Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: In this paper, the authors focus on keystroke inference attacks in which an attacker leverages machine learning approaches,  In particular, a new framework is proposed for low-resource video domain adaptation using supervised disentangled learning, and another method to assess the threat of keystroke inference attacks by an attacker using a deep learning system, given limited real-life data. The novelty of the approach and its theoretical foundation is appreciated. For a given domain, they decompose the data into real-life style, synthetic style, real-life content, and synthetic content, and then combine them into feature representations from all combinations of style-content pairings across domains to train a model, This allows classify the content of a sample in the style of another domain. Results indicate that training with these pairs to disentangle style and content prevents their model from overfitting to a small real-world training sets, and thereby provides an effective form of data augmentation that prevents overfitting.

The paper is clearly written and well organized, and all the key concepts and motivations are described in enough detail to understand the paper.  However, it is not clear from the outset the amount of limited real-world data should be collected from the target domain. It should also be clarified at the beginning why their data augmentation that prevents models overfitting, and why translated to better security against keystroke inference attacks.

The experimental validation should include an analysis of the impact on the performance of the amount of real-world target domain data, the class imbalance, and capture conditions. The supplementary material provides additional information on the training setup that should be useful to the reader. It however seems like their code is not made available, so there is a concern that the results in this paper would be very difficult for a reader to reproduce.
review_title: Disentangling style and content for low resource video domain adaptation: a case study on keystroke inference attacks

final_score: rating: 5: Marginally below acceptance threshold
review_content: The authors investigate video domain adaption for keystroke inference attacks on synthetic and real-life data. They propose a disentangle model to separate the representation of content and style. In their problem, style encapsulates the trajectory of the finger in between keys or speed of the user typing, while content represents the typed sentence. The model is naive by simply applying the adversarial domain adaptation into the keystroke inference attacks. Also, I suspect the paper is more suitable for the security conference, e.g., S&P. In addition, there still exists the following concerns.

+ lack comparison to the state-of-the-art methods, such as:
   John Lim et al, 'Revisiting the Threat Space for Vision-based Keystroke Inference Attacks', in arXiv preprint arXiv:2009.05796, 2020.

+ lacks comparison to the state-of-the-art domain adaptation methods, such as:
    Ehsan Hosseini-Asl et al, 'AUGMENTED CYCLIC ADVERSARIAL LEARNING FOR LOW RESOURCE DOMAIN ADAPTATION', in ICLR 2019.

+ In addition to CycleGAN, video to video translation methods should be included: 
  Ting-Chun Wang et al, 'Video-to-Video Synthesis', in NeurIPS 2018.

+ I notice that the generated results quality of CycleGAN (in Figure 6) is poor. The background is black and only a thumb is generated. Please explain the reason.

+ The paper claims that the proposed method can separate the style () and content. The visualization or demonstration is needed to support their claims.
review_title: Lacks of novelty and some experiment results

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper is about keystroke inference attacks and proposes a method to assess the threat of deep learning based approaches
when only limited real-life data are available. To this end, it is introduced a video domain adaptation technique
that is able to generate data into separate style and content representations. This data augmentation scheme is shown to be effective and prevents overfitting.

This is an interesting applicative approach, but I believe that the introduced novelty is probably limited for ICLR. Two claimed contributions are the assessment of deep learning methods for keystroke inference attacks when limited data are available and the domain adaptation approach to generate synthetic data. Now these contributions have been also introduced recently in Lim et al. (2020). One difference is that the threat scenario is based on single keypresses,  while in this submission complete sequences are tackled. In addition, in Lim et al. it is used the adversarial discriminative domain adaptation (ADDA) technique introduced by Tzeng et al. 2017, while in this submission a supervised disentangled learning based approach is proposed.
Given these similarities I would have expected more discussion in the related work about this paper and also some comparison between single keypresses results vs complete sequences. Furthermore, from Table 1 it appears that ADDA provides much worse results with respect to the proposed method. Then a discussion is needed since it has been used in Lim et al. achieving good performance in a similar context.

For what concern the supervised disentangled learning based approach, I think that the authors should make very clear which is the introduced novelty with respect to current state-of-the-art methods. In particular, which are the new components of the proposed method. In this respect it would be helpful to make comparisons with some baselines. This would help to assess the relevance of the proposal.

As a final minor comment I think it would be important to provide more information about the real life dataset used in the experiments, for example by indicating how many participants where involved.

=============== Post rebuttal comments ===============

First of all, I want to thank the authors for answering my questions.
The clarifications confirm my previous concern about the limited technical novelty.
In addition, they highlight that only three participants were involved to build the real life dataset used in the experiments.
In my opinion this is not sufficient to carry out a significant evaluation.
For these reasons I keep my original rating.
review_title: Disentangling style and content for low resource video domain adaptation: a case study on keystroke inference attacks

final_score: rating: 7: Good paper, accept
review_content: In this paper, the authors introduce a video domain adaptation technique that learns to disentangle style and content of a video in order to generate as form of data augmentation. The main idea is to train a style and content encoder and enforce 
1)	The output of the style encoder cannot be used to determine keystrokes 
2)	The output distribution of the content encoder for real and synthetic data cannot be distinguished. 
They motivate their problem by recognizing that deep learning-based keystroke inference attacks are trained with a small number of real data along with a larger number of synthetic data. This results in the need for data augmentation via domain adaptation.

Pros:
The proposed method of disentanglement and combination in the feature space for classification is novel and interesting. Figures are well done and informative. Multiple evaluation metrics were used, and it is clear that the framework is useful under the considered setting. 


Cons/Comments:
The output of style encoder gives you a representation that maximizes the prediction loss in order to lose content information. The output of content encoder on the other hand, gives a domain invariant representations that presumably holds all the information needed for classification. The authors propose combining them with a decoder in various combination in order to do data augmentation. However, it is not clear to me how would style representation be useful in this data augmentation. In the case where style representation is totally ignored and decoder only looks at the content representation, it minimizes the prediction loss (Eq 5) and also the semantic alignment loss (Eq 8). While Table 2 shows it clearly improves the results, I am unsure of the exact reasoning on how the losses help the style encoder in encoding anything useful for the final classification. 

In general, I find this paper well-written and well-motivated. The method is novel and produces good results over other baselines. I recommend this paper for acceptance.
review_title: Novel with good results

Meta-review: The paper focuses proposes a new framework for low-resource video domain adaptation leveraging synthetic data with supervised disentangled learning for tackling keystroke inference attacks.

The paper received contrasting reviews, 2 positive and 2 negative, and the overall confidence of the reviewers is not so high.
Overall, it is recognized that the work has some merit, but also some problems, which the rebuttal has not fully fixed, and I mainly refer to R2, R3 and R4 remarks. 

The first issue is the level of novelty, which is not much high as compared to the former work of (Moiitan et al. 2017). Besides, the questions raised by some reviewers, also discussed in the rebuttal, also denote a certain lack of clarity, despite the paper is considered well organised in general. 

The other main issue regards the experimental evaluation. To start with, the application addressed is very specific and it is not clear how this approach can be extended to other problems too, since no evidence is provided in this sense. The reported comparative analysis wrt baselines are in fact quite "simple" (e.g., ADDA is a work dated back to 2017, so as CycleGAN). Moreover, although the considered dataset is the only one in this scenario, its significance is a bit limited since only 3 subjects were considered, and this likely raised the comment of one reviewer questioning if this paper was not better suited to an application-oriented, security conference. A discussion for the setting of the lambda parameters is also missing.

Overall, given the above issues, I consider the paper not yet ready for publication in ICLR 2021.

Decision: Reject