Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: Driven by the success of data augmentation in improving the transferability of adversarial samples, this paper conducts an empirical investigation about the best combination of different data augmentations towards boosting the adversarial transferability. Experiments across ten data augmentations lead to a new composition that outperforms previous data augmentation methods.
strength_and_weaknesses: **Strength**

1. An empirical investigation about the combination of the best practices in data augmentations for boosting adversarial transferability can provide useful insights for the community.

**Weakness**

1. The novelty of this paper is very limited. It manually combines existing data augmentations to generate a better augmentation strategy without providing theoretical analysis or an automatic solution, which is more like a technical report. The technical contributions cannot match the bar of ICLR.

2. The paper wastes too much contents on background knowledge about adversarial attacks and data augmentations, and starts to introduce the experimental results, which are the major contributions of this paper, from the 6th page. The presentation style can be better organized.

3. The experimental results are not solid enough. Only one dataset with 1000 images is considered, while the datasets like CIFAR-10/100/SVHN/ImageNet, which are commonly adopted in the literature, are not included. In addition, only one perturbation strength (16/255) is considered. It is highly desired to conduct experiments across different datasets, perturbation strengths, and defensive methods, otherwise the accuracy gap between the proposed methods and baselines in Table 1/2 may be overturned via tuning the hyperparameters of adversarial example generation.
clarity,_quality,_novelty_and_reproducibility: The paper wastes too much contents on backgrounds, which hurts the presentation clarity, and the novelty is very limited. The reproducibility is good as the codes are provided via an anonymous link.
summary_of_the_review: Considering the limited novelty and the lack of necessary experiments as elaborated in the weakness section, I tend to reject this paper.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: In this work, the authors study in detail the effect of a diverse set of data-augmentation techniques on the transferability of adversarial attacks in the black-box setting. The paper presents a large systematized empirical study of the effect of adversarial transferability with the use of augmentations such as Color Jitter, Fancy Principle Component Analysis, Channel shuffle, Greyscale, random erasing, sharpening, CutMix, neural transfer and AutoAugment. In particular, the paper finds that the composition of several such augmentations generally yields increased transferability.
strength_and_weaknesses: Strengths:
1) The paper clearly motivates the study of augmentation to boost adversarial transferability, and covers contributions of past works in a clear, concise manner which helps place the findings uncovered in a systematic framework.
2) The paper presents a fairly detailed set of empirical evaluations on a wide range of deep networks with different architectures, on a 430-class subset of ImageNet with 1000 images that is commonly used to assess adversarial transferability. The inclusion of both normally trained and adversarially trained models in the evaluations helps establish the results in a detailed manner.
3) The proposed combination of augmentations is largely seen to outperform the current state of the art, which largely serves as a baseline, especially considering that DST-MI-FGSM is a subset of the final augmentations utilized.



Weaknesses:
1) With the large number of possible augmentations available, the paper primarily focuses on the parallel composition of augmentations, as opposed to the serial case as done in prior works (eg. as in DST-MI-FGSM). However, given that this is a key aspect of the paper, more details could have been provided in Section-3.3 to better understand the associated pros and cons. 
2) For example, it appears that parallel augmentations apriori require additional forward and backward passes as opposed to serial composition. Could the authors kindly clarify if the parameter of interest “m” in Algorithm1 is kept constant for the proposed approach as compared to prior works? Or is the sampling over the distribution D done independently for different augmentations in the parallel-composition setting?
3) Furthermore, given that the prior methods such as DST-MI-FGSM are subsumed by the proposed approach, a more thorough complexity analysis needs to be included. Thus, the running time required for generating the attacks using UltimateCombo could be reported for a subset of the models considered.
4) While the empirical results presented are indeed interesting, the paper could have possibly devoted more attention to analyzing why such compositions are more effective. For example, a slightly more detailed discussion as currently provided in Section-5.4 could have been included with respect to cosine similarity of gradients post parallel-composition, and the direction towards mitigating the effect of overfitting during the use of a single surrogate model as compared to an ensemble.
5) While the majority of the results are presented on the ImageNet subset, additional evaluations over other standard datasets such as CIFAR-10 or CIFAR-100 could be included, given that it has served as a benchmark for adversarial defense research for the past few years (though some prior works on adversarial transferability exclude these as well). This could also potentially help weed out results that are overly-specific to the case of ImageNet based images, and help generate a better understanding towards the compositional nature of augmentations.


Minor Typos-
 Page3: “ set of these defense.” -> ” set of these defenses.”
Page5: “The main difference from e is that” -> “The main difference from RE is that”



clarity,_quality,_novelty_and_reproducibility: The paper overall is well-written and presents most of the matter in a clear, concise manner. While the key contributions are an extension of prior works, the empirical evaluations presented are fairly thorough. 
summary_of_the_review: The paper presents a systematic study regarding the composition of augmentations to boost adversarial transferability. Indeed, it finds a performative subset such that enhanced transferability is observed over prior state-of-the-art approaches, which are largely subsumed by the proposed composition. However, as mentioned in the weaknesses section, more details could be provided to clarify key aspects of the proposed approach, alongside complexity comparisons to prior approaches. I would be willing to raise my score further if these points could be addressed in detail.


Post-Rebuttal Update:
A note has been added titled "Post-Rebuttal Comments and Modification to Recommendation" in the thread below. I would like to update my score to be “3: reject, not good enough".
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes to enhance the transferability of adversarial examples by doing adversarial attacks using multiple data augmentation parallelly. 
strength_and_weaknesses: Pros:

1. The paper study a novel problem of how data augmentation affects adversarial attacks' effectiveness. 

2. The work considers multiple model architectures to test its proposed method. 

Cons:

1. Lack of clarity
- 1(a) Section 3.3. The author says “In parallel composition, augmentation methods are applied independently on the input, and their outputs are aggregated (i.e., taking their union)”. I cannot understand, what means by "their outputs are aggregated (i.e., taking their union)". Do you feed the model with the union of augmented images? Or randomly choose one augmentation to apply?
- 1(b) Section 5.1. The section title says "COLOR-SPACE AUGMENTATIONS OUTPERFORM THE STATE OF THE A RT". This title does not match the argument in this paragraph. What this paragraph says is actually, composing COLOR-SPACE AUGMENTATIONS with the SOTA method (DST) is better than the SOTA (DST-MI-FGSM)
- 1(c) Section 5.2. The author says "The results reflected a mostly monotonic relationship between transferability and augmentations." But the results seem to be not displayed in this paper. 
- 1(d) Section 5.4 The author says "As can be seen from Table 5, the methods least conducive for transferability (NeuTrans and Sharp) ..." I do not find any evidence saying that NeuTrans and Sharp have the least transferability. 

clarity,_quality,_novelty_and_reproducibility: The paper has a fair novelty in its method. However, the paper has a pool of clarity that prevents the reader from fully understanding the proposed method and appreciating this work. 
summary_of_the_review: Based on the pool clarity, I am afraid that the current submission does not reach the bar of acceptance. If the clarity is improved in the rebuttal, I will consider re-evaluating this manuscript.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper studies the use of various data augmentation in boosting the attack transferability of adversarial examples. Overall, the paper is clear and the experimental results and analysis support the claim.
strength_and_weaknesses: __Strength__

__[S1]__ The paper is easy to follow.

__[S2]__ The method is simple, practical and effective.

__Weakness__

__[W1] Lack of novelty.__ The paper studies the use of data augmentation in improving the attack transferability of adversarial examples. Apparently, all the data augmentation schemes are based on established works. There are no new theories or methods about data augmentation and attack transferability are introduced.

__[W2] Lack of comparison with related works.__ The paper should discuss and compare the method with existing works, e.g. [Huang et al., 2019], [Wang et al., 2021], [Wu et al., 2021].

__[W2] Insufficient experiments.__ The study is only conducted on the ImageNet-compatible dataset using MI-FGSM on Inception- and ResNet-based models. It is unknown if the findings will be the same on other datasets (e.g. CIFAR-100), attack methods (e.g. I-FGSM) and architectures (e.g. VGG).

__Ref.__

[Huang et al., 2019]: Enhancing Adversarial Example Transferability with an Intermediate Level Attack.

[Wang et al., 2021]: Enhancing the Transferability of Adversarial Attacks through Variance Tuning.

[Wu et al., 2021]: Improving the Transferability of Adversarial Samples with Adversarial Transformations.

clarity,_quality,_novelty_and_reproducibility: The paper is easy to follow. The analysis is sound and reasonable. However, a large part of the study is based on established work (see W1). Also, the paper does not compare or discuss their method with existing works (see W2).
summary_of_the_review: Overall, this paper proposes a simple way to combine different data augmentation methods to improve the attack transferability of adversarial samples. Due to the lack of novelty and comparison with related works, I tend to vote for rejecting the submission.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper experimentally verifies the effect of augmentation (and their compositions) in improving the transferability of adversarial examples.
However, all of the reviewers insisted on rejecting this paper due to several reasons. The biggest concern is that the novelty of this paper is very limited. The fact that performance can be improved simply through known augmentations is a fact that can be generally accepted in almost all tasks. I would like to recommend that you analyze the nature of this task in more depth and propose augmentation specific to this task.
justification_for_why_not_higher_score: limited novelty
justification_for_why_not_lower_score: n/a
Decision: Reject