Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This work introduces and studies "unadversarial" input modifications (patches or object textures) designed to *increase* classifier accuracy, particularly in corrupted images. The work is inspired by research on adversarial examples (in particular "adversarial patches" which trick a classifier into predicting a particular class when the patch is present in the scene, regardless of what other class might be present).

Given access to a known, fixed, pre-trained network, a small patch (or the entire object texture) are optimized by gradient descent to increase prediction accuracy. When applied, the method is shown to be quite effective for increasing classification accuracy (and performance on a simple regression task) under a variety of simulated image corruptions (blur, fog, etc.). In addition, the patch method is shown to significantly aid classification even when printed and affixed to real physical objects.
main_review: *Originality: Are the tasks or methods new? Is the work a novel combination of well-known techniques? (This can be valuable!) Is it clear how this work differs from previous contributions? Is related work adequately cited?*

Reliance on prior works is clearly and properly acknowledged throughout the paper. The method in this paper appears to be heavily inspired by "Adversarial Patches" [BMR+18], however, in addition to the novel "unadversarial" setting, this paper treads new ground in a few areas:
* Introducing an effective way to optimize "unadversarial" object texture (using the method of [AEI+18])
* Showing robustness to a wide variety of artificial image corruptions
* Showing robustness to a variety of patch sizes and viewing angles ([BMR+18] were not particularly robust here)
* Applying the method to a regression setting (drone landing pad localization)
One setting that is absent is a "black box" network where patch training is performed on one or more known networks, but testing is performed w.r.t. a *previously unseen network*.

*Quality: Is the submission technically sound? Are claims well supported (e.g., by theoretical analysis or experimental results)? Are the methods used appropriate? Is this a complete piece of work or work in progress? Are the authors careful and honest about evaluating both the strengths and weaknesses of their work?*

The experiments are well designed and clearly described, and the authors discuss limitations/strengths/weaknesses/relation to prior work throughout the text. The claims are well supported experimentally, with two caveats:

1. *Results are limited to a classification setting:* As acknowledged by the authors, nearly all results are on image classification problems. While classification is a fair and reasonable problem setting, it is not likely to be the primary setting in which the method would find real world application. And there may be non-trivial issues with extending this work to other problems, e.g. object detection. (a) While patches may increase the *saliency* of an object, it may not help (and could even harm) prediction of bounding boxes or instance segmentations. (b) Multiple patches in the same image could conflict with each other or overwhelm other prediction signals. (The results of Fig. 5 are encouraging in that patches are shown to be effective improving classification scores without dominating the visual features of the object during classification, but further experiments are needed.)

2. *Results are limited to a white-box network/dataset setting:* Again this limitation is acknowledged and is not unreasonable (though some cited hypothetical examples, e.g. line 159, would be hard to fit in this setting). The results would be stronger with an examination of the effectiveness of patches learned on Network A when seen by Network B. Also of interest here is whether the dataset is important, e.g. can patches learned with a network trained on KITTI perform well when tested on a network trained for Cityscapes?

*Clarity: Is the submission clearly written? Is it well organized? (If not, please make constructive suggestions for improving its clarity.) Does it adequately inform the reader? (Note that a superbly written paper provides enough information for an expert reader to reproduce its results.)*

The paper is well written and organized (including supplementary), figures are polished and clear, and it seems adequately informative for reproduction.

*Significance: Are the results important? Are others (researchers or practitioners) likely to use the ideas or build on them? Does the submission address a difficult task in a better way than previous work? Does it advance the state of the art in a demonstrable way? Does it provide unique data, unique conclusions about existing data, or a unique theoretical or experimental approach?*

While there is little methodologically novel here, the task and experiments are quite interesting and raise practical questions for further research. For instance, QR tags (and similar) are quite common in robotics settings; could learning "unadversarial" patches be preferable in some settings? If these results hold for black-box network settings, what impact could this have on safety and robustness with autonomous agents? The experiments in this work are a useful start.

*Bottom line*
I find the paper to be very well written, methodologically straightforward, but experimentally good, and potentially impactful both practically and toward further research. That said, the conclusions would be much more informative with two further experimental settings (object detection and transfer from network A to network B or dataset A to dataset B), and it is difficult to comprehensively judge the importance of this work without them.

*Notes*
* Line 159: Designing road signs would likely require the "black box" network setting, so it doesn't seem to be a good example for the "fixed network" setting. Similar in line 309.
* Fig. 4, Fig. 5, Fig. 6, and Fig. 9: Does "Accuracy" refer to "Top-1 Accuracy" in each of these cases? Only Fig. 7 specifically names "Top-1 Accuracy".
* Line 181, "we construct unadversarial patches of varying size": Is there a single learned patch that is scaled to various sizes when pasted on test images?
* Fig 5: "(red bards)" should be "(red bars)"
* Supplementary, Line 732: "we fix the -a- set of patches to [a] predefined pattern"
limitations_and_societal_impact: The primary limitation addressed by the authors is that the method requires differentiability w.r.t. the patch or texture of interest. Implicit in this the need to access to the weights of a fixed, pre-trained network that is later used (unmodified) at test time. This latter implication is not always clearly considered, particularly when hypothesizing about applications of the work, as listed in the previous section. Additional care should be taken here.

As noted above, further limitations include demonstrating few results outside of classification problems. In particular, no results are shown with multiple visible patches or where size or pose of the object are predicted.

Regarding societal impact, all methods applied in this paper were first explored in the context of creating *adversarial* examples, designed to trick a classifier. This paper leverages such methods to *improve* classification when subjects can be modified, e.g. by applying a sticker to an object. The paper mentions the potential for misuse in this type of work and also notes some potential benefits when end users have the ability to increase or decrease classifier performance even without being able to control the classifier itself.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This work proposes and studies two techniques to generate unadversarial images (images which cause a computer vision deep learning model to more reliably give accurate predictions). One technique is for creating unadversarial patches which can be overlaid on testing images to increase the robustness of a pre-trained classifier, the other is for creating unadversarial textures for 3D meshes which when applied to 3D meshes. The work provides strong empirical evidence for unadversarial patches on ImageNet and CIFAR, including results where images are corrupted after applying the patches. Evidence is provided for unadversarial textures on simulated data and a small scale real world experiment.
main_review: Strengths
* The paper is very clearly written, with good figures and relevant additional details provided in the appendix.
* Strong empirical evidence for the effectiveness of unadversarial patches, including for cases where strong corruptions are applied to the images. The work provides thorough analysis with respect to patch size, simple baseline patch techniques. Further, there is evidence that when a patch is applied to a different class from the intended one it overall does not cause the model to classify according to the patch and ignore the image entirely.
* The ability to ensure visual classifier robustness for pretrained classifiers is highly desirable, especially for real world applications like fiducial marker tracking. As a result I find this work very well motivated. The drone landing simulated experiment points to the real world utility of the proposed techniques.

Weaknesses
* The takeaways that can be made from the experiments in AirSim using four ImageNet classes are not entirely clear. This is because the number of 3D models used for each class for these experiments is not specified. The results presented in Figures 6 and 7 are impressive, but it’s currently difficult to understand their significance without knowing the scale of the experiment.
* A similar weakness regarding the scale holds for the real world experiments. While it’s good to see that the patterns of improving accuracy with adversarial patches hold, experiments with only four objects do not represent strong evidence.
* While the ImageNet experiments validate the approach, there’s a lack of sufficient evidence for how applicable the proposed techniques are on real data from real world tasks. An important direct application is fiducial marker detection, and an experiment where a CNN-based fiducial marker detector is made more robust as a result of applying unadversarial patch techniques is well within scope. Such an empirical investigation would significantly strengthen this work.

Minor
Typo in figure 5 where there’s “bards” rather than “bars”

**Update After Discussion Period**

Thank you to the authors for engaging in thoughtful discussions with the reviewers. The issues pertaining to the scale of the simulation and real-world experiments remain. Making physical patches and applying them to objects (for the real world), or applying them as textures (in 3D simulation) directly shows the utility of unadversarial patches. The evidence of experiments in these settings would be more significant if there are more instances per category at test time, given that the problem is object classification and not instance classification. I therefore keep my initial rating: 6 - marginally above acceptance threshold.

limitations_and_societal_impact: The authors have adequately addressed the limitations and potential negative societal impact of their work
review_title: null

final_score: rating: 9: Top 15% of accepted NeurIPS papers, strong accept
review_content: summary: In this work, the authors leverage techniques from the adversarial examples literature to design patches and textures that aid in classifying an object *correctly.* In a fixed-model setting, they construct patches / textures using gradient-based methods and demonstrate effectiveness on clean CIFAR-10 and ImageNet and various robustness benchmarks such as ImageNet-C (common perturbations). The authors also compare their patches / textures to simple baselines such as QR codes, smaller-sized images from the training set, and predefined fixed patterns.
main_review: Originality: Applying gradient-based adversarial perturbations in this setting (aiding the end user who benefits from classification) is unique and interesting. The work is an interesting application of the "adversarial patch" concept, "adversarial reprogramming," and PGD. Related work is adequately cited.

Quality: The experiments are well-designed, and the claims are well-supported by the results. The baselines presented in the appendix are thorough. The authors do a good job acknowledging practical constraints by users (i.e. line 101, recognizing that users have only limited control over physical objects). The methods are sound and well-thought out -- for example, the corruptions are applied correctly (after the patch), and the setting where patch & class conflict is studied. Code is attached to the submission and clearly organized at a glance. 

Clarity: The submission is very clearly written and organized. The introduction and motivations are explained thoroughly and well. There are a few nits:

* line 82: recent work (ex: Ford and Gilmer et al. 2019) describes how adversarial examples do not have to be restricted to "carefully constructed perturbations." Although the authors of this paper implicitly acknowledge different kinds of distribution shifts in section 2, maybe the paper could benefit from changing the statement in line 82 to "Adversarial examples can include small, carefully constructed perturbations..."

* figure 5 typo: s/"red bards"/"red bar"

Finally, it would be very interesting to see how the authors ended up at the patch size they chose. Essentially, how does figure 5 change as a result of the patch size?

Significance: This work motivates a new line of work into constructing "helper" perturbations to aid in classification. The results are compelling, and the open-sourced code hopefully will make it easy for others to build on this work. 
limitations_and_societal_impact: Limitations and societal impact are addressed adequately in section 5.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper considers a scenario where a fixed computer vision system (such as CNN based classification or regression models) is given and one tries to adapt the design of objects in order to increase their chance of being correctly detected by the system. This setting is similar to the design of marker systems for computer vision with the difference that the detection algorithm is considered fixed.

Two approaches are presented to design (i) patches that can be printed and sticked onto objects and (ii) complete textures that cover the surface of 3D objects. Both approaches follow the design of adversarial perturbations with the difference that instead of maximizing the loss of the system, it is now minimized to improve its performance instead of weakening it.

Experiments evaluate how these approaches can improve the overall performance of the given system as well as its robustness against a variety of different corruptions. Experiments are performed on synthetic 2D and 3D data, as well as on real objects, where the designed patches are printed out and attached to physical objects. Overall, they demonstrate consistent and significant improvements over non-modified objects and simple baselines.
main_review: **Originality**

The idea to turn the table and use adversarial attacks to ones advantage is quite original and refreshing. Especially the experiments on real objects with attached stickers of the designed patches demonstrate potential use cases for such an approach. While it does not provide much methodological novelty compared to adversarial attacks, it demonstrates some novel, desirable and surprising effects of such a simple change from adversarial examples to unadversarial examples. In particular, the fact that the model still works on unmodified objects and the observation that it prefers the actual object over a conflicting patch have positive consequences for applications. Finally, it will be interesting to see how such an approach can benefit other applications besides classification and regression.

**Presentation**

The paper is well written and structured. The most important details to understand the idea are clearly presented in the main paper and the supplementary and code provide additional details which should make the results reproducible.

**Strengths**

- The paper contributes an original idea to turn adversarial attacks, which are associated with decreased robustness of CNNs, into something to increase the robustness of CNN based models (in a specific setting).
- It provides some novel and interesting results regarding conflicting signals that arises from such an unadversarial optimization of patches.
- It provides an extensive and convincing evaluation, which includes evaluation of overall performance and robustness against corruptions for varying sizes of unadversarial patches and textures, and includes an evaluation of printed patches attached to physical objects. The evaluation shows consistently positive results.
- The approach is applicable to already deployed systems to boost their performance in the presence of unadversarial markers without any negative effect in the absence of these markers.

**Weaknesses**

- It is not quite clear how realistic the scenario is for applications but this is something hard to judge objectively and I am including it only as a minor point.
- While the proposed approach has the important advantage of being applicable to pretrained, fixed models, it is still important to get a sense of how well this performs in comparison to more specialized marker approaches. The authors seem to somewhat agree with this by including QR codes as a baseline. However I do not think that this baseline accurately reflects the quality of markers for computer vision. In particular, Grinchuk, O. et al. “Learnable Visual Markers.” NeurIPS (2016) outperform QR codes and moreover, it is very close to "jointly optimizing models and unadversarial objects" (l.298) - something which according to the paper  under review should be explored in future works.

**Comments and Suggestions**

- It took me a while to get a concrete understanding of the considered setting. Until l.23 the description is rather abstract and I think it would be quite helpful to provide a concrete example already in the abstract (e.g. that which is actually considered in the paper, sticking a patch onto objects).
- l.151/Sec. 3.1 Why speak of a "threat" model here? My best guess is that this is related to adversarial attacks but in the current work I don't really see a "threat" model since there is no adversary (except maybe for image corruptions but I wouldn't call them adversarial).
- Fig. 1 and its caption provide very little context which makes it hard to understand without already knowing the considered task.
- Fig. 5 immediately left me wondering if this does not contradict results regarding adversarial patches; my concerns were well addressed in footnote 3 but I think this is a rather important point and might as well be included in the main text.
- l.217-218 a quick summary of the results that QR code detection is less robust than the proposed unadversarial examples could be included here.

**Rating**

The paper is well written, contributes an interesting idea and performs a solid evaluation thereof. The main issue that I see is a missing discussion of Grinchuk et al. 2016 and comparison to this work and other, existing marker systems besides QR codes. However, the fact that the proposed approach provides additional advantages over such existing marker systems, in particular the fact that the system gracefully falls back to its usual performance if the "marker" is missing without being affected negatively, lessens this drawback somewhat such that I recommend acceptance. Nevertheless, I would still highly recommend to at least discuss these approaches and potentially compare to them.
limitations_and_societal_impact: The paper discusses limitations regarding the requirement for differentiability and additional aspects that should be explored in future work, such as settings where both markers and models are optimized and the applicability to tasks other than classification and regression. It discusses impacts regarding dual use but also the potential to influence already employed models towards the better.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper exploits the  known-sensitivity of deep models to perturbation in the input data in order to improve (rather than decrease) the performance of a pre-trained model in a classification task. Specifically, the authors propose to alter the input data (i.e. images)  by 1) adding a patch to the image 2) altering the texture of specific objects. The paper shows experimentally that this improves both in-domain performance and robustness to data corruptions.
main_review: Pro:

- The idea is novel and intuitive.
- The paper is well-written, easy to follow and well-motivated.
- The experimental results shows significant boost in terms of both in-domain performance and corrupted data.

Cons.
- The technical contribution is a bit limited (mostly an extension of known techniques from the adversarial robustness literature).

Questions:
- Are the patches/texture specific to the architecture or do they generalize among different architectures and pre-trained models? Some analysis in the generalization capabilities of the unadversarial examples could make the technical contribution stronger. 

- Recently, several methods have exploited the idea of "test-time" optimization to also improve both in-domain performance and out-of-domain performance. For example [1] and [2] .  While they do not act directly on the input image as here ( e.g. [1] optimizes some parameter of the models, and [2] first project the image to a latent space), the idea is somewhat similar e.g. gradient-based optimization at test time to maximize performance of the pre-trained model.  I would have loved seeing a comparison of those methods vs directly  altering the image (un-adversarial examples) since the last one could be more interpretable  but 1 and 2 does not require to directly modify the image.

[1] Tent: Fully Test-time Adaptation by Entropy Minimization ICLR 2021

[2] Semantic Segmentation with Generative Models: Semi-Supervised Learning and Strong Out-of-Domain Generalization  CVPR 2021

limitations_and_societal_impact: Yes
review_title: null

Meta-review: Reviewers agreed that this is a solid contribution to NeurIPS. Reviewers agreed that providing more convincing evidence related to the 3D simulation and physics experiments would have significantly strengthened the paper. 
Decision: Accept (Poster)