Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: Paper proposes a novel adversarial transferability attack (i.e. an adversarial attack when a surrogate model is used to attack an unknown model). Proposed method works by modifying iterative proceduce to find adversarial examples, such that it tend to find adversarial examples in flatter regions of a loss surface.
Authors conduct thorough study of the method.

main_review: Paper is well written, evaluation is reasonably good and thorough. Results show that method helps to improve transferability of adversarial examples.

Nevertheless there are few things in evaluation that could be improved:

1. Authors use I-FGSM as one of the baseline attacks, but it’s not clear whether they do random restarts (as described in https://arxiv.org/abs/1706.06083 ). It would be useful to clarify this and if authors don’t do random restarts then add an attack with random restarts.

2. Most evaluation is done on undefended models. It would be interesting to study attack performance when source and/or target model is adversarially trained. While authors mentioned few defended models from Tramer at al 2018, it has been shown later that ensemble adversarial training is not particularly strong defence. It’s much better to perform multi-step PGD adversarial training, like in https://arxiv.org/abs/1812.03411. Note that it has been shown that denoising used in https://arxiv.org/abs/1812.03411 is not a good defense, nevertheless authors do produce an adversarially trained model without denoising.
summary_of_the_review: Reasonably good paper. There are few potential improvements for evaluation procedure.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes an adversarial attack, RAP, to boost the transferability of adversarial examples, based on the intuition of flatness of loss landscape and model generalization.
Experimental results show that the proposed attack is more effective against real world APIs.


main_review: The paper is easy to follow and the motivation is clear. However, the technical novelty of the paper is limited. The proposed attack method mainly leverage the minmax framework to search for regions that may have high adversarial transferability loss and then minimize the loss for those regions so as to achieve “flat” loss regions. The algorithms to solve the minmax optimization is standard and follows the existing work. There is no convergence, or any transferability guarantee.

Empirically, from table 3, the targeted attack success rate improvement is usually not significant. Since the paper aims to propose a more transferable attack, it would be interesting to see if it can attack against existing defenses, including the gradient obfuscated ones comparing BPDA attack [1] and adversarially trained models. 

[1] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

summary_of_the_review: Overall the paper is well motivated, and the problem statement is clear. However the technical novelty is limited and more baseliens on improving adversarial transferability need to be compared with.
It would be interesting to see if the proposed method can boost the adversarial transferability for different tasks such as object detections as well.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on the transferability of the adversarial examples and proposes to boost the transferability by reversing the adversarial perturbation. The motivation is that the flatness of the loss landscape can help to alleviate the overfitting to surrogate models, and thus improve the transferability. Specifically,  instead of purely minimizing the adversarial loss at a single adversarial point, this paper injects the worst-case perturbation for each step of the optimization procedure. Experimental results show that the proposed method surpasses the SOTA transfer-based attack methods by a clear margin, which demonstrates its effectiveness. 
main_review: Strengths:
- The writing is clear and the proposed method is easy to follow.
- The idea to seek a flat region of loss landscape to improve the transferability is novel. Instead of purely minimizing the adversarial loss at a single adversarial point, the paper proposes to find a flat region of loss landscape by bi-level max-min optimization, so as to eliminate the overfitting problem of adversarial attacks.
-  The experimental results demonstrated the effectiveness of the proposed method. By injecting the proposed attack method into the existing attack method, the paper improves the transferability of adversarial examples by a large marge in both untargeted attacks and targeted attacks. 

Weaknesses:
- The evaluation of defense methods is somewhat limited, the paper only considers the ensemble adversarial training, and many advanced defense methods are lost (such as feature denoising [1] and NRP [2]).
- A drawback of the proposed method is that it requires to conduct T steps update in the inner maximization, which increases the overhead of adversarial attacks.

Suggestions:
- In section 4.2, the paper plots the visualizations of loss landscapes of targeted attacks,  the loss landscapes of untargeted attacks are also needed.

[1] Feature denoising for improving adversarial robustness. CVPR 2019.
[2] A self-supervised approach for adversarial robustness. CVPR 2020.
summary_of_the_review: Overall, the paper proposes a novel adversarial attack, which is effective and easy to follow. I think the paper is marginally above the acceptance threshold, although there are some weaknesses.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a min-max formulation to improve attack transferability. The key idea is motivated by the fact that the smoothness of the loss landscape could improve model generalization ability.  Thus, a reverse adversarial noise (for landscape smoothing) is injected so as to compensate for the effect of an adversarial attack. Numerous experiments are provided to demonstrate the effectiveness of reverse adversarial perturbation (RAP). 


main_review: Strengths:

+ The bi-level min-max formulation is novel for generating transferrable attacks. 
+ There exist extensive experiments involving a variety of model architectures and baselines. 


Weakness:

- The flatness of loss landscape with respect to (w.r.t.) input vs. model generalization should be more carefully studied. My doubt arises from the paper [https://openreview.net/pdf?id=BylKL1SKvr]. This work showed that model transferability (from the source domain and the target domain) relates to the smoothness of loss landscape, but this conclusion holds for loss landscape w.r.t. model parameters. I understood why authors draw a connection between the flatness of loss landscape and model generalization in the context of attack generation. However, has this been well studied and believed as a grounded conclusion?

- The use of a min-max formulation for attack generation has been studied in [https://arxiv.org/pdf/1906.03563.pdf]. This related work should be covered and discussed in Related Work. 

- If the min-max formulation (2) is replaced with EoT (expectation over transformation), namely, n^{adv} is randomly generated from e.g., Gaussian distribution, then this will lead to an EoT-type baseline. It will be better to cover this baseline as well to demonstrate the superiority of bi-level formulation.

- Min-max attack generation could be difficult to tune. Thus, the computation time and hyper-parameter setups of the proposed approach should be clearly stated. 

- If the n^{adv} is regarded as model noise to flatten the loss landscape, then how does the attack perform compared to RAP? This is another baseline to verify the usefulness of the flatness of loss landscape w.r.t. `input' rather than 'model parameters'.






summary_of_the_review: I think this is an Okay submission, but several technical and experimental questions remain.
review_title: null

Meta-review: This paper studies the transferability of adversarial attacks in deep neural networks. In particular, it proposes the reverse adversarial perturbation (RAP) method to boost attack transferability by flattening the landscape of the loss function.

The reviewers acknowledge the strengths of the paper, which include effectiveness of the simple RAP method proposed and the extensive experimentation presented.

However, a number of outstanding concerns still remain. Some of them include the technical novelty of the paper, insufficient theoretical justification of the proposed method, lack of grounded justification between flatness of the loss landscape and model generalization under the specific context of attack transferability, similarity of the optimization problem with some existing work, potential difficulties of the min-max attack generation problem, among others.

As it stands, this is a borderline paper that is reasonably good, but not great. Addressing the outstanding concerns will make the paper more ready for publication in ICLR.
Decision: Reject