Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper proposes the GAMA attack, a generative approach to generating adversarial examples. The proposed method incorporates the vision-language model CLIP in the training of the generator. Experiments demonstrate the effectiveness of the proposed method in various attack settings.
strengths_and_weaknesses: ### Strengths 
* The paper is well-written and easy to follow.
* Experiments demonstrate the effectiveness of the proposed method in various attack settings, including both the white-box and the black-box, even under the setting with different datasets and tasks.

### Weaknesses
* The major concern is that the algorithmic contribution of the proposed method is limited. The main contribution of the proposed method is incorporating the vision-language model CLIP in the training of the generator, which is also the main concern.  Previous methods only train the generator with a pre-trained DNN and the corresponding dataset. Instead of a pre-trained model, the proposed method requires access to the CLIP model. The  CLIP  extracts knowledge from ~400 million image-text pairs. Thus, the proposed method actually leverages much more information in training the generator, compared with previous generative approaches. Thus, the effectiveness of the proposed method is obvious, since it leverages much more information. From this perspective, the algorithmic contribution of the proposed method seems limited.



questions: * Does the GAMA attack perform well on the single-object dataset like ImageNet? In Table 1, it is said that the GAMA attack can analyze both attacking scenarios with input scenes that contain multiple objects or a single object. However, in experiments, the GAMA attack is only trained on PASCAL-VOC and MS-COCO, which are scenes containing multiple objects. So does the GAMA attack perform well when training on the single-object dataset like ImageNet?
* How to conduct fair comparisons with baseline methods, which aim to handle attacking scenarios with input scenes that contain a single object? As mentioned in Table 1, previous methods only analyze single-object attacking scenarios. However, in experiments, all previous methods are also trained on PASCAL-VOC and MS-COCO,  which are scenes containing multiple objects. Is it fair to compare with baseline methods in a different setting from their original design?
limitations: The authors adequately addressed the limitations and potential negative social impact of their work.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper introduces the first multi-object generative attack, GAMA, which utilizes a pre-trained CLIP model as an attacker tool to enhance the transferability across different data distributions. Extensive experiments in this paper show that GAMA can achieve state-of-the-art transferability on various black-box settings when training on multi-label datasets. Besides, GAMA also shows its superior efficacy against various defense methods compared with baselines.
strengths_and_weaknesses: Pros:

1. This paper first proposes the problem of multi-object scene based adversarial attack. 

2. Introducing joint vision-and-language pre-trained models, such as CLIP, to adversarial attacks is interesting. Specifically, the authors generate multi-class text prompts and leverage the semantics relationship underlying the text representations to tackle the multi-object attack problem. 

3. When training on multi-label datasets, the proposed method outperforms prior works in terms of transferability on various black-box settings.

4. This paper is clearly written and very easy to follow. 

Cons:

1. This paper only considers the settings of training on multi-object datasets in the experiments, such as Pascal-VOC and MS-COCO, and shows its superiority compared with prior works. Those prior works focus on single-object scenes and the authors adapted them to multi-object scenes. However, the proposed method should also be able to handle single-object scenarios, while the experiments of training on single-object scenes, such as ImageNet, and transferring to other single-object datasets, as done in TAP [12], BIA [13], are not included in this paper. I am curious about how GAMA performs compared with those prior works on this standard setting.

2. Typos: L159 and L201: $\mathcal{L}\_{\text{txt}}$ -> $\mathcal{L}\_{\text{img}}$.


questions: 1. See Con 1), How does GAMA perform and transfer compared with prior works on attacking single-object scenes? This result should play an important role in judging the significance and applicability of this paper to the community. If GAMA can still beat those baselines that focus on single-object attacks then in the future one could directly choose to use GAMA to perform attacks without caring about the number of objects in the image.

2. For $\rho\_\text{img}$ and $\rho\_\text{txt}$, are you using the joint image/text embeddings or the embeddings that directly come from the image/text encoder? Do you use any normalization on $z$, $\hat{z}$, $\rho\_\text{img}$, and $\rho\_\text{txt}$? If not, how do you ensure that $\hat{z}$, $\rho\_\text{img}$, and $\rho\_\text{txt}$ are within the same feature space so that you can contrast them with each other, considering that the surrogate classifier and CLIP image/text encoder are using different architectures.
limitations: The authors adequately discussed the limitations and potential societal impact in the last section of the main paper.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper studies the problem of adversarial attacks on multi-object scenes by leveraging a pre-trained vision language model. More specifically, it leverages the joint embedding space learned from cross-modal data to provide self-supervised signals for generating adversarial perturbations on the image domain. Experiments have been conducted on multiple image benchmarks including single-object benchmarks such as PASCAL-VOC and multi-object benchmarks such as MS-COCO.
strengths_and_weaknesses: Strengths:
* [S1] This paper presents a clean solution to generating multi-object attacks. The quantitative results demonstrate the strength of the proposed attacks when compared to state-of-the-art attacks. The reviewer feels that the paper could possibly open up a new research area of using foundation models to craft adversarial attacks and defenses in the future.

Weaknesses:
* [W1] In Table 3 and Table 5, the proposed GAMA is less effective than TAP [Ref 12] when applied to the VGG19 network. It would be helpful to provide some explanations and high-level insights on this.
* [W2] Although the quantitative experiments are thorough and solid enough, the qualitative analysis is definitely insufficient (Figure 5). As a scientific study, it would be helpful to understand how GAMA explores the perturbation space compared to other existing attacks (e.g., perturbation/feature visualization).
* [W3] Missing discussions on mid-level or semantic-level adversarial attacks using generative models ([NewRef1-2]).

References 
* [NewRef 1] SemanticAdv: Generating Adversarial Examples via Attribute-conditioned Image Editing. Qiu et al., In ECCV 2020.
* [NewRef 2] Unrestricted Adversarial Examples via Semantic Manipulation. Bhattad et al., In ICLR 2020.
questions: * [Q1] Explain why GAMA is less effective than TAP in some cases as mentioned in [W1]. 
* [Q2] Provide some findings and analysis of the GAMA perturbations (e.g., raw input level and feature level).
limitations: Limitations have been mentioned in the paper.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes the first generative adversarial attack specifically for multi-object scene classification. It makes use of a CLIP model to provide additional losses during training. Good performance is achieved across a variety of tasks and models in black box and white box settings.
strengths_and_weaknesses: Strengths:
- The paper is well written and the explanation of the method is relatively easy to understand given its complexity.
- The results are convincing and demonstrate the effectiveness of the method on various tasks, datasets and models, and in both black and white box settings.
Weaknesses:
- The method does not outperform the baselines as consistently when trained on MSCOCO as it does on Pascal-VOC
questions: 1. Can you explain why you think the method works better when trained on Pascal-VOC vs MSCOCO?
2. Have you evaluated the adversarial images on the clip model? 
limitations: The discussion of limitations and societal impacts is good.
review_title: null

Meta-review: metareview: The authors proposed the first multi-object generative attack, GAMA, which utilizes the vision-language model CLIP as an attacker's tool in the training of the generator to enhance the transferability across different data distributions. 
All four reviewers recognize that this paper is well-written and easy to follow. The presented results also are promising. Most importantly, the Generative Adversarial Multi-object scene Attack is good direction for further study.
Since the four reviewers consistently accept the paper with good comments, the AC made a decision of acceptance.
confidence: Certain
Decision: Accept