Venue: ICLR 2017 workshop

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: The work explores whether one can perturb the input of a VAE (or VAE-GAN) imperceptibly in such a way that the reconstruction resembles a target sample. The paper shows two ways to do so.
It is not particularly surprising that an inference network in a VAE is susceptible to adversarial examples (in fact the opposite would be more interesting). It is after all a neural network with only a bit of noise added to it, and the susceptibility of such networks to adversarial attacks was established before. But it is nevertheless a finding worth reporting.
review_title: Interesting exploration

final_score: rating: 5: Marginally below acceptance threshold
review_content: CONTRIBUTIONS

This paper builds upon recent work on adversarial examples -- which shows that one can maliciously craft an input to a classifier using various approaches and have the classifier recognize this input as any desired class -- and extends it to the realm of deep generative models.

It claims two main contributions:
- It shows the existence of two attack vectors on encode/decode-type generative models and proposes a method to perform each of them.
- It provides a new visualization tool which gives "[...] insight into how adversarial examples appear in generative models."

NOVELTY, CLARITY, SIGNIFICANCE, QUALITY

The idea of the existence of adversarial examples in generative models is new to me, and I think it is very relevant to the field.

I find the definition of adversarial examples for generative models proposed in the introduction confusing.

The sentence "Specifically, if the person doing the encoding step is separated from the person doing the decoding step, the attacker may be able to cause the encoding party to believe they have encoded a particular message for the decoding party, but in reality they have encoded a different message of the attacker’s choice." is vague and does not give a concrete picture of what attack scenario the authors have in mind.

Similarly, the sentence "Our results show that these attack methods are effective and VAE and VAE-GAN can be easily fooled." does not explain what exactly VAEs and VAE-GANs would be fooled into doing.

Fortunately, the "Methods" section offers clarification: in the L_VAE case we are looking for a perturbation of a source input such that its reconstruction matches that of a target input, whereas in the latent attack case we are looking for a perturbation of a source input such that its latent representation is close to that of a target input. In both cases we want to keep the adversarial input as close to the source input as possible.

I find Figures 1 and 2 difficult to parse. It appears to me that only the reconstructions are shown; in the absence of the original images and their respective perturbations I can't really assess how close to the original the perturbations are and therefore how successful the attack is. Looking at Figures 5 and 6 in the appendix makes me think that the perturbations are indeed pretty close to the original, but I think having the original, its reconstruction, the perturbation and its reconstruction side by side would go a long way towards making the results look more convincing.

Overall I feel like this work shows great potential, but the lack of clarity gets in the way of the results. I would be inclined to recommend acceptance if the introduction and figure presentation were reworked to improve clarity.

PROS (+), CONS (-)

+ Subject is relevant and novel
+ Some of the results, especially in the appendix, show good potential
- Confusing introduction
- Figures are not very well explained and contextualized
review_title: Review

Decision: Reject