Venue: AAAI 2022 Workshop AdvML

Reviews:

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: This paper proposed novel defense and attack methods using image transformations. The random transformation defense is designed by averaging the scores of results under random transformations. This paper proposed to use Bayesian optimization to select the most informative transformation parameters. The authors also re-implemented and evaluate BaRT attacks and improve their performance.

The experimental results and solid and significant so I recommend a clear acceptance.


review_title: A novel method of empirical attacks and defenses using semantic transformations

final_score: rating: 7: Good paper, accept
review_content: The authors show that backward-pass differentiable approximation struggles to approximate some transformations accurately, and non-differentiable transformation can’t guarantee robustness. Furthermore, the authors propose a novel attack method to evaluate random transformation defenses. This work provides a more reliable evaluation of robustness for random transformation defenses.
review_title: A more reliable evaluation of robustness for random transformation defenses

Meta-review: Both reviewers give high scores on this paper. Thus it is accepted as an oral presentation. 
Decision: Accept (Oral)