Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: The paper introduces a new approach to generate adversarial examples for deep classifiers. As opposed to the majority of work on adversarial attack models, which generally limit the attacker on pixel-space distortions measured with respect to an Lp norm, the authors here consider a slightly more general attack model that is a combination of an affine transformation and additive L2 perturbation of the input example. 

Finding optimal attacks for this model can be non-trivial (standard due to the highly nonlinear coupling between the affine parameters and the additive perturbation), so the authors instead propose training a surrogate neural network that generates the attack affine-transformation and distortion- parameters sequentially. This can, in principle, be done in a traditional supervised training setup; however, to force the adversarial images to look perceptually close to natural looking images, the authors throw a discriminator loss on top, and train the attack generator network adversarially.

The paper is well-written in general, the idea is intuitive, and the experiments are well-described. However, I have a few concerns that lead to me to give a low score (at least in the first round of reviews).

- Novelty. 
Leveraging spatial distortions (or other visually meaningful transformations) to generate adversarial attacks is not a new idea, but the authors seem to have been unaware of this very large body of work. See, for example:
** Engstrom et al, "Exploring the landscape of spatial robustness", ICML 2019
** Poovendran et al, "Semantic adversarial examples", CVPR 2018
** Ho et al, "Catastrophic Child's Play", CVPR 2019
** Joshi et al, "Semantic adversarial attacks", ICCV 2019
among many others.

Using GAN-like transformation models to generate attacks is also not a new idea. A few of the above papers use this approach, and the authors refer to a few other such papers as well.

So as such, the conceptual novelty of the contribution seems to be low (beyond the specific choice of combining affine and L2 perturbations).

- Experimental evaluation.
The authors do a commendable job thoroughly laying out the experimental setup. However, a couple of red flags emerge in the experiments. First, why not look at L-infty perturbations (as opposed to L2)? Second, why not test on more challenging datasets (CIFAR, CelebA, etc) as opposed to simple black/white datasets such as MNIST/Fashion-MNIST? One would imagine that the smaller, simpler datasets are easier to optimize for, and therefore the "amortized" attack generator networks are not necessary here.

- Weakness of theoretical part.
I am not sure the theorem is saying anything strong or useful (since the underlying transformer neural network is assumed to possess infinite capacity). I would suggest just removing it.

review_title: Official Blind Review #1

final_score: rating: 1: Reject
review_content: This paper builds upon the work of AdvGAN and proposes to add spatial transformations on top of it. The resulting attacking framework is demonstrated to outperform AdvGAN on attacking several defense approaches, such as Defense-GAN, AdvCritic and adversarial training. Compared to previous approaches on generating spatially transformed adversarial examples, this approaches amortizes the attacking procedure and can produce spatially transformed adversarial examples much faster. This approach also simultaneously combine spatial transformations and perturbations to make the attack stronger.

I cannot recommend acceptance of this paper because of several reasons:

- The idea is not novel enough. It is simply an A + B paper where A = AdvGAN and B = spatial transformer networks. The idea of adversarial attacks with spatial distortion is not the innovation of this paper and has been proposed and extensively studied by many previous papers. This paper does not have additional innovation and does not lead to additional insight that can warrant an acceptance at ICLR.

- The general narrative of this paper is misleading. The title seems to indicate this paper is the first to discover the importance of considering spatial perturbations, which is misleading. There is no mention of previous work on spatial transformation attacks in either the abstract nor the introduction (except at the very last). The introduction simply analyzes some well-known phenomenon in the literature, does not place this work well in the literature (even true in the related work section as well), and can mislead readers in believing that this work was the first to realize the importance of spatial transformation attacks.

- Theorem 1 is a vacuous statement. It is automatically true based on the universal approximation assumption of neural networks. Including the statement of Theorem 1 is decorative and a waste of space.

- The experiments are not convincing. For example, there is no \gamma value reported in the tables. Since \gamma is as important as \epsilon in the proposed attacking method, the missing of this important variate is suspicious. Also the adversarial training only uses FGSM not PGD. The Defense-GAN is already shown not robust by Athalye et al. and cannot be considered as one of the state-of-the-art defenses. 
review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: This paper proposes a new adversarial attack method by combining spatial transformations with perturbation-based noises. The proposed method uses two networks to generate the parameters of spatial transformation and the perturbation noise. The whole architecture is trained by a variant of GAN-loss to make the adversarial examples realistic to humans. Experiments on MNIST prove that the proposed attack method can improve the success rate of white-box attacks against several models.

Overall, this paper considers an important problem of adversarial robustness of classifiers, and present a new approach to craft adversarial examples. The writing is clear. However, I have some concerns about this paper.

1. This paper seems to integrate multiple ideas studied before into a single attack method. Perturbation-based adversarial examples, spatial transformation-based adversarial examples, generating adversarial examples based on the GAN loss are all studied before. And the proposed method integrates them together to form a new attack.

2. The experiments are only conducted on MNIST and Fashion MNIST. More experiments on CIFAR-10 and ImageNet can further prove the effectiveness of the proposed method.

3. More robust defense models should be incorporated in experiments, at least the PGD-based adversarial training model (Madry et al., 2018).
review_title: Official Blind Review #3

Meta-review: The method proposed and explored here is to introduce small spatial distortions, with the goal of making them undetectable by humans but affecting the classification of the images. As reviewers point out, very similar methods have been tested before. The methods are also only tested on a few low-resolution datasets. 

The reviewers are unanimous in their judgement that the method is not novel enough, and the authors' rebuttals have not convinced the reviewers or me about the opposite.
Decision: Reject