Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper defines a new optimization objective function which combines the fluency, similarity and translation error to adversarially attack machine translation models. A gradient projection algorithm is applied to solve this optimization. Experiment results show the proposed method outperforms baselines. The transferability is also examined. 

strength_and_weaknesses: Strength

- The proposed method is simple and straightforward. 
- The experiment results show superior performance in attack success rate and significant decrease in translation quality. 
- This work also demonstrates the capability and efficiency of blackbox attack.


weaknesses

- Existing adversarial attack on NMT aims at improving the robustness of these models. However, in this work, achieving a high attack success rate seems to be the goal. Therefore, I’m wondering if TransFool is as effective as baselines in improving robustness. Or what is the desired use case for this method?
- Translation models use beam search or similar mechanisms to generate high-quality output. Is the proposed attack still effective when using these mechanisms?
- Missing human validation. Although automatic metrics show significant decrease in translation quality, I’m not convinced that the algorithm triggers incorrect translation. Maybe the translation is correct but has a very low BLEU or chrF score (i.e., the attack method is attacking the automatic metrics instead of the NMT model, which could also be an interesting finding). 

clarity,_quality,_novelty_and_reproducibility: The space after figures and tables are being squeezed too much. 

summary_of_the_review: The novelty of the proposed method is somewhat incremental. 

The experiment part is strong in terms of datasets and models. The automatic evaluation metrics also show strong performance. 

I think adding a human evaluation would reveal lots of insights.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a new approach for adversarial attacks on NMT models.
The authors design a way to propagate the gradient for embeddings and propose a specific loss that targets reasonable criteria.
The propagation is based on the common idea of relaxation with a new additional FC part to create embeddings for comparison.
The metrics are good, and overall, the results are promising.
strength_and_weaknesses: Strengths:
- Quality metrics are better than that of competitors.
- Experiments are interesting and numerous. They include human evaluation as well.
- Nice adversarial example found in Table 2

Weakness, methods:
- The novelty is limited. The paper contains some engineering tricks to make everything work, but all ideas are similar to those previously discussed in the literature.
- Not clear why we need the FC part in the approach. We can use BERT-like architectures to generate similar differentiable $v_i$-s as well. What would be the difference in this case?
- Investigation on the distortion of the generated adversarial sequence $x'$ is limited and includes only "Semantic Similarity" from Yang et al. Can you include metrics like BERT score for a pair of $x$ and $x'$ as well?

clarity,_quality,_novelty_and_reproducibility: - New loss is proposed that consists of three terms. The ideas for these are out there for some time.
- New architecture is proposed to find adversarial sequences. It is an interesting modification of a common one.

I also imagine that the observed behaviour can be related to the requirement to include a projection layer in self-supervised learning or in other settings.
summary_of_the_review: The results seem promising, on the other side, the novelty is limited. From the paper, it is not clear, why this approach works in the NMT-attacks field, where other approaches failed.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This work proposes TransFool for generating non-targeted adversarial examples against neural machine translation models. One core idea is to utilize an autoregressive language model (GPT-2) to add a language model loss term, which helps generate fluent adversarial examples. They also add a similarity loss, which constrains the distances of embedding distances between the original input sentences and adversarial examples. They perform a comprehensive study to evaluate their approach on translating from English to different target languages, and show that TransFool achieves higher attack success rates compared to baselines, while the generated adversarial examples better preserve the semantic meaning and look more natural. Meanwhile, they show that the generated adversarial examples transfer to other models in the black-box setting, including Google Translate, and can also transfer to different target languages.
strength_and_weaknesses: Strengths:
1. Each term in the loss function of TransFool is well-motivated and properly designed.

2. The empirical study is pretty thorough. To me, the most interesting finding is that the generated adversarial examples can transfer to different target languages. 

Weaknesses:

1. The study of defense is lacking. For example, it is helpful to see how the attack works with existing defenses against adversarial examples for language models. Also, it is interesting to try adversarial training with TransFool adversarial examples.

2. This is more of a question rather than a weakness, but have you tried TransFool for targeted attacks, and how does that work?

3. It is good to investigate more into the transferability between different target languages. For example, have you done these experiments on Google Translate?
clarity,_quality,_novelty_and_reproducibility: The writing is clear, and the approach is well-designed.

TransFool is novel as an adversarial attack algorithm for machine translation. The individual terms are not that new as there are prior works leveraging language models to improve the fluency of adversarial examples in the NLP domain, but this work provides a more comprehensive study for machine translation problems. 

The authors plan to release their code for reproducibility.
summary_of_the_review: This work proposes a well-designed adversarial attack for neural machine translation models, though it is not entirely novel. The paper presents a comprehensive study in different attack settings. In particular, the transferability of attacks between different target languages is interesting and new. Therefore, I lean towards accepting this work.

-------------
I thank the authors for explanation and adding more experiments, and I keep my original score.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a white-box adversarial attack against neural machine translation model named TransFool. TransFool uses an optimization loss function with three terms: a) adversarial loss to maximize the loss of the target NMT model; b) a similarity term to ensure that the adversarial example is similar to the original sentence; c) and loss of a language model to generate fluent and natural adversarial examples. The authors compare their TransFool method with two NMT attack methods, kNN and seq2sick, with respect to the Attack Success Rate, Relative decrease of translation quality, Semantic Similarity, Perplexity score and Token Error Rate. The proposed method can outperform baseline methods on two NMT model, Marian NMT and mBART50 MNMT model. The authors also show that the adversarial examples they found can conduct transfer attack on black box NMT models, using the adversarial examples from Marian NMT to attack mBART50 MNMT model and google translation api.
strength_and_weaknesses: Pros:
+ This paper is good written and easy to follow.
+ The authors valid their method not only on research models but also on real world commercial product, like google translation.
+ The transferability analysis section is enlightening. It is not widely studied in NLP field. The transferability between different language is an important issue in multilingual NLP filed.


Cons:
- Novelty is limited. 
a) First, the authors consider not only the attack success rate but also the fluency and semantic similarity. However, these two issues are widely studied in NLP attack field. For example, [1] has systematically reveal that the fluency and semantic similarity issue in textual adversarial attack and they empirically study the threshold of filtering the adversarial examples according to the fluency and semantic similarity. 
b) Second, this paper claims that they propose a new strategy to incorporate the embedding vectors of a language model. However, utilizing language model to attack NLP model is not a novel technique. For example, [2-3] utilize BERT to conduct word-level substitution.

- Lack of soundness. This is not only the weakness of this paper but also the weakness of a large portion of textual adversarial attack works.
a) The soundness of their method is weak. This paper use language model due to it provide a meaningful representation of the tokens. However, based on the finding of previous work [1], the semantic similarity cannot be guaranteed with language model. A good example is that “I [like] eating apple.” and “I [hate] eating apple” have very high representation similarity according to the language model representation. But their semantic are totally opposite. So I am worried that the adversarial attack will change the semantic meaning of source sentence, leading to the over-estimation of attack success rate.
b) The soundness of their evaluation is weak. The authors evaluate the semantic similarity by the universal sentence encoder and BERTScore. However, as I mentioned above, the soundness of such model-based automatic metrics is limited. The high attack success rate could be partially due to the changing of meaning in source sentence. Conducting a human annotation experiment will be better than just showing an example.

[1] John Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, Yanjun Qi ,Reevaluating Adversarial Examples in Natural Language, EMNLP 2020.
[2] Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, Xipeng Qiu, BERT-ATTACK: Adversarial Attack Against BERT Using BERT, EMNLP 2020.
[3] Siddhant Garg, Goutham Ramakrishnan, BAE: BERT-based Adversarial Examples for Text Classification, EMNLP 2020.

clarity,_quality,_novelty_and_reproducibility: Clarity: This paper is well-written and easy to follow.
Quality: The soundness of their method and evaluation is limited. Please refer to the weakness part.
Novelty: This paper is not very novel. Please refer to the weakness part.
Reproducibility: The reproducibility will not be a issue. The authors claims that their code will be released. And they provide the link of the metric and scripts used in their paper.

summary_of_the_review: This paper proposes an adversarial attack method against neural machine translation model. The authors conduct experiments to show the superiority of their method. However, the novelty and the soundness of this paper is limited. So I tend to reject this paper.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper presents a method for an adversarial attack machine translation model. In particular, the algorithms seek for small pertubation that can significantly degrade the translation quality. Multiple evaluation approaches, including human evaluation, are provided in the revision during the rebuttal. Overall, the paper is interesting and the authors tried hard to address all the comments. However, it's still arguable if the paper is in publishable status to a top venue. 


Strengths: 
+ Different from most existing papers that focus only on text classification tasks, the paper proposes an adversarial attack algorithm for machine translation. The community should encourage more papers considering adversarial attacks for more complex NLP tasks. 
+ The paper shows significant improvement on the previous baseline, seq2sick, for attacking the machine translation model. 

Weaknesses: 

- Several reviewers pointed out the concern of novelty. Although the authors argue the novelty of the approach in the rebuttal, it is still unclear what is the key insight of the proposed approach and how it advances the field. I would suggest the paper elaborating on the key challenge of adversarial attack for translation and how the proposed methods address the challenge. Specifically, the description Sec. 4 provides a nice explanation what has been done, but does not articulate enough what are the intuition and insight behind the approach.

- A few reviewers point out the issue of similarity metrics, and the authors provide human evaluation in the rebuttal. Although I (and reviewers) appreciate the authors provide new results in such a short time, there are still some remaining issues. 1) The evaluation is done in a small scale, it is unclear if the results are reliable; it is also unclear how the annotators are selected and how they get paid. 2) The human evaluation results show that the approach does significant change the meaning of the source sentence. Although the authors argue that the propose approach has smaller difference between the similarity of the original and adversarial sentences in the source v.s target, it is not clear to me this is a right metric. The similarity might not be linearly scale and when the source sentence is grammatically incorrect, the translation can off the track. 

- Related to the previous point, the Appendix D.4 shows adversarial examples generated by the proposed approaches and baselines. Although it demonstrates the proposed appraoch is better than baseline, none of adverarisl examples generated by Transfool make inceptible changes that keep the meaning and maintain the grammatical correctness. For example, Table 9,  the state is changed and there is a spacing issue. Table 10, 12 the meaning of sentences change significantly and the sentences are not grammatically correct. Table 11, 13, 14 the sentences are not grammatically correct. Table 15, 16, the changes are less perceptible, but still the meaning of sentences change. Table 15, the tense changed. Table 16 is probably the only example makes sense. Besides, those examples also show that the evaluation metric is not reliable. For example, the translation of Table 13 is not faithful to the source sentence. Table 16, the BLUE score of Transfool is low because it transliterates the name. 

I agree with the authors that many of prior works suffer from similar issue. However, this does not justify that these concerns should be tolerated. Instead, the community should be more rigiorious in the definition and the evaluation of the advesarial examples.
justification_for_why_not_higher_score: Although the author tried hard to address the issue, there are some inherent issues of the research in NLP adversarial attacks. In particular, the adversarial examples do not really keep the meaning and grammatical correctness of the source input.  Therefore, it's hard to argue that translation quality degradation is caused by adversarial attacks or simply because the translation model cannot deal with grammatically incorrect input. 

Another issue is although the idea of the paper is interesting, it does not elaborate enough on the insight behind the proposed approach. Therefore, several reviewers concern the novelty of the paper.
Decision: Reject