Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 4: Ok but not good enough - rejection
review_content: Pros:
- Targets an important problem, adversarial attacks semantically constrained as opposed to being constrained by an artificial norm ball. 
- Extensive results with a wide variety of models, datasets, and more importantly, applications, with not only attack evaluation on standard models, but application to adversarial training, a user study, and evaluating against certified defenses. 

Cons:
- The disentangled representations of StyleGAN were used for generating realistic perturbations, and the application of training with said perturbations (adversarial training) was considered [1]. This paper isn't cited, let alone compared to given the significant similarity in the methodology. [2] considered constraining adversarials to be within the output space of a learned generative model, this work was also not cited. 
- The emphasis given to the result that adversarial training improves clean performance isn't fully justified, as unrealistic images, e.g. images not too perturbed, were controlled for by limiting the number of iterations. If one limits the number of iterations for a norm-based attack, or considers a smaller epsilon ball, the same control would be met, but a comparison to norm-based adversarials with the same control is not conducted. Note that adversarial training was originally viewed and used as a regularization method [3,4], improving i,i,d, performance, and the robustness-accuracy tradeoff can straightforwardly be mitigated by considering a weaker form of robustness by using a weaker attack (FGSM [3]), or controlling the strength of the perturbation, where the latter is exactly the filtering performed here. It is intuitive that semantic adversarials would provide benefit for the robustness-accuracy tradeoff, but this experiment certainly does not demonstrate that due to the obvious confounders. 
- The emphasis on the "breaking" of a certified defense can also be seen as overclaiming, as breaking a certified defense implies succeeding against the defense within their considered threat model. This is not done here, thus it doesn't violate any of the claims made by randomized smoothing, thus it does not break the certified defense. Though the impracticality of norm-based adversarial defenses are well-understood, this experiment simply shows that if one goes outside of a certified defense's threat model, the certified defense can perform worse, which is entirely expected. 

Conclusion: On one hand, the research direction is valuable and the experimental results are extensive. On the other hand, comparison to the literature is sorely lacking, there exists techniques which share much of the same functionality of the method [1], a comparison to norm-based adversarials in the adversarial training experiment should have been done to clarify concerns that controlling for unrealistic adversarials is the source of the result, not the contribution of semantic adversarials, and the certified defense is not "broken", as the attack went outside of the defense's threat model. 

In summary, this work does not compare to any baselines when baseline experimentation is clearly needed to justify the novelty and contribution of the work, and fair treatment of prior literature is missing, with not only citations missing for quite similar approaches, but claims are made which on the surface invalidate previous work (breaking randomized smoothing) when said previous work was not fairly evaluated (as the attack went outside of the defense's clearly specified threat model, thus not invalidating any of their claims). 

I implore the authors to consider their contribution in the context of the literature more carefully. 

References:  
 [1]: https://openaccess.thecvf.com/content_CVPR_2020/html/Gowal_Achieving_Robustness_in_the_Wild_via_Adversarial_Mixing_With_Disentangled_CVPR_2020_paper.html.  
 [2]: https://openaccess.thecvf.com/content_CVPR_2019/html/Stutz_Disentangling_Adversarial_Robustness_and_Generalization_CVPR_2019_paper.html. 
 [3]: https://arxiv.org/abs/1412.6572.  
 [4]: https://arxiv.org/abs/1704.03976
review_title: Review

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper proposes a mechanism to generate adversarial examples by applying latent variables level manipulation, based on the styleGAN framework. Unlike previous works mostly focused on image level perturbations and geometry transformations, this work tends to control higher level latent sampling such as style, so as to generate a style-adversarial examples. Although a similar idea has been proposed by Song et al. (2018), this work is along the same direction and achieves better performance. The loss is proposed for general classification tasks such as object classification, object detection and semantic segmentation. The experimental results show not only qualitatively confusing human vision but also quantitatively improve the performance on testing clean images.

+ The paper is well written and easy to read.
+ Experimental results demonstrate the proposed idea qualitatively and quantitatively.
+ Sufficient ablation analysis to make the proposed method convincing.

However, I still have some concerns:

- There’s no experiment to compare with existing methods such as Xie et al. ‘20 and PGD. A standard experimental protocol ex ImageNet should be conducted and fairly compared.
- Deeper analysis of the impact by y_adv and eta_adv in both object detection and semantic segmentation. Although final results in table 1 shows that style-based adversarial training benefits the performance, ablation studies of y_adv and eta_adv in both tasks should be conducted.
- Since the attack is in the feature space, the defense should also happen in the feature space [a]; 

Overall, I think the paper is valuable. The proposed idea is novel, and sufficient experiments are provided to demonstrate the idea. Rich visualization to help readers understand the concept. I’m willing to raise my rate if my concerns are addressed.

[a] M. Lecuyer et al., Certified Robustness to Adversarial Examples with Differential Privacy: https://arxiv.org/abs/1802.03471
review_title: Style-based adversarial attack is on the way

final_score: rating: 6: Marginally above acceptance threshold
review_content: The paper presents a new method for generating unrestricted adversarial examples.  Based on Style-GAN, this work separates stylistic and noise modifications so as to control higher-level aspects and lower-level aspects of image generation.

By handling style and noise variables separately and changing the different levels of synthesis networks, the model can input various types of perturbations in generating adversarial images.  As the authors claim, the style variables from different layers affect different aspects of images.  Generation of adversarial images are tested in both un-targeted and targeted attacks.  Overall,
the paper is well-motivated, well-written, and the method is evaluated with three tasks, classification, semantic segmentation, and object detection.

On the other hand, although the different layers of the networks are concerned with different aspects of the images and the proposed method can generate a variety of images, we may not be able to intentionally control specific aspects of the images.  This is an incremental work on top of Style-GAN so that the novelty of the paper is not very high.

Please make clear how the parameter values are determined.  For example, how did you select the step sizes?
review_title: This work proposes a new perturbation method for generating unrestricted adversarial examples through introduction of stylistic and stochastic modifications.

final_score: rating: 7: Good paper, accept
review_content: ###Summary###


The paper proposes a method of generating adversarial samples to enhance classification performance.
Specifically, it finds variables of pre-trained generative model to produce images that the pre-trained classifier gives wrong answers.
The new classifier is then trained by adding these samples to the existing training dataset.
This method achieved good performance because the distributions of the samples generated in this way is closer to the distribution of the real images than the ones generated with norm-bounded perturbations.


###Pros###


-
The effectiveness of the proposed method is reasonably explained by comparing with the preceding works.


-
Authors thoroughly analyzed the qualitative results.
It helps in understanding the underlying mechanisms.



###Questions###


-
Is there a difference in performance between using non-targeted adversarial samples and targeted adversarial samples?
If so, how different is it?
Which of the two to use depends on the outcome?

-
What is the criteria that you divide layers as high-, mid- and low-level ones?
Have you checked layer-wise effect?

-
How one image varies in different settings?
For example, generation results in figure 3 using only one original image.
review_title:   

Meta-review: The paper received two borderline accept recommendations and one accept recommendation from three reviewers with low confidence and a reject recommendation from an expert reviewer. 

Although all reviewers found that the paper addresses an important and challenging problem of semantically constraining adversarial attacks as opposed to constraining them artificially by an artificial norm ball. However, during the discussion phase it has been pointed out that there were some important weaknesses indicating that the paper may need one more evaluation round.  The meta reviewer recommends rejection based on the following observations. 

In terms of evaluation, while it is understandable the authors were unable to compare to Gowal et al. due to the lack of publicly available implementation, showing Song et al.'s adversarials hurt performance and and are farther than the image manifold has been found puzzling, as this was done by Song et al. only to keep human prediction the same while changing model prediction. Furthermore, the paper did not contain a user study similar to Song et al. for a fair comparison Finally, the discussion revealed that the comparison to "norm-bounded adversarial inputs" may not have clarified whether this experiment faithfully demonstrates an advantage for the contribution as the norm could be contained to a point where accuracy is not reduced, and the discussion on the certified defense being "broken" was inconclusive.
Decision: Reject