Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The main essence of the paper is to point out that existing methods for illustrating how adversarial attacks can affect autonomous driving illustrate the problem by mainly taking a component evaluation perspective rather than a complete end to end systems evaluation perspective. The paper illustrates, by integrating stop sign attack data with an end to end autonomous driving stack, that failures at a component level are inconsequential at a systems level.  The authors trace the phenomenon to the nature of the sampling distribution of scale for stop signs and the fact that the particular error situations are never triggered given that tracking compensates for the misdetections due to adversarial perturbations. The paper then illustrates that one can redesign the attacks, by taking into account the projection geometry in the context, thus making the violations at a systems level to increase significantly.

strength_and_weaknesses: Strengths:
The main message of the paper is rather clear, the experimentation is done well, the link from real world to simulated data scenarios is nicely done and the results are conclusive. 

Weaknesses:
While I appreciate the extensive systems engineering work, the novelty is marginal.  There is a lot of redundancy in the writing in the paper in the early sections and one could shorten them (many points are repeated multiple times).  I am wondering whether the paper is more suited for a conference such as WACV or CVPR since there are no general takeaways besides the concrete application setting insight.  The idea of performance characterization at a systems level rather than components level is well known in computer vision literature since the 90's. (see for instance: haralick.org ). 
clarity,_quality,_novelty_and_reproducibility: Clarity: Very Good
Quality:  Good
Novelty:  Marginal
Reproducibility:  The authors have reimplemented attack methods and offer to open source them. There is sufficient detail in the paper to be able to reproduce the experiments.
summary_of_the_review: While I appreciate the amount of engineering work in the paper to demonstrate how component level errors may not propagate at a systems level, the novelty is marginal. The paper may be more suited for WACV.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This article describes how to design an attack model more reasonably to evaluate target detection algorithms, thereby improving AD security. The authors propose the concept of a system model, and by attacking the previous work, it is found that the existing works cannot respond accordingly to the attack. Therefore, two assumptions are made that lead to low validity of the system-level evaluation.
The main contribution of this paper is to creatively propose the concept of a system model to evaluate the effectiveness of the attack, and to reasonably propose the assumption of uneven pixel distribution of the attack object, and design a system model-driven attack to verify the hypothesis.
strength_and_weaknesses: strengths of the paper
Targeted attacks are carried out on the existing work (YOLO, Faster RCNN), and reasonable assumptions are put
forward according to the performance, and a more reasonable attack model is designed from the system model
level to better overcome the two limitations to achieve System level effectiveness.
weaknesses of the paper
W,r,t Hypothesis 1, how to determine the distribution. y= 1/x^2 is used to calculate the distribution in eq(3). Is
that the possible reason to balance the attack success rate between far distance and near distance?
clarity,_quality,_novelty_and_reproducibility: Clarity:
The logic of the paper is clear, from the formulation of the problem, to the establishment of the model, and the verification of the hypothesis, it clearly expresses the verification of the effectiveness of the system.
Quality:
Authentic professional expression, fluent language.
Novelty:
The concept of system model is creatively proposed, and some existing works are evaluated from the system level, and reasonable assumptions are put forward.
Reproducibility:
Looking forward to the performance of the code after open source.
summary_of_the_review: In terms of attack evaluation technique, this paper is novel. But I think this paper might be more suitable for CVPR or other vision-related conferences as there is little theoretical contribution.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This work presents an interesting study of the effectiveness of existing object-hiding attack in autonomous driving from a system-level effects perspective. The authors proposed that the limitation of previous attacks is that they can only achieve successful attack for a particular targeted model such as object detectors, but can not achieve system level attack effects considering not only the perception module but also the control and vehicle physical properties. To be more practical, the authors proposed two limitation hypothesis that previous works have: the stop sign size in pixel sampled distribution is not uniform in the attack's system model when the vehicle is moving towards the stop sign; and prior works generate the attack without considering the system-critical range systematically, which leads to low performance of the attacks. The authors then proposed improvements on the system model in the AD context. The improvements include a new transformation distribution, and using a reasonable range to generate the attack. The results indicate that the proposed model is effective in achieving an average of 70% system violate rate.
strength_and_weaknesses: Strength: this is a very thought-provoking work. Many adversarial attack work have unreasonable or unrealistic assumptions, and may not work in the real world scenario. This work puts additional question marks on existing works and evaluate under real system constraints. The motivation and contribution of this work is relatively significant. The used method in this work also makes sense, and the used tools are relatively more realistic than other previous works.

Weakness: the experiments are still performed in simulation, and test is also done in simulation, which makes the result heavily rely on the validity of the simulator. However, it is not clear from the work how realistic is the used SVL simulator and if there is any convincing benchmarks or metrics that can validate the simulator. 
clarity,_quality,_novelty_and_reproducibility: Clarity: the paper is written in a clear manner, with the goal clearly presented. However, some results presentation are not clear enough. For example, in table 3, it would be great if the caption of the table could contain more information such as the conclusion we can draw from the table, and what are the numbers about, and what are the differences between different testing cases.

Quality and novelty: the work is of relatively high quality if we consider the simulation to be authentic. The idea is novel as far as I know. It could be great if the author can provide some metrics showing the validity of the simulation platform and how quantitatively it is similar to the real world.

Reproducibility: the code is not released, and there are not enough training details such as network architecture, training hyper parameters. Therefore, the reproducibility is a question. 
summary_of_the_review: Overall the work's idea is great and novel, and the achieved results outperform the baselines by a large margin, and it proposes to test the effectiveness of other existing work on attack on AD considering the system level constraints, which is of practical meaning.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper studies how a specific type of errors in the perception module of autonomous driving (AD) systems, when attacked adversarially, can be translated to the final consequence at the system level. The work empirically studies several popular adversarial attack strategies on stop sign detectors based on deep neural networks in a closed loop AD system simulator, and found that these approaches can not lead to traffic rule violation at all under the scenario considered. Two improvements that can enhance the impact of adversarial attacks are proposed: one being a more practical source distribution of the size of stop signs, and another one being the optimal range of attack to maximize the impact. Empirical study suggests that the proposed attack methods can lead to more serious consequences to the AD system.

strength_and_weaknesses: Strength
Study on an interesting problem of practical significance

Weakness
Limited novelty
Missing literature and comparison to related works
Scenarios studied are too specific with limited impact and coverage.  
Presentation should be improved

clarity,_quality,_novelty_and_reproducibility: On the novelty side, the impact of perception errors in the context of AD system has been studied by several recent works (e.g., Learning to Evaluate Perception Models Using Planner-Centric Metrics, CVPR 2020) in a more general setting, and the problem discussed in this work is only a specific case. While this work focuses more on the adversarial attack, the core problems remain quite close: how to measure the impact of perception error from the system perspective (as once the proper metric is defined, one can always optimize either the attack for the bad and the perception module for the good).    

That being said, the design of the proposed attack methods adopt a specific metric (traffic rule violation rate) on a particular AD system for optimisation. While the observation suggests the viability, the result may not be translated to broader impact trivially. E.g., besides the stop sign violation, how are other AD system metrics affected (hard brake, jerks, etc)? What if some modules of the AD system change (e.g., tracker, planner, etc)? What about other types of object hiding attack (e.g., pedestrians, vehicles, obstacles, lanes, etc)? There are various interesting cases that do not get studied and tested. Also, the experiment involves many random trials, yet the statistical significance is missing and it remains unknown how reliable these results are.        

The presentation also needs to improve. 
There are places where sentences do not make sense. E.g., “For example, the millions of Tesla cars (Kane, 2021) that are equipped with Autopilot (Tesla, 2022).” 
The contents can be better organized. Critical results supporting the claim should be placed in the main text instead of appendix (e.g., table 4 and 5, figure 5, etc), in exchange of some implementation details.
Space between figure, table and text seem to be shrinked manually and affect readability (e.g., figure 2 and table 2). 

summary_of_the_review: An empirical study on adversarial attacks on autonomous systems with solutions limited only to a particular problem setting.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper was marked as a borderline submission and discussed between the AC and some of the reviewers. 
Overall the consensus was that the paper suffers from two different issues: 
1) Since the approach is similar to prior work, the novelty is quite limited, appropriate for a workshop paper. Submitting to a benchmark tracks paper might be another option.
2) It is unclear to what extend the findings are robust to the specific implementation of the simulation, rather than generalisable.  For example, it is entirely unclear if any of the findings would translate to the real world. 

All things considered the paper would benefit from addressing the reviewers' concerns and going through another round of fresh reviews. An alternative option is to submit it as a datasets and benchmark tracks paper at NeurIPS 2023, which seems to be a better fit for this type of work 
justification_for_why_not_higher_score: 1) Since the approach is similar to prior work, the novelty is quite limited, appropriate for a workshop paper. Submitting to a benchmark tracks paper might be another option.
2) It is unclear to what extend the findings are robust to the specific implementation of the simulation, rather than generalisable.  For example, it is entirely unclear if any of the findings would translate to the real world. 
justification_for_why_not_lower_score: NA
Decision: Reject