Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: Adversarial attack on discrete (categorical) input is a challenging problem. This paper proposes PCAA, which converts the problem to a continuous optimization problem and solves it with gradient descent. It further shows that using PCAA for adversarial training (PAdvT) can improve the model robustness.

strength_and_weaknesses: Strength:

- The idea of using cross-entropy loss and Lagrangian form is novel and interesting. 

Weaknesses:

- This paper takes an L0 distance as the only constraint to adversarial examples, however it is insufficient for text classification tasks, and may also be flawed on other tasks. For example, replacing the word “good” with “bad” will significantly change the meaning of a sentence by the L0 distance is just 1. 
- The adversarial probability distribution pi assumes that each feature is independent. However, it is not true in natural language and other types of input sequences. 
- Textual adversarial attack requires human evaluation to ensure that the adversarial sentences do not change the meaning (or the true label). That part is missing in this paper. 
- Attacking a text classifier seems to be an important use case for the proposed method. There are numerous works trying to improve the quality of the adversarial sentences. Those methods are not cited and compared in this paper. 
  - Jin et al., Is bert really robust? a strong baseline for natural language attack on text classification and entailment
  - Li et al., Bert-attack: Adversarial attack against bert using bert
  - Li et al., Contextualized perturbation for textual adversarial attack
  - and many other papers. 


clarity,_quality,_novelty_and_reproducibility: The methodology is presented clearly. 

It has some novelty in formulating the attack into an optimization problem. However, there are some issues with the formulation considering practical NLP or sequence classification tasks. There are issues with the experiments as well. 

The source code was not submitted. 

summary_of_the_review: The methodology has some novelty. However, there are still many issues with the problem formulation and experiments.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper's objective is to efficiently generate adversarial examples for categorical data stronger than prior search-based methods. To tackle this problem, it proposes a Probabilistic Categorical Adversarial Attack (PCAA) that transfers the adversarial attack in the discrete space to an optimization problem in a continuous probabilistic space. Notably, it assumes that the features of adversarial examples follow a categorical distribution and aims to generate adversarial examples with the corresponding distribution that leads to high loss value and are closer to the clean adversarial examples.

Further, the paper proposes Probabilistic Adversarial Training that utilizes the proposed objective of PCAA for inner maximization in standard adversarial training. The experimental evaluation is conducted on three datasets, where the proposed method achieves a higher success rate with significantly lower running time for higher $\epsilon$ values.

strength_and_weaknesses: ## Strengths
 
* The problem of generating adversarial examples and defending against them is essential, which has yet to gain the required attention in the community. The paper generated categorical adversarial examples by estimating their probabilistic distribution, which is simple and interesting.
* The proposed method is well-written and easy to follow. The time complexity analysis between various attacks is well-described in the paper.
* The attack experiments are conducted over three diverse datasets showing the efficiency of the proposed method.

---

## Weaknesses

### Originality and quality
* The practicality and usefulness of the proposed method need to be clarified. In Table 1, GS obtains the highest success rate for most cases; it is unclear why the adversary would prioritize the attack's efficiency at the cost of having a significantly weaker attack. Further, the reported time is in seconds, except for IPS, the computational cost does not seem too expensive to choose PCAA.
* The paper highlights that PCAA is more efficient for higher budget attacks; however, the choice of higher $ \epsilon $ needs to be better justified. I'd suggest including the comparison between the generated adversary examples for various attacks to motivate the requirement of robustness against higher epsilon for these datasets. 
* While the paper cites Bao et al. [1] in experiments, it lacks a discussion and comparison with this recent paper that analyses the classifier's vulnerability with categorical inputs via an information-theoretic adversarial risk analysis.
* The paper needs to provide confidence intervals for any method for attack and defense evaluation; therefore, it is hard to conclude the improvement provided by PADVt in Figure 3, as PAdvT shows similar or worse performance than ASCC. 


### Clarity 
* The paper is not well-written and requires many changes to improve the readability for the readers:
* The y-axis in Figure 3 and Figure 4 should be mentioned, which makes it difficult to read the plots. 
* The paper also swaps the X-axis and the multi-row in Figure 1 and Figure 2, making it difficult to read these plots.
* For both figures, it would be easier to interpret them when represented as tables instead of statuettes.
* For gradient search SR in LSTM, the SR for 0.32 is lower, is that an exception in that table or was it a typing mistake?
* Instead of having one paragraph for ablation analysis and one subsection, I suggest combining them into one subsection with multiple paragraphs.

### Reproducibility
The code was not released with the submission. I hope the authors can do that in the later version to promote the reproducibility of the attack and defense for future works.

---
[1] Bao et al. Towards Understanding the Robustness Against Evasion Attack on Categorical Data. ICLR 22

clarity,_quality,_novelty_and_reproducibility: The review above elaborates on all these points in detail.
summary_of_the_review: The paper tackles a significant problem; however, the usefulness of the proposed attack is unclear. Further, the proposed defense provides limited or no gains compared to prior works and are limited to NLP data, whereas the objective of the paper was to focus on more categorical tasks. The paper also needs improvement in the clarity of results and overall writing. Due to these reasons, I recommend a weak reject for the current version of the paper.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a probabilistic categorical adversarial training method, which conduct adversarial attack and adversarial defense on categorical data. The authors transform the discrete optimization problem on categorical data into a continuous problem, which is then solved using PGD. The proposed method can achieve a better balance between time complexity and performance, and the effectiveness is verified by comparisons on multiple datasets and multiple baselines.
strength_and_weaknesses: +Extends PGD based AT to categorical input data.

+Achieve a better balance between time complexity and performance, including categorical adversarial attacks and robustness of adversarial training.

-The technique novelty is somewhat limited, considering that it is only the expansion of PGD based AT on categorical input data.

-The performance is not significant. The results show a better balance between time complexity and adversarial attack or defense robustness. However, compared with the existing technology, the proposed method neither achieves the least time consumption nor achieves the best adversarial attack or defense robustness.

clarity,_quality,_novelty_and_reproducibility: The clarity, quality and reproducibility is ok. The nolvelty is somewhat limited, considering that it is an extension of PGD based AT, and there is no significant performance improvement.
summary_of_the_review: This paper extends PGD-AT well to categorical input data, and the main concern is the inability to achieve better performance than the existing technology.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This work proposes a new attack for categorical data by probabilistic distribution of non-adversarial samples, named Probabilistic Categorical Adversarial Attack (PCAA). Unlike conventionally expensive attack by greedy search, PCAA can convert the discrete optimization into continuous optimization and apply gradient based approach to generate stronger adversarial samples efficiently. Upon the attack, this work also provides a probabilistic adversarial training method against PCAA and other adversarial attacks.
strength_and_weaknesses: Strength:

1. This work provides an attack/defense pair instead of attack alone to avoid potential risks on adversarial machine learning research.

2. This work does not only provide PCAA theoretically in epsilon/delta language, but it also provides an efficient algorithm with experimental results.

Weakness:

1. Lack of theoretical explanation why PAdvT is also good to attacks other than PCAA.

2. In algorithm 2, the adversarial training only depends on adversarial samples. What about also considering non-adversarial samples? I mean training with mixture of adversarial and non-adversarial samples.
clarity,_quality,_novelty_and_reproducibility: Clarity: All definition, algorithm and writing in this work are clear.

Quality: Both theoretical and applied aspects of attack and defense is good.

Novelty: The attack is novel from probabilistic perspective.
summary_of_the_review: This work is a good work to cooperate theory and application together in the adversarial machine learning area. We should encourage more work like this.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The authors propose Probabilistic Categorical Adversarial Attack (PCAA), a method for constructing adversarial $\ell_0$ attacks on categorical data. After discussion, all reviewers unanimously recommended the paper for rejection. 

While the reviewers found the ideas in the paper interesting (e.g., the details of the discrete to continuous relaxation), they raised two main issues. First, it is unclear if $\ell_0$ attacks are meaningful in the domains studied in the paper (cybersecurity, text, and gene splicing), since small modifications can change the meaning of the input. Second, the empirical improvement in performance was unconvincing, as it did not seem to clearly outperform existing methods; while SOTA results are not a requirement for acceptance, for this paper, the empirical performance of PCAA is its key contribution. Reviewers also suggested comparisons to several related papers as well as improvements to the clarity of writing.
justification_for_why_not_higher_score: Originally, 3 reviewers voted to reject and 1 voted to accept, but after discussion, all 4 reviewers voted to reject. The reviewers felt that it wasn't obvious that the problem was well motivated ($\ell_0$ attacks are not necessarily semantics-preserving in all of the datasets the authors studied), and they also felt that the empirical performance that the authors reported was not compelling.
Decision: Reject