Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper tries to attack the pre-trained models (when handling the downstream tasks) by introducing a Low-Level Layer Lifting Attack (L4A) method, which mainly perturbation the neurons lying at the low-level layers of the pre-trained models.
strengths_and_weaknesses: Strengths:

The method looks simple and effective. It greatly improved the attack success rate compared to the SOTA.


Weaknesses:

1. Figure 1 gives little information about this method, and I think more detailed information should be given in the caption. 
2. The author just uses three pre-trained models, two of which are similar (ResNet50 and ResNet101); how about the performance on CLIP or the other pre-trained models?
questions: For the `Low-Level Layer Lifting Attack`, the authors chose the first and second layers of the pre-trained to attack since they found the layers laying at a higher level, the more their parameters change during fine-tuning. However, this does not mean that attacks the parameters at the higher level layers are useless. Hence, some additional experiments can be done. For example, attack all the parameters at different layers but with some hyperparameters (i.e., loss weights to balance each term). Also, I think there should be a hyperparameter in `Eq.5` between those two norm.
limitations: Yes
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This work proposes a new type of adversarial attack that aims at the pre-trained models, which could still fool the pre-trained model after fine-tuning. The proposed method is built upon the observation that the lower layers of the pre-trained model hardly change after fine-tuning. Specifically, they propose to generate a perturbation that can fool the feature of lower layers. Empirical results demonstrate a high attack success rate after fine-tuning.
strengths_and_weaknesses: Strengths 
1. Figure 2 nicely shows the feature in the lower layers only change a little.
2. The performance on multiple datasets is reported.

Weaknesses
1. For the motivation, I am wondering if this setting is realistic. In practice, it is way harder to get the pre-trained model than the weight of the model. Moreover, knowing the weight of the model can make the adversarial attack much more successful (since we can attack both low and deep layers). In this case, why do we still want to attack the pre-trained model?

2. For evaluation, the authors only attack the standard pre-trained models. I think it is necessary for conducting experiments on the adversarial pre-trained models, which are obviously more robust than the standard pre-trained models.

3. For evaluation, the fine-tuning setting is not described. Which fine-tuning is performed here, adversarial or standard fine-tuning? If it's adversarial fine-tuning, which adversarial fine-tuning method is employed here? If it's standard fine-tuning, what's the attack success rate for adversarial fine-tuned models.

4. There is no detailed description in the caption of Table 1, Table 2, and Table 3. It is hard to learn the meaning of the percentage value in these Tables
questions: My concerns and questions are listed in the weakness part.
limitations: No social negative impact is found here.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper aims to propose a new attack method that can specifically improve the attack success rate on big pre-trained models. The newly proposed two techniques, Low-Level Layer Lifting Attack and Uniform Gaussian Sampling, have demonstrated notable performance improvement. 
strengths_and_weaknesses: ## Strengths

(1) The proposed methods sound reasonable. Damaging the low-level features of the pre-trained models intuitively should have the ability to attack the downstream tasks. 

(2) The experimental results have demonstrated the effectiveness of the proposed methods, outperforming the previous methods by a large margin. 

(3) The analysis of the proposed method is quite extensive, almost covering all the aspects I can think of. The trade-off between the clean accuracy and robustness is interesting.

## Weaknesses

(1) All the figures and tables are two small. I need to zoom in by 300% to clearly see the contents.

(2) I am curious about the formulation of Eq4. Why don't we maximize ||f(x + δ) - f(x)||, but to maximize -f(x + δ)?
questions: Please refer to my previous questions on the weakness part.
limitations: Yes
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper deals with robustness of pretrained models (i.e. self-supervised feature learners which can be used for multiple downstream tasks).  The goal of this paper is to develop "pretrained adversarial perturbations" (short: PAP) -- perturbations that are crafted to attack pretrained models AND their downstream tasks, without having any knowledge about the downstream tasks.  To generate PAPs, a method is developed -- Low-Level Layer Lifting Attack (L4A), which "lifts" the neuron activations of lower-level layers of the neural network.  

Experiments are performed on the downstream task of image classification.  Two pretraining methods are used:  SimCLR (with convolutional networks) and MAE (with transformer networks).  ImageNet is used as the pretraining dataset.  
strengths_and_weaknesses: ## Strengths:
1. Recently, pretrained models have been shown to be useful for many downstream tasks, and in many domains (such as vision, NLP, robotics, audio, ..).  Additionally, "prompt" learning has made pretrained models easy to apply in a zero-shot setting.  Due to these reasons, the idea of transferable adversarial perturbations (i.e. learned on the pretrained model, but also affecting unseen downstream tasks) is interesting and useful for the community.
2. Sec 5 discussion on why UAP is better than PAP on the pretraning domain, is a good contribution.
3. The finding from Fig 2 is interesting -- it shows that lower-level features of the classifier do not deviate much after finetuning on downstream tasks.  

## Weaknesses:
1. The proposed method is tested only on image classification tasks.  Often pretrained models are used for many different tasks (for eg. in NLP, pretrained language models can be used for text classification, text generation, machine translation, question answering, etc.  Recently, there has also been an effort to use pretrained vision-language models for many different downstream tasks.  This paper falls short of evaluating the adversarial perturbations on *different* tasks (not just different datasets for the same task).  See:
    i. https://arxiv.org/abs/2204.14198
    ii. https://arxiv.org/abs/2104.00743
2. Eq 6 ($PAP_{UGS}$) method, uses information from the finetuning datasets -- this should be clearly mentioned in the paper.  It only becomes apparent after reading Eq 6.  

Overall -- the paper does a good job at defining a new problem statement, providing a method, and showing empirical results on one task (image classification).  However, I find it lacking in terms of transferability to other tasks (see weakness 1).
questions: ## Questions:
1. Line 125:  "In our experiments, we find the lower the layer is, the better it performs, so we choose the first layer as default, such that k = 1.".  Did you compare with pixel-level perturbations?  i.e. instead of perturbing the feature space, perturb the pixels (this would be equivalent to prior work ike PGD, FGSM etc.). How does PAPs method compare against these?
2. In Table 1, 2 -- UAPEPGD seems to perform significantly better than PAPs for certain datasets (eg. CIFAR10), but on an average PAPs is better -- what might be the reason for this?  Please provide some intuition for this.  
3. It is unclear why Sec 4.5 (tradeoff between robustness and clean accuracy) is needed.  This is a well-known result as the paper itself cites Zheng et al for example.  Since the setting of this paper is different, as mentioned by line 250-252, what is the new insight that is being conveyed through Sec 4.5 / Fig 7?

## Suggestions about Formatting, Typos, Structure etc. (Note: these points do not affect my rating, but will be better to address)
1. Please increase the font size for tables 1, 2, 3 and figure 7.
2. Please also include a section on adversarial defenses, and (if there are) techniques developed for defending against trasferable / universal perturbations.  
3. Line 114: " To alleviate the lousy effect of the above negative factors" -- the term "lousy" seems out of place here.  I would probably just rephrase it as "To alleviate the negative effect of the above factors".
4. In Table 1, 2, 3, please mention that the % numbers are error rates -- this isn't mentioned anywhere in the paper. 

limitations: Limitations and social impact are mentioned in Sec 6.
This section should also mention that finding from previous sections -- that UAP is a better attacker than PAPs on the pretraining domain -- as a limitation.
review_title: null

Meta-review: metareview: This paper develops an attack method for the pre-trained models so the attack can remain effective even for downstream tasks. The authors introduced a Low-Level Layer Lifting Attack (L4A) method, which mainly perturbation the neurons lying at the low-level layers of the pre-trained models. Their method looks simple and effective, and multiple datasets and settings are reported to justify its effectiveness. During rebuttal, the authors also reported additional results on adversarial pre-training, which would be valuable to add to the final paper. 

On the negative side, the proposed method is tested only on the image classification task.  Besides, the authors should have provided the required social/ethical review statement and questionnaire responses - please make sure to add. 

Overall, this paper passes the bar given the generally positive sentiment among reviewers.

confidence: Certain
Decision: Accept