Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors propose a novel technique to poison training data by crafting perturbations to either repel or attract training data to the corresponding class' mean feature vector. The authors demonstrate that this poisoning technique is superior to known availability attacks when defended against with adversarial training.
strength_and_weaknesses: ### Pros:
1) The attack is intuitive, and the results appear promising.
2) The paper is clear and well written.
3) Experimentation is fairly thorough, and a large number of related works are compared to.

### Cons/Random things to address:
1) I strongly encourage the authors to re-name their method and rephrase its positioning. The authors claim that their poisoning method is successful because it perturbs "indiscriminative features". However, in my opinion, there is little basis for this claim. It is also an unnecessary claim as the paper's results ostensibly justify the proposed method. In fact, I would argue that the poisoning technique does in fact perturb discriminative features - especially in the INF pull case as the perturbations by construction center the features of the poisoned data around the class mean - a descriminative quantity... Observing the visualizations of your perturbations would seem to confirm this. To their credit, the authors do try to justify this claim (briefly) in section 6, but TSNE visualizations are not convincing evidence of this claim. It's also not clear from what models the plots in Figure 5 were generated. Are they the features according to the reference model or the victim model after poisoning?
2) Table 1 presents very encouraging results for your method. However, from Table 3, it appears that your attack success is reduced by using a smaller adversarial training $\varepsilon$-budget. To present a fair comparison, Table 1 should instead show the *maximum* adversarial training accuracy a practitioner could achieve against each method - a practitioner would not use a higher than necessary adversarial training budget if a smaller one produces better results.
3) If I understand correctly, there is another slightly unfair aspect to the comparisons to previous works. Your method crafts the perturbations using an adversarially trained reference model, and you show the superiority of your method compared to other methods in the face of an adversarial training defense. Did you adapt the other attacks and use an adversarially trained model for those results? If not, Table 1 doesn't present an apples-to-apples comparison. As you state "More specifically, modifying the robust (semantic) features is the key to poisoning the AT models". Maybe this is key for other methods as well.
4) While I understand your point that defenders might not have access to a clean-trained model, or a clean AT model, I think this is a bit of a stretch. What if a defender could use a general purpose clean-trained feature extractor (widely available) to defend against your attack?
5) Potentially the biggest issue I have is Figure 4a. If I'm reading this correctly, if the defender simply trained  in a standard fashion (not AT), the results in Table 1 would jump well into the 80's? Why would the defender choose to adversarially train then? 

Overall, I think the paper is interesting, and I'm willing to raise my score if my concerns are sufficiently addressed.




clarity,_quality,_novelty_and_reproducibility: The writing is clear, the method is novel as far as I know.
summary_of_the_review: I find the work interesting and well motivated, but I have serious questions about the setting for comparisons. I am willing to raise my score if these questions are addressed.
review_title: null

final_score: rating: 10: strong accept, should be highlighted at the conference
review_content: summary_of_the_paper: The paper introduces a new approach, indiscriminative features (INF), to the problem of poisoning a data set so as to make predictive models learned from the data less successful, even if those models are trained using adversarial training.  Typically, adversarial training has been a successful defense against indiscriminative data poisoning.  To overcome this, the paper introduces INF-push and INF-pull.  INF-push permutes the data points so their points' features in a learned model are maximally moved further from the centroid of their class's centroid, within a permutation budget.  In INF-pull, data points are permuted so their points' features are moved closer to the nearest centroid of an incorrect class.

The paper demonstrates these poisons effectively evade a defense of adversarial training, as well as several other reasonable defenses.
strength_and_weaknesses: **Strengths**

- The paper is very clear and easy to read.
- The approach is intuitive and effective.
- The problem is relevant.
- Visualizations are clear and informative.

**Weaknesses**

The weaknesses are few. It's impact will not be world-changing, but it is a professionally written paper.  The description of Theorem 1 is awkward, as it uses notation and terms from another paper that is not introduced in this paper (for example, "risk" and $\mathcal{R}$).  This should be easily remedied.
clarity,_quality,_novelty_and_reproducibility: The paper is very clear and well written.  It seems reducible, though I have not looked at the code.
summary_of_the_review: A very good and interesting paper, which moves the ball forward on indiscriminate poisoning.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper challenges the defense ability of adversarial training against clean-label availability poisoning attacks. It was believed that these attacks can hardly harm adversarially trained models. However, the proposed attack method in the paper substantially degrades the test accuracy of adversarially trained models from 84.88% to 71.57% on CIFAR-10, which is seven times better than existing methods, resulting in a new SOTA.

strength_and_weaknesses: Strengths:
- The setting of $\epsilon_{adv}\ge \epsilon_{poi}$ considered in this paper is indeed more reasonable than the setting of $\epsilon_{poi}\ge 2\epsilon_{adv}$.
- The paper points out an implicit assumption behind the defense ability of adversarial training against clean-label availability poisoning attacks: adversarial training is capable of minimizing the adversarial risk on the poisoned data distribution. When this assumption is broken by the proposed attack, adversarial training would fail.
- Experimental results are strong. As far as I know, no previous attack can degrade the test accuracy of adversarially trained models by more than 2% on CIFAR-10. In contrast, the proposed attack can degrade the test accuracy by more than 10%. This is impressive.


Weaknesses:

- The authors claim that the proposed attack method makes some features become not useful even for adversarial training, and thus the assumption behind the defense ability of adversarial training is broken. This means that when the proposed method induces indiscriminative features in the training data, adversarial training becomes not capable of minimizing the adversarial risk on the poisoned data. Are there any experimental results that validate that adversarial training faces difficulties in minimizing the adversarial risk of such poisoned data?

- It is interesting to see that in Table 3, when the poison budget $\epsilon_{poi}=8/255$, adversarial training with $\epsilon_{adv}=4/255$ performs better than adversarial training with $\epsilon_{adv}=8/255$. Could you provide any insight about this?

- The reference model adopted in this paper is adversarially trained. Figure 4 shows that this performs better than adopting naturally trained models. The effectiveness of the previous attack methods may also be improved by adopting an adversarially trained model as the reference model. Have the previous works tried this? Do you have any results to share?

clarity,_quality,_novelty_and_reproducibility: - The paper is well-organized, and the proposed attack method is clearly introduced.
- The proposed attack method is novel and sound.
- The authors conduct various quantitative evaluations and qualitative visualizations, which provide insights for the proposed method.
summary_of_the_review: This paper establishes a new SOTA in degrading the test accuracy of adversarial training under clean-label availability attacks. Overall, the proposed method is adequately evaluated, and the results are very impressive. Thus, the paper successfully challenges the consensus that clean-label availability attacks can hardly harm adversarial training.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this work the authors attack in models in the following adversarial threat model: 
* Problem considered: CIFAR-10 image classification task
* Attacker threat model: can modify each training image by up to $\epsilon=8/255$ in $\ell_\inf$ norm
* Attacker goal: minimize clean test accuracy on models trained on this dataset 

The authors develop a new algorithm, INF, for this kind of data poisoning task, specifically aimed at the defense of performing adversarial training at train time. The authors find that they can decrease accuracy by 13.31% (from 84.88% under no poisoning to 71.57% under INF).
strength_and_weaknesses: Strengths:
* The method is novel and obtains state-of-the-art levels of poisoning success on CIFAR-10 adversarially trained models. The authors' attack is interesting: given a learning algorithm, it exploits the model class' idiosyncrasies to poison newly trained models.

Weaknesses (mostly in writing and unnecessary claims):
* Claims about the mechanism of INF (and of other attacks). Any claims about the claims need to be properly defined or removed. For example, from the introduction "Different from our attack strategy, existing methods commonly inject perturbations as shortcuts, which ensures that the model wrongly learns the shortcuts rather than the actual image content, leading to low test accuracy (Segura et al., 2022a; Evtimov et al., 2021; Yu et al., 2022)" - there is no definition of what a shortcut or indiscriminate feature here is. The authors should describe concretely in what sense the given attack is different from previous work. These poorly defined claims around shortcuts vs indescriminate features are throughout the paper and should be rectified (or removed) before the work is accepted.
* Poor contextualization: Is adversarial training currently considered the best possible defense in the given $\ell_p$-based threat model? It would be good to provide this kind of context.
clarity,_quality,_novelty_and_reproducibility: This paper is relatively well written other than the weaknesses above.
summary_of_the_review: The paper presents a new method that yields state-of-the-art poisoning on adversarially trained models, which were previously seen as an effective defense against $\ell_p$-based data poisoning methods. The paper has some issues around claims and contextualization of work,.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper received significant discussion from reviewers. They were pleased to see a clean-label attack that appears relatively powerful against adversarial training. There were some initial concerns (e.g., whether the attack is effective when there is no defense), but these seemed to be mostly assuaged by the authors responses and follow-up experiments. One critique was that it felt questionable about knowledge of the values of eps from the defender (though I think this was addressed in rebuttal), see also, the other concerns of Reviewer VPK4. The authors are expected to update the final version of the paper with all the changes suggested by the reviewers, especially DCRE who felt some of the claims needed to be toned down.
justification_for_why_not_higher_score: Concerns of Reviewer VPK4, overclaiming in some places as highlighted by DCRE
justification_for_why_not_lower_score: A strong paper that challenges conventional wisdom regarding adversarial training and robustness
Decision: Accept: notable-top-25%