Venue: ICLR 2017 conference

Reviews:

final_score: rating: null
review_content: Adversarial examples for one network may be adversarial examples for different networks (trained with different initial conditions or even different network architectures). Have you examined how each defense method performs when an adversarial example is calculated on a different model then where it is evaluated on?
review_title: Explored how each defense responds to transferability 

final_score: rating: null
review_content: Hi,

I am curious if you have checked the perturbation magnitude of the attacker using cg or adam. For example, in the result of table 3 and table 4, while fgs fails, does it take cg and adam a huge perturbation to change the prediction label? Are the generated adversarial examples still imperceptible to human?


Best,
review_title: About the experiments of cg and adam

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper compares several defense mechanisms against adversarial attacks: retraining, two kinds of autoencoders and distillation with the conclusion that the retraining methodology proposed by Li et al. works best of those approaches.

The paper documents a series of experiments on making models robust against adversarial examples. The methods proposed here are not all too original, RAD was proposed by Li et al, distillation was proposed in Goodfellow et al's "Explaining and harnessing adversarial examples", stacked autoencoders were proposed by Szegedy et al's "Intriguing Properties of Neural Networks". The most original part of the paper is the improved version of autoencoders proposed in this paper.

The paper establishes experimental evidence that the RAD framework provides the best defense mechanism against adversarial attacks which makes the introduction of the improved autoencoder mechanism less appealing.

Although the paper establishes interesting measurement points and therefore it has the potential for being cited as a reference, its relative lack of originality decreases its significance.
review_title: Interesting comparisons, not very original.

final_score: rating: null
review_content: What is n in 1/n \sqrt(\sum ...) at the end of the introduction of Section 3? 
Why is n outside the square root rather then inside?
review_title: The definition of distortion

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper performs a series of experiments to systematically evaluate the robustness of several defense methods, including RAD, AEC and its improved version etc.. It provides interesting observations. Overall, RAD and distillation have the best performances, but none of the methods can really resist the 'additional' attack from cg or adam. Since it is an experimental paper, my main concern is about its clarity. See the comments below for details.

Pros:
1. This paper provides a good comparison of the performances for the selected methods.
2. Section 3.3 (the 'additional' attack) is a interesting investigation. Although the final result about the defense methods is negative, its results are still inspiring. 
3. Overall, this paper provides interesting and inspiring experimental results about the selected methods.

Cons:
1. There are several other methods in the literature that are missing from the paper. For example the defense methods and the attack methods in the papers [1,2]. 
2. Although a long list of experimental results are provided in the paper, many details are skipped. For example, details of the experiments that generate the results in Table 5. 
3. Without further explanations and analyses about the experimental results, the contribution of the paper seems limited. 
4. This paper proposed an improved version of the AEC algorithm. But its experimental results seems not promising. 

Minor comments:
Page 3: Equation (3) is also non-convex. So the non-convexity of Equation (2) should not be the motivation of Equation (3).

[1] https://arxiv.org/abs/1507.00677
[2] https://arxiv.org/abs/1511.03034
review_title: Systematic experimental setting, but lack of clarity and originality

final_score: rating: 4: Ok but not good enough - rejection
review_content: I reviewed the manuscript as of December 6th.

The authors perform a systematic investigation of various retraining methods for making a classification network robust to adversarial examples. The authors achieve lower error rates using their RAD and IAEC methods perform better then previously introduced distillation methods for retraining networks to be robust to adversarial examples. This method suggests a promising direction for building a defense for adversarial examples.

Major Comments:
I find the paper to not be lacking in exposition and clarity. The paper has a laundry list of related results (page 2) but no clear message. I *think* one larger point is the superior performance of their retraining techniques but it is not clear how well these techniques perform compared to other retraining techniques, nor are the details of the retraining techniques clear. The paper requires more discussion and a clear exposition about the methods the authors introduced (i.e. RAD, IAEC). What follow are some more detailed comments along this theme of improving the exposition and clarity:

- The authors should provide more details about how they constructed the auto-encoder in the IAEC method (diagram?). The same needs to be said for the RAD method. The authors point to a previous workshop submission (https://arxiv.org/abs/1604.02606) but the authors need more discussion about what this method entails and how it compares to other retraining methods (e.g. [1,2]) since this is the first peer-review of this work.

- Section 3.2 indicates that the authors are concerned with 'cross-model' efficiency but it is not clear from the text what this means. Are the author exploring the phenomenon of retraining off one algorithm and then evaluating adversarial images derived on another? Or, are the authors examining how examples derived from one instance of a trained model may fool or trick a second instance of a model? The latter point is quite important because this points towards examples and retraining procedures that can generalize across the class of all models.

- How do RAD compare with basic retraining methods described in [1, 2]? Since the main contribution of this paper seems to be evaluating the efficacy of RAD, AEC and IAEC, I would suggest that the authors provide more discussion and exposition.

- Why are the authors measuring 'recall' (https://en.wikipedia.org/wiki/Precision_and_recall) in Section 3.1? What does recall mean in this context? I would expect the authors to measure something more like the error rate of the classifier after employing the retraining procedure. This needs to be clarified in the manuscript.

[1] https://arxiv.org/abs/1412.6572
[2] https://arxiv.org/abs/1611.01236
review_title: Official review of submission

Meta-review: The paper investigates several retraining approached based upon adversarial data. While the experimental evaluation looks reasonable, the actual contribution of this paper is quite small. The approaches being evaluated, for the most part, are already proposed in the literature, with the one exception being the "improved autoencoder stacked with classifier" (IAEC), which is really just a minor modification to the existing AEC approach with an additional regularization term. The results are fairly thorough, and seem to suggest that the IAEC method performs best in some cases, but this is definitely not a novel enough contribution to warrant publication at ICLR.
 
 Pros:
 + Nice empirical evaluation of several adversarial retraining methods
 
 Cons:
 - Extremely minor algorithmic advances
 - Not clear what is the significant contribution of the paper
Decision: Reject