Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper proposed a meta attack approach that is capable of attacking a targeted model with fewer queries. It effectively utilizes meta learning approaches to abstract generalizable prior from previous observed attack patterns. Experiments on several benchmark datasets demonstrates it performance in reducing model queries.

- The proposed meta learning approach seems to learn a universal gradient direction of an image x for all networks, which seems to be an ambitious goal. The authors did not provide any intuition or demonstrative explanations towards this. I hope the author could provide some more evidence showing that why this is achievable and is this indeed achieved by the meta learner (e.g., comparing the cosine similarity between the true gradient and the meta learner generated gradient?) 

- In Algorithm 2, the authors seem to use coordinate-wise zeroth-order gradient estimation as in ZOO. I wonder have the authors considered using NES type Gaussian noise to estimate the gradient? As it has been shown to be more efficient than coordinate-wise zeroth-order gradient estimation in (Ilyas et al. 2018).

- I notice that the authors only consider L2 norm attack case and did not include more popular L-infinity norm case. Is there any reason why it can not be applied to L-infinity norm? I didn’t find anywhere in the algorithm that would restrict the choice of norm type. The author might also need to compare with the following recent papers regarding black-box attacks.

Yan, Ziang, Yiwen Guo, and Changshui Zhang. "Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks." arXiv preprint arXiv:1906.04392 (2019).
Moon, Seungyong, Gaon An, and Hyun Oh Song. "Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization." ICML 2019.
Chen, Jinghui, Jinfeng Yi, and Quanquan Gu. "A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks." arXiv preprint arXiv:1811.10828 (2018).

- In experiments part, only 100 images from each dataset may not be representative enough. I would suggest the authors to test more samples. Also please consider only the images that can be correctly classified without perturbation, as there is no need to attack those already misclassified images.

review_title: Official Blind Review #4

final_score: rating: 8: Accept
review_content: The authors proposed a meta-learning based black-box adversarial attack method to reduce the number of queries. Their proposed meta attacker is trained via a meta-learning approach, and it could utilize historical query information and fast adapted to different target models. The authors conduct experiments in three datasets, and the results show that their proposed meta attacker is more efficient than other black-box attack methods. 

Strong points of this paper:
1) novelty. The paper combines meta-learning and black-box attack and develops a deep convolutional model (meta attacker) to predict the gradients of another DNN model. Most of the other query-efficient attack methods focus on utilizing estimated gradients, while this paper focuses on predicting accurate gradients. That makes this paper novel. 
2) The results are good. The proposed method could attain comparable l2 norm and attack success rate with much fewer queries. And the analysis in experiments is interesting. The generalizability experiment of the meta-attacker(meta transfer) shows that gradients in different models and different datasets have some similar patterns. 

Weak points of this paper:
1) The authors could investigate more in the theoretical part. For example, the authors could gives the theoretical support of why a convolutional network could stimulate other networks' gradient. 
2) The deploy of the meta-attacker is not as easy as other black-box attack methods. It would not be practical if we need to meta training the attacker before we use it. 

Questions:
1) Is it hard to meta training the meta-attacker? How long will it take for training? 
2) Is it necessary to finetune the meta attacker in algorithm 2 every m iteration? How to determine the "m"?
3) Could the proposed meta-attacker embedded with other optimized black-box attack methods? 

Overall, this paper is well-structured, novel, and ideas are well motivated. The query-efficient black-box attack problem is practical and meaningful. I would encourage the authors to release their codes. Last, I would recommend acceptance for this paper. 


review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: Summary:

The authors of this paper propose a novel approach for query-efficient black-box adversarial attacks by leveraging meta-learning to approximate the gradient of given clean images. 

Paper strength:
1.	The overall idea of this paper is interesting to improve the transferability of adversarial examples through meta-learning. 
2.	The paper is well-organized and easy to follow.
3.	Adequate experiment results demonstrate that the meta-attacker is efficient to decrease the number of queries for the adversarial attacks. It is interesting to see the meta attacker trained on certain source domain can be transferred to other domains.

Paper weakness:

1.	The authors miss some important details about training meta attackers like how many images you choose to get the image and its gradient pairs. Are the images from the training set or test set. Is there an overlap between the meta-attacker training set and the test set? 
2.	What if you try to learn the adversarial perturbation directly instead of learning the gradient of images?
3.	How about changing the meta learner to vanilla training and learning an autoencoder directly to map the image to its gradient? There could be a problem of how to incorporate the existing classifiers, but I think this could be an important baseline.
4.	The authors try to use the gradient from the ZOO to guide the pre-trained meta attacker to adapt to a new classifier in Algorithm 2 (line 3). What if you take multi-step ZOO to give a much stronger prior to finetuning?
5.	Take a look at the confusion matrix in [1] which studies the transferability of white-box attack and black-box attack. I think it could be more interesting if the authors change the ground truth from gradient to estimated gradient from ZOO for learning meta-attacker. 


Li, Yandong, et al. "NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks." arXiv preprint arXiv:1905.00441 (2019).

review_title: Official Blind Review #3

Meta-review: This paper proposes a meta attack approach based on meta learning approaches to learn generalizable prior from the previously observed attack patterns. The proposed approach is able to attack targeted models with much fewer queries. After author response, all reviewers are very positive about the paper. Thus I recommend accept. 
Decision: Accept (Poster)