Venue: ICLR 2023 TinyPapers

Reviews:

final_score: rating: Great Start (GS): a submission which meets some of the reviewing criteria but has room for improvement
review_content: summary_of_contributions: This work introduces a new way of investigating vision transformers's resistance to adversarial attacks. The work utlizes three transformers encoders for its adversarial training and claim to outperforms all current state-of-the-art resuts.
strengths_and_weaknesses: Strengths
- The authors showcase an excellent technical depth by utilizing a 3-encoder architecture to ensure the model has information on not just the targeted image but also about other images and the classes and relationships between them. 
- The authors also leverage nicely proven, standard techniques while acknowledging those works. The submission page limit could have caused an oversight, but that wasn't the case.

Weaknesses
- Works on which the methodology was based were cited generously. Still, I find it a bit worrying that the authors mention that there has been very little interest in Transformer-based GANs, but a quick search on Semantic Scholar proved otherwise. The work could use a more extensive literature review to clarify that efforts are not being duplicated needlessly.
- While the authors included much information about their methodology, reproducing the work might not be straightforward due to several missing details. For example, the authors mentioned using a more restrictive norm than usual, but there was no explanation of how and why a more restrictive norm was selected. 
suggested_changes: While the Attack Success Rate (ASR) scores of this work seem impressive compared to ATA's and PNA's scores, the communicated results allow for skepticism on whether the hyper-parameters were hand-selected to make this work superior or not. The authors claim that ATA and PNA have lower scores due to a more restrictive norm used. An extensive ablation study can put to rest doubts about the rigor of the work.
review_title: null

final_score: rating: Great Start (GS): a submission which meets some of the reviewing criteria but has room for improvement
review_content: summary_of_contributions: This paper uses transformer-based GANs to generate adversarial perturbations to attack vision transformers. Results show that the proposed attack is more effective than existing black-box attacks.
strengths_and_weaknesses: Strengths:
- The paper presents an attack that is shown to be more effective on attacking vision transformers in a black-box setting.

Weaknesses:
- It is unclear how existing GAN-based attacks (even if they are not transformer-based) perform on the settings studied in this paper. 
- It is unclear where the improvement comes from, without sufficient ablation studies.


suggested_changes: Add more experiements, as suggested in "Strengths And Weaknesses".
review_title: null

Decision: Invite to archive