Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: In this paper, the authors propose a method (RAP) for generating adversarial examples that are transferable to other models. The authors identify that adversarial examples lay on a flat minimum will be more likely to be transferred to other models. The authors then propose the reverse adversarial perturbation guided by an additional inner maximization optimization process, to generate adversarial examples lay on a flat minimum.
strengths_and_weaknesses: + The proposed method is straightforward and effective.
+ The authors conduct a comprehensive evaluation of several models with various types of attacks.
+ The authors conduct a case study with Google Cloud Vision API to validate the effectiveness of the proposed method.
- The proposed method is not new.
- The authors did not provide an analysis or theoretical proof for justifying the flat minimum hypothesis.
- The evaluation does not have competitive baselines.
questions: Though It seems that the theory of flat minimum is intuitive, is there any additional analysis besides the empirical experimental results that justify the theory? Additionally, why simple EOT method is not enough for generating adversarial examples at a flat minimum? It seems to the reviewer that no competitive baselines are provided in the paper.
limitations: The limited novelty of the paper. The theory of flat minimum is intuitive and not well justified by either experiment or theoretical proofs. Competitive baselines are not provided to show the effectiveness of the proposed method.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper focuses on generating transferable adversarial examples. Observing previous works overfits to the surrogate model, the authors propose a novel method to address this issue. According to the experiments, the proposed method generates stronger transferable adversarial examples.

strengths_and_weaknesses: + Strength
1. The proposed method is interesting and insightful. Previous methods usually address the overfitting issues by borrowing the techniques from deep learning model training strategy, such as momentum term, data augmentation. In contrast, this paper proposes a method specifically designed for generating adversarial examples.
2. The results are reasonably good. According to the results in the main paper, the proposed RAP and RAP-LS significently improve the transferability of adversarial examples.
- Weakness
I found the proposed method is less effective when attacking strong defense models (such as Feature Denoising), according to Table 8. Is there any explanation?

questions: See weakness. If the concern in weakness can be well addressed, I am willing to increase the score.
limitations: 1. It is not clear if the proposed method can attack strong defense models.
2. It is not clear if the proposed method can be applied to generate other kinds of adversarial examples (such as patch attack)
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The paper proposed to add reverse adversarial perturbation at each iteration in gradient-based attacks to compute more accurate gradient directions and escape sharp local minimum
strengths_and_weaknesses: #### Strengths
- Paper is clear and the idea is simple.  
- Experiments are comprehensive
- Can be integrated easily into existing gradient-based attacks
- Figure 3 is very insightful


#### Weakness
- The paper improves already an earlier line of works to find a more accurate gradient direction. The novelty of the method is not high but that said, the paper clearly provides detailed analyses from a loss landscape perspective and is validated through a battery of experiments in both targeted and untargeted persepctive.


questions: - How is. the performance of the attack wrt to PGD-based adversarial training

- Recent works of improving gradient directions by looking ahead [a] or by accumulating the gradients of multiple data points around the current data point sampled [b] can be discussed to clearly highlight the contributions

[a] Jang, Donggon, Sanghyeok Son, and Dae-Shik Kim. "Strengthening the Transferability of Adversarial Examples Using Advanced Looking Ahead and Self-CutMix." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022.

[b] Wang, Xiaosen, et al. "Boosting adversarial transferability through enhanced momentum." arXiv preprint arXiv:2103.10609 (2021).

- SOTA transferability technique   Variance tuning-based FGSM [c] as well as [a] should be reported since they refine the gradient direction as in the proposed method. I appreciate the authors for including another line of methods such as LinBP and ILA, and TTP.  

[c] Wang, Xiaosen, and Kun He. "Enhancing the transferability of adversarial attacks through variance tuning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

I'm giving the score of 4 because of no evaluation and discussion to  [a,b,c] which also find optimal gradient direction at each step. I'm very much open to increasing the scores given the comprehensive experiments already reported in the paper.   
limitations: -  calculation of inner optimization increases the computational time of attack wrt baseline methods.
- Adds more hyperparameters (S and mu) but the ablation studies show they are largely target model agnostic
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors claim that the adversarial examples should be in a flat local region for better transferability. To boost the transferability, they propose a simple yet effective method named Reverse Adversarial Perturbation (RAP). RAP adds an inner optimization to help the attack escape sharp local minima, which is general to other attacks. Experimental results demonstrate the high effectiveness of RAP.
strengths_and_weaknesses: # Strengths

1. The idea is novel and interesting. The adversarial example in flat local region could boost the transferability, which seems to be reasonable.

2. The method is simple yet effective. Adding an inner optimization could effectively boost the transferability, which is also general to existing attacks.

3. Extensive evaluations on ImageNet demonstrate the effectiveness of the proposed method in most scenarios.

# Weakness

1. Figure 1 is not clear. What do the x-axis and y-axis indicate? How do you obtain the curve?

2. Why does the flat local region indicate better transferability? It might be interesting if you could provide some analysis.

3. What does one iteration mean? Does it indicate one forward and back propagation? 

4. RAP is general to existing attacks, not limited to input transformation based attacks. Hence, the authors should integrate RAP into various attacks, such as momentum-based attack [1], different loss function [2], model specific attack [3].

5. The biggest concern is the huge computation cost due to the larger iteration and the inner optimization in Eq. (4). Existing attacks could exhibit superior attack performance in much lower iterations. For instance, MI-FGSM [4], VMI-FGSM [1], EMI-FGSM [5], and the corresponding input transformations only adopt 10 iterations.

6. Minor typos:

Line 42 “a slightly change…” -> “a slight change…”

Line 65 “help to escape…” -> “help escape…”

Line 76 “can significant boost…” -> “can significantly boost…”


[1] Wang et al. Enhancing the transferability of adversarial attacks through variance tuning. CVPR 2021.

[2] Wu et al. Boosting the Transferability of Adversarial Samples via Attention. CVPR 2020.

[3] Li et al. Learning Transferable Adversarial Examples via Ghost Networks. AAAI 2020.

[4] Dong et al. Boosting Adversarial Attacks with Momentum. CVPR 2018.

[5] Wang et al. Boosting Adversarial Transferability through Enhanced Momentum. BMVC 2021.

questions: See weakness, especially 4 and 5.
limitations: N/A
review_title: null

Meta-review: metareview: This paper studies the transferability of adversarial examples. In general, the reviewers found the paper is well motivated, and the proposed method is simple and effective. Most initial concerns were about missing comparisons and ablations. 

All these concerns are well addressed in the rebuttal. As a result, all reviewers unanimously agree to accept this submission.
confidence: Less certain
Decision: Accept