Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: 1. Summary
- This paper presents the imperceptible warping based back-door attack technique.
- With the poisoned image generated from the technique, the network will be fooled.

2. Strong points
- The technique produces the imperceptible poisoned image.
- Looks superior to other techniques.

3. Weak points
- I am not sure that the experiments are enough to show the technique's superiority.
- Why did you perform experiments only on small datasets such as CIFAR-10, MNIST, and GTSRB?


I am not confident in the review because I am not familiar with the attack algorithms.
I can conclude my decision with other reviewer's reviews.


review_title: Review for WaNet

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper proposes a new backdoor attack method on vision classifiers, where a warping-based trigger is adopted instead of patched triggers. To bypass backdoor detectors, the authors also propose a “noise” mode of training poisoned classifiers. 
1. For the image warping, from Figure 3, I can not see any difference between most of the warped images and the original one. Also, the authors claim that WaNet is an imperceptible backdoor attack. However, Table 2 reported that the fooling rate of human on backdoor inputs and clean inputs are 38.6% and 17.4% respectively, this suggests that there may still be some differences between backdoor inputs and clean inputs that can be identified by human. Can the authors show some such examples? 
2. I understand that the backdoor in this paper is the unique warping function. I think the authors should explicitly mention this as part of the threat model of WaNet.
3. The authors mentioned in section 3.2 that “To get such a warping field, we extend the idea of TPS with some modifications”. What is the extension and what is the difference from the original TPS? I think the authors should explicitly define their contributions while describing the technical details.
4. Did the authors try the defense “Spectral signatures in backdoor attacks” (Tran et al. 2018)? I think this is a valid defense method worth evaluating for WaNet.
5. I suggest the authors briefly describe how the image warping process is conducted. Currently it is not discussed in the paper, which may not be good for interested readers.

Overall i am satisfied with the paper presentation. The idea is interesting and the paper is self-contained. I would like the authors to address the issues I raise.
review_title: Interesting idea.

final_score: rating: 7: Good paper, accept
review_content: This paper proposes a backdoor attack method using warp-based triggers, which distorts the global structure of the image (input) making the attack undetectable/un-noticeable by humans.
This global-distortion aspect of the attack makes effective against (besides humans) popular backdoor defense mechanisms such as neural cleanse and fine pruning.

Overall, I enjoyed reading this paper and the ideas proposed therein. However, I have some remarks about its clarity and some of the experiments that I hope the authors address.

-----

*Quality* (8/10):
The paper provides substantial experimental evidence that the attack method is effective in terms of:
1. Demonstrating the attack on a variety of datasets (MNIST, CIFAR10, GTSRB)
2. Ablation studies of the proposition components.

I'd have increased my Quality score if:
- The experiment of Ablation Studies (Role of Noise Mode) was presented with more supporting evidence rather than a single-class from a single dataset optimized trigger patterns (Figure 7a.)
- More datasets and/or various classifier architectures (Table 1)

-----

*Clarity* (6/10):
- There is room for improving the paper's write-up and presentation (e.g., some figures are missing their x-axis/y-axis labels as in Fig 6b). 

-----
*Originality* (9/10):
I believe that this work is original. The bulk of backdoor attacks have been patch-based and this is one of few works that explore other backdoor alternatives.

-----
*Significance* (8/10):
This is a significant work and opens the door to new questions in the field of backdoor attacks.

-----
Pros:
- A new framework of imperceptible backdoor attacks that break away from the notion of patches  & water-marks.
-Thorough experiments that validate the effectiveness of the method.

Cons:
- Not enough supporting evidence to the role of Noise Mode in training.
- Some missing experiments (highlighted below) to further support the proposition.

----

**Remarks/Questions to the authors**:
- Fig 1: I suggest adding difference images for each of the methods, to highlight the differences each attack is incorporating into the image.
- Sec 2.4: The justification for the unsuitability of affine & projective transformations for attack purposes is not clear. Do you mean they are not going to be effective?
- Fig 2: Would be great to pinpoint some pixels of M and highlight what their values are in the [-1,1] interval besides the colormap.
- Sec 3.2: It appears that there are no constraints on the backward warping? A target pixel ,say at[-1,-1], can have a source pixel at [1,1]? It is not clear how the control grid (Eq. 3) ensures the locality of the warp. Please elaborate.
- Sec 3.2: Does M get generated once? or it's per image? I assume it is generated once.
- Sec 3.2: If there is a single M, how robust is the training to different realizations of M? The experiments do not discuss that.
- Table 2: Why "Clean Inputs" fooling rate differs across different attacks? Should not they be the same?
- Figure 6a: Please specify how clean mode is obtained (is it based on the first row of Eq. 6) while "backdoor" represents all of Eq. 6?
- Figure 6d: Please describe GradCam setup. Is it visualizing the activations based on the backdoor label $\hat{c}$?
- Figure 7b: I was expecting all the curves to start with a low-accuracy as the images from all the modes tend to be very similar for (k<6 and s<0.75; as shown in Figure 3) and so should not they suffer equally?

**Post-Rebuttal**
The authors have addressed my comments and revised the manuscript accordingly. Recommending an accept.

review_title: A New Framework of Imperceptible Backdoor Attacks

Meta-review: The paper presents a new method for generation of backdoor attacks against deep networks. The new method uses global warping instead of noise patches which makes the attack much more stealthy than previous approaches. The attack effectiveness is demonstrated on 3 benchmark datasets. A small user study is carried out to demonstrate that the attack is stealthier than conventional backdoor attacks. 

The new attack is a novel and original contribution which is likely to advance the understanding of backdoor attacks. There were some issues with respect to clarity in the original manuscript but the authors adequately addressed the critical remarks raised by the reviewers. 
Decision: Accept (Poster)