF).

Moreover, the robustness against white-box adversaries is not sufficiently studied. Firstly, the robustness of the non-adversarially trained detector is suspiciously high. There is little reason to expect that a composition of two neural networks (the saliency map methods and the classifier) would be non-trivially robust. The authors should consider alternative attacks perhaps using more iterations with a smaller step size. Secondly, after adversarial training, only the robustness against the same attack is considered. In order to argue about white-box robustness, the authors would need to evaluate against a variety of diverse adversaries.

Overall, the technical and conceptual contribution of this paper is insufficient for publication at ICLR, even ignoring the concerns about its experimental evaluation.
review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: This paper presents a method for training networks to detect adversarial examples and by virtue of doing so, providing defense against adversarial attacks. Two different approaches are examined, in which a saliency map is used in combination with the input as a mask. In one instance the saliency mask is based on a classifier used to distinguish "normal" from adversarial examples. In the other instance, the salient pixels themselves form the basis for defense. In both cases, the saliency map is combined with the image for training a CNN by way of an element-wise product.
Overall, this presents a relatively simplistic way of deriving representations of saliency and combining these with inputs for training that builds robustness against white and black box attacks. At the same time, the empirical results presented reveal a considerable degree of success in providing a defense against such attacks. I find that this presents an interesting contribution to the literature addressing both adversarial attacks, and new notions on ways of characterizing saliency.
review_title: Official Blind Review #3

Meta-review: This submission proposes a method for detecting adversarial attacks using saliency maps.

Strengths:
-The experimental results are encouraging.

Weaknesses:
-The novelty is minor.
-Experimental validation of some claims (e.g. robustness to white-box attacks) is lacking.

These weaknesses were not sufficiently addressed in the discussion phase. AC agrees with the majority recommendation to reject.

Decision: Reject