Venue: ICLR 2018 conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: 
-----UPDATE------

Having read the responses from the authors, and the other reviews, I am happy with my rating and maintain that this paper should be accepted.

----------------------



In this paper, the authors trains a large number of MNIST classifier networks with differing attributes (batch-size, activation function, no. layers etc.) and then utilises the inputs and outputs of these networks to predict said attributes successfully. They then show that they are able to use the methods developed to predict the family of Imagenet-trained networks and use this information to improve adversarial attack.

I enjoyed reading this paper. It is a very interesting set up, and a novel idea.

A few comments:

The paper is easy to read, and largely written well. The article is missing from the nouns quite often though so this is something that should be amended. There are a few spelling slip ups ("to a certain extend" --> "to a certain extent", "as will see" --> "as we will see")

It appears that the output for kennen-o is a discrete probability vector for each attribute, where each entry corresponds to a possibility (for example, for "batch-size" it is a length 3 vector where the first entry corresponds to 64, the second 128, and the third 256). What happens if you instead treat it as a regression task, would it then be able to hint at intermediates (a batch size of 96) or extremes (say, 512).

A flaw of this paper is that kennen-i and io appear to require gradients from the network being probed (you do mention this in passing), which realistically you would never have access to. (Please do correct me if I have misunderstood this)

It would be helpful if Section 4 had a paragraph as to your thoughts regarding why certain attributes are easier/harder to predict. Also, the caption for Table 2 could contain more information regarding the network outputs.

You have jumped from predicting 12 attributes on MNIST to 1 attribute on Imagenet. It could be beneficial to do an intermediate experiment (a handful of attributes on a middling task).

I think this paper should be accepted as it is interesting and novel.

Pros
------
- Interesting idea
- Reads well
- Fairly good experimental results

Cons
------
- kennen-i seems like it couldn't be realistically deployed
- lack of an intermediate difficulty task

review_title: Review

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper attempts to study model meta parameter inference e.g. model architecture, optimization, etc using a supervised learning approach. They take three approaches one whereby the target models are evaluated on a fixed set of inputs, one where the access to the gradients is assumed and using that an input is crafted that can be used to infer the target quantities and one where both approaches are combined. The authors also show that these inferred quantities can be used to generate more effective attacks against the targets.

The paper is generally well written and most details for reproducibility are seem enough. I also find the question interesting and the fact that it works on this relatively broad set of meta parameters and under a rigorous train/test split intriguing. It is of course not entirely surprising that the system can be trained but that there is some form of generalization happening. 

Aside that I think most system in practical use will be much more different than any a priori enumeration/brute force search for model parameters. I suspect in most cases practical systems will be adapted with many subsequent levels of preprocessing, ensembling, non-standard data and a number of optimization and architectural tricks that are developer dependent. It is really hard to say what a supervised learning meta-model approach such as the one presented in this work have to say about that case. 

I have found it hard to understand what table 3 in section 4.2 actually means. It seems to say for instance that a model is trained on 2 and 3 layers then queried with 4 and the accuracy only slightly drops. Accuracy of what ? Is it the other attributes ? Is it somehow that attribute ? if so how can that possibly ? 

My main main concern is extrapolation out of the training set which is particularly important here. I don't find enough evidence in 4.2 for that point. One experiment that i would find compelling is to train for instance a meta model on S,V,B,R but not D on imagenet, predict all the attributes except architecture and see how that changes when D is added. If these are better than random and the perturbations are more successful it would be a much more compelling story. 
review_title: interesting approach to adversarial examples but I find generalization thus applicability is hard to assess

final_score: rating: 7: Good paper, accept
review_content: The basic idea is to train a neural network to predict various hyperparameters of a classifier from input-output pairs for that classifier (kennen-o approach). It is surprising that some of these hyperparameters can even be predicted with more than chance accuracy. As a simple example, it's possible that there are values of batch size for which the classifiers may become indistinguishable, yet Table 2 shows that batch size can be predicted with much higher accuracy than chance. It would be good to provide insights into under what conditions and why hyperparameters can be predicted accurately. That would make the results much more interesting, and may even turn out to be useful for other problems, such as hyperparameter optimization.

The selection of the queries for kennen-o is not explained. What is the procedure for selecting the queries? How sensitive is the performance of kennen-o to the choice of the queries? One would expect that there is significant sensitivity, in which case it may even make sense to consider learning to select a sequence of queries to maximize accuracy.

In table 3, it would be useful to show the results for kennen-o as well, because Split-E seems to be the more realistic problem setting and kennen-o seems to be a more realistic attack than kennen-i or kennen-io.

In the ImageNet classifier family prediction, how different are the various families from each other? Without going through all the references, it is difficult to get a sense of the difficulty of the prediction task for a non-computer-vision reader.

Overall the results seem interesting, but without more insights it's difficult to judge how generally useful they are.
review_title: interesting results, but more insights would be helpful

Meta-review: Novel way of analyzing neural networks to predict NN attributes such as architecture, training method, batch size etc. And the method works surprisingly good on the MNIST and ImageNet.
Decision: Accept (Poster)