Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors propose a GAN based approach to generate attacks and also claim to enhance the detection of illicit activity in various domains. They use three type of loss functions to train a generator to generate the attacks. The domain they focus on is money laundering and recommendation systems. The authors claim there methods applies to other settings
strength_and_weaknesses: The idea here is not novel as there are a number of papers that use a GAN like structure for generating OOD samples (or adversarial examples) - see references below, of course, mostly focussing on image domain. This paper does not work on image domain, which is actually a strength of the paper.

But, I did not see any insights that are generalizable or even some domain specific hard structural problem that is addressed (i.e., the loss functions used are quite natural and probably too simple). I am not sure why these objective were chosen, is there some citation to support these? I was also hoping to see some quantitative measure of how good the attack is, which in the paper is just shown qualitatively

I do not understand the part about discriminator - a line in the paper says that "the discriminator eventually learns to distinguish synthetic attacks from real data", but isnt a GAN supposed to eventually make the discriminator not be able to distinguish (by learning a good generator)? Along same lines, I do not understand what is going on in Figure 4? It seems rather like adversarial training that a neural network is trained with OOD data and is able to then detect those. But, then the generator can be trained again to bypass this new discriminator?

Baluja, S., & Fischer, I. (2018). Learning to Attack: Adversarial Transformation Networks. Proceedings of the AAAI Conference on Artificial Intelligence, 32(1).
Liu, A., Liu, X., Fan, J., Ma, Y., Zhang, A., Xie, H., & Tao, D. (2019). Perceptual-Sensitive GAN for Generating Adversarial Patches. Proceedings of the AAAI Conference on Artificial Intelligence, 33(01)
Xiao, C., Li, B., Zhu, J. Y., He, W., Liu, M., & Song, D. (2018). Generating adversarial examples with adversarial networks. In 27th International Joint Conference on Artificial Intelligence, IJCAI 2018 (pp. 3905-3911). International Joint Conferences on Artificial Intelligence.
clarity,_quality,_novelty_and_reproducibility: The paper is written clearly and I have not checked the code for reproducibility, but the authors present enough details.

I believe the novelty is limited - see weaknesses listed.

summary_of_the_review: My recommendation is based on my perception of limited novelty and lack of new generalizable principles to be taken away from this work.
review_title: null

final_score: rating: 1: strong reject
review_content: summary_of_the_paper: This paper introduces an adversarial method without label requirements, to enhance the detection of illicit activity in various domains.This method comprises a generator that produces meaningful attacks and a discriminator to detect them.This meaningful attacks can reveal  defensive weaknesses for the discriminator to correct.The method  is evaluated with a suite of experiments in money laundering and recommendation systems .
strength_and_weaknesses: Strengths:

1. Compared with classical GANs,the loss of the author’s generator  is a linear combination of the loss of three components,including the optimisation objective,the GAN and the alert system .this makes the author’s framework can produce out-of-sample data without label requirements.
    
2. In two real-world  cases, money laundering, and recommendation systems.the generator of framework can produce meaningful attacks ,the discriminator can obtain near-perfect classification by training.
    

Weaknesses:

1. The method is  not well demonstrated either by theory or practice.For example, in section 2.1.1,the paper points that the loss of generator of the framework is a linear combination ,where the weights are three hyperparameters controlling. It lacks  theoretical proof in this paper.
    
2. This method has poor versatility because the structure of generator and the optimisation objective of the framework need to be customized.
    
3. In the experiments,the discriminator can obtain near-perfect classification,but the author do not provide convincing evidence of the correctness of the proposed approach or its utility compared to existing approaches.
    
clarity,_quality,_novelty_and_reproducibility: original work
summary_of_the_review: The author provides very limited theoretical and empirical results.This submission looks more like a working draft rather than a conference paper.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper tackles the problem of detection of “illicit” activities. The main proposal is “The Ganfather”, a Generative Adversarial Network (GAN) that automatically crafts samples conforming to a given “illicit activity” which – if not detected – will cause harm to the owners of an information system. By training a detector on the generated “illicit activities”, it is possible to develop a detector that protects the information system against such malicious samples. The proposal, for which no theoretical analysis is provided, is empirically evaluated on two datasets representing typical scenarios affected by illicit activities: money laundering, and recommender systems.
strength_and_weaknesses: STRENGTHS:
+ Potentially of use to practitioners


WEAKNESSES
- Misleading contributions
- Unfair claims
- Poor evaluation
- Lack of theoretical foundations
- No novelty
- Lack of comparison with prior work

clarity,_quality,_novelty_and_reproducibility: Overall, the presentation of the paper is inappropriate for ICLR.

The quality of the English text is mediocre: the manuscript is readable, but the writing is superficial at best.

Figures and Tables are of poor quality.

The topic addressed by the manuscript is source of abundant literature but appropriate for ICLR.

The references are not appropriate, and there are many related works missing.

The contribution is not significant.

The experiments are partially reproducible: the data are public, but the code is not publicly released.

summary_of_the_review: The paper cannot be accepted to ICLR, and I am confident of my decision. Truly, I believe the paper requires a complete re-write, starting from its conceptualization: put simply, the contributions of "The GanFather" - as presented in the paper - are unfair and misleading. Probably, the authors should simply begin by performing a detailed review of existing literature on “automatic” evasion of ML systems / generation of adversarial (or “out of distribution”) samples, as there are hundreds of papers that propose similar systems. Below I will list some additional issues that affect the paper. 

**Misleading contributions (no labels).**
It is unfair to claim that the proposed method requires “no label” as a contribution. First, because the “Ganfather” is simply a GAN, which—by definition—requires no labels. Second, because the problem of labels is that they must be created via the human supervision: although, yes, the GanFather does not require supervision in the form of “labels”, it still requires supervision to define the “intended behavior [of the illicit activity]” (quoted from the introduction). Hence, the absence of labels is a "fake" contribution.

**Misleading contribution (automated attack generation).**
Proposing methods that “automatically generate attacks” is (1) not novel and (2) not a contribution per-se. There are literally thousands of approaches that aim to automatically generate attack samples, which may leverage either basic classifiers [C], or GANs [B], or Reinforcement Learning [A].

**Misleading contribution (detection).**
It is unfair to claim that the proposed method can “automatically learn from attacks” as a contribution. Indeed, the process of “re-training” on evasive samples is well-known in literature [A]. This also applies for the contribution denoted as “Expose and augment current defence system:” (which is a 1:1 overlap with the second one)

**Misleading contributions (generality).** 
It is unappropriate to claim “generality” when the method is provided “as is” (there is a significant lack of theoretical analyses supporting its scientific soundness) and when such supposed “generality” is empirically evaluated on just two settings. What is worse, is that such experiments are shallow: I would have at least expected some sort of statistical validation, but there is no trace of such testings.

**The contributions are not contributions.**
Irrespective of the above, the "contributions" listed in the Introduction are not actually contributions, but rather properties of the proposed "The GANFather" method. The question is: does "The GANFather" perform better than existing methods? Unfortunately, the answer to this question cannot be answered because there is no hard-comparison with any "automatic generation" method. A proper comparison could be made by using any "GAN"-based method to generate some "illicit activities", and then showing that such activities would be either easily detected; or would not be good enough to make a detector "as robust" as those generated by "The GANFather".

**Lack of theoretical analysis.**
As a direct consequence of the above issue, there is no theoretical argument supporting not only the “generality”, but also the rationale behind the proposed “Ganfather” method. The description is provided in Section 2.1.1, but it only consists in a single equation (with several terms never introduced), with no justification whatsoever as to why it would even remotely work. What is worse is that the paper attempts to propose such a method as “novel”: as a matter of fact, no work is cited in Section 2.1 (aside from (Arjovsky et al. 2017) to regulate the GAN loss). I will be blunt and state the following: the claimed generality is passable as a “we use GANs to solve this problem, and hence our method is general; however, the specific application of our method requires domain expertise and significant tuning and supervision” which is unfair, unscientific and definitely not appropriate for ICLR.

**Misleading evaluation of “real-world”**
The abstract states that the paper “evaluates the method in two real-world use cases”. I was hoping that the evaluation was truly performed on some “real world” deployment. However, these use-cases simply use “benchmark” datasets collected from the real-world – which is hardly passable as an “evaluation on a real-world use case”. With such premises, any evaluation can be claimed to be a “real-world use case”.

Some additional issues:

•	The first paragraph of the Introduction is illogical: “Illicit activities frequently target digital systems and services. Importantly, these illicit activities are adversarial: an attacker and a defence system constantly adapt to each other’s behaviour.” First, “illicit activities” do not “target” anything: it is attacker who “target” digital systems and perform “illicit activities” with such systems. Second, the term “adversarial” is misleading, and it is not true that “attacker and defence system constantly adapt” (I dare say in most domains there is no adaptation by the “defence” at all). I suggest revising this paragraph entirely.

•	The second paragraph of the Itntroduction does not logically follow the previous one. What is the need of “for instance”? To me, this paragraph should follow something along the lines of “Despite providing many advantages, information systems are vulnerable to cyber attacks.” The same applies for the third paragraph of the Introduction.

•	The paper states that “Recent estimates indicate undetected money laundering activities of C0.7–3 trillion annually (Lannoo & Parlour, 2021)”. I checked (Lannoo & Parlour, 2021) and I couldn’t find a single occurrence of “0.7—3 trillion”. Rather, I found “Money laundering is estimated to cost the global economy between USD800 billion and USD2 trillion annually, according to the United Nations Office on Drugs and Crime report 2020”. 

•	The following sentence in the Introduction should be revised “For example, a one-star decrease in restaurant ratings can lead to a 5 to 9 percent decrease in revenue (Luca, 2016)1. Detecting malicious agents is far from trivial. A critical challenge relates to class imbalance, as illicit activity is rare. Additionally, labelled datasets are often unavailable or incomplete due to the absence of natural labels and the cost of feedback, primarily generated through manual labelling.” The transition between the example and the technical problems is too abrupt.

•	The paper really looks like a “draft”. The term acronym “AML” is first mentioned in Section 2, but never introduced before (I originally believed it stood for “Adversarial Machine Learning”, but later found out it referred to “Anti-Money Laundering”). Parentheses are sometimes opened and not closed (e.g., beginning of Section 2.1). Equation 1 has several terms that are never mentioned, such as $G, O, D, A$.  The same applies for equation 2: what is $\mathcal{S}_{in}$? 

•	What is the goal of generating “out of distribution” samples if such samples are not realistic in the first place? I am referring to the statement in Section 4.1: “Whereas De Cao & Kipf (2018) concerns generating realistic data that verifies some conditions (e.g., as our method could achieve leveraging the optional alert system), The GANfather generates out-of-distribution data to tackle adversarial domains)”



EXTERNAL REFERENCES

[A]: Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020). Deep reinforcement adversarial learning against botnet evasion attacks. IEEE Transactions on Network and Service Management, 17(4), 1975-1987.

[B]: Usama, M., Asim, M., Latif, S., & Qadir, J. (2019, June). Generative adversarial networks for launching and thwarting adversarial attacks on network intrusion detection systems. In 2019 15th international wireless communications & mobile computing conference (IWCMC) (pp. 78-83). IEEE.

[C]: Garg, S., & Ramakrishnan, G. (2020, November). BAE: BERT-based Adversarial Examples for Text Classification. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) (pp. 6174-6181).

======== 

Update after authors' response:

I appreciate the authors' efforts in improving the paper and toning down some of its original "overclaims". The paper now is more truthful as to what it does. I will increase my score substantially: from a 1 to a 6.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: To tackle the problem of missing or delayed labels in adversarial settings, the authors proposed The GANfather, an adversarial and label-free method to both (1) generate a variety of meaningful attacks, as guided by a custom, user-defined objective function; and (2) train a defence system to detect such attacks. The authors test their framework in two real-world use-cases, namely injection attacks in recommendation systems and anti-money laundering.

Though reviewers liked the setting, they found the paper to be a bit too applied in nature and limited in scope: it is not clear how well it would apply to other domains, datasets, etc., or whether there is a deeper/more fundamental conclusion to be made from this (fundamentally experimental) paper. They authors made changes and toned down their claims, but reviewer concerns remained even after the rebuttal. 
justification_for_why_not_higher_score: Limited novelty/generalizability of results
Decision: Reject