Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: The paper suggests to use temperature scaling in adversarial attack design for improving transferability under black-box attack setting. Based on this, the paper proposes several new attacks: D-FGSM, D-MIFGSM, and their ensemble versions. Experimental results found that the proposed methods improves transferability from VGG networks, compared to the non-distillated counterparts. 

In overall, I liked its novel motivation and simplicity of the method, but it seems to me the manuscript should be improved to meet the ICLR standard. Firstly, the presentation of the method is not that clear to me. The mathematical notations are quite confusing for me as most of them are used without any definitions. I am still not convinced that the arguments in Section 3.1 and 3.2 are indeed relevant to the actual practice of black-box adversarial attacks, which usually includes extremely non-smooth boundaries with multiple gradient steps. Even though the experiments show effectiveness partially on VGGNets, but the overall improvements are not sufficient for me to claim the general effectiveness of the method unless the paper could provide additional results on broader range of architectures and  threat models. 

- I feel Section 2.3 is too subjective with vague statements. The following statement was particularly unclear to me: "The first problem with gradient based methods is that they lose their effectiveness after a certain number of iterations.": Does the term "effectiveness" indicate some relative effectiveness compared to other methods, e.g. optimization-based attacks? Is this really a general phenomenon in gradient-based attacks? Also, please elaborate more on "So, insufficient information acquisition for different categories and premature stop of gradient update are the reasons ..."

- Regarding that the softmax is the problem, one could try to directly minimize the logit layers skipping the softmax, i.e., gradient on logits? This is actually one of common techniques and there are many simple tricks in the context of adversarial attack, so the paper may include comparisons with such of tricks as well. 

- It is important to specify the exact threat model used throughout the experiments, e.g. perturbation constraints and attack details. Demonstrating the effectiveness on a variety of threat models could also strengthen the manuscript.

- Table 1 and 2 may include other baseline (black-box attack) methods for comparison. This would much help to understand the method better. 
review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: This paper proposes distillation attacks to generate transferable targeted adversarial examples. The technique itself is pretty simple: instead of only using the raw logits L(x) to compute the cross entropy loss for optimization, they also use the distilled logits L(x)/T to generate adversarial examples. Their evaluation setup largely follows the style of Liu et al., but they construct a different subset of ILSVRC validation set, and some of the model architectures in their ensemble are different from Liu et al. Their results show that by including the distilled logits when computing the gradient, the generated adversarial examples can transfer better among different models using both single-model and ensemble-based attacks.

I think their proposed attack is interesting due to its simplicity and effectiveness. However, I would like to see clarification of some evaluation details, as well as more experiments to compare with Liu et al.:

1. To assess the effectiveness of targeted attacks, it is important to ensure that the semantic meaning of target label is far from the ground truth label. Some of the 1000 ImageNet labels have very similar meanings to each other, thus different choices of the target label would dramatically affect the difficulty of the attacks. In Liu et al., they manually inspect the image-target pairs to ensure that the target label is very different from the ground truth in its meaning. To enable a fair comparison, it would be helpful to provide results on the same image-target pairs constructed by Liu et al., which could be found in the public repo linked in their paper.

2. For ensemble attacks, is including both the raw and the distilled logits crucial in obtaining a good performance? What is the performance of including distilled logits only? How do different values of \lambda_1 and \lambda_2 in (8) affect the attack performance?

3. Could you visualize some generated adversarial examples, so that we can view the qualitative results?

4. In general this paper lacks empirical analysis on why distillation helps improve the transferability. Some more discussion would be helpful.

-------------
Post-rebuttal comments

Thanks for your response! I think this paper still misses a more in-depth analysis, and thus I keep my original assessment.
-------------
review_title: Official Blind Review #2

final_score: rating: 1: Reject
review_content: This paper proposes an attack method to improve the transferability of targeted adversarial examples. The proposed method uses a temperature T to convert the logit of the network, and calculates the gradient based on the new logit, yielding the distillation-based attack method. It has been integrated into FGSM and MI-FGSM.

Overall, this paper has the poor quality based on the writing, presentation, significance of the algorithm, insufficient experiments. The detailed comments are provided below.

1. The writing of this paper is poor. There are a lot of typos in the paper. The notations are used without definitions. These make the paper hard to read and understand.

2. Based on my understanding of the paper, the motivation of the proposed method is that the softmax function on top of neural networks can make the gradient unable to accurately penetrate classification boundaries. And the distillation-based method is proposed to reduce the magnitude of the logits to make the gradient more stable. However, if the argument were true, we could use the C&W loss to perform the attack, which is defined on the logit layer without affected by the softmax function.

3. There are a lot of recent attack methods proposed to improve the transferability of adversarial example, e.g., "Improving transferability of adversarial examples with input diversity" (Xie et al., 2019); "Evading defenses to transferable adversarial example by translation-invariant attacks" (Dong et al., 2019). The authors are encouraged to compare the proposed methods with previous works.
review_title: Official Blind Review #3

Meta-review: This paper proposes an attack method to improve the transferability of adversarial examples under black-box attack settings.

Despite the simplicity of the proposed idea, reviewers and AC commonly think that the paper is far from being ready to publish in various aspects: (a) the presentation/writing quality, (b) in-depth analysis and (c) experimental results.

Hence, I recommend rejection.
Decision: Reject