CL Attack: Unperceivable Perturbations Cause Forgetting and Confusion in Continual Named Entity Recognition
Authors: Yahan Yu, Zhengdong Yang, Fei Cheng, Chenhui Chu


Reviewer paper summaries: This paper proposes CL-Attack, which highlights the security vulnerabilities of CNER systems. To attack CNER, the proposed method first trains an attack model that can output the desired perturbations and then uses the perturbed training samples to for further learning. The proposed CL-Attack is shown to be effective and stealthy, evidenced by extensive experimental results on different CNER methods and datasets.
Summary of strengths: 1. This paper identifies threats in CNER systems and proposes a new attack method, CL-Attack, to effectively and stealthily attack CNER.
2. The experimental results are extensive, demonstrating the proposed methods’ better performance compared to baselines.
Summary of weaknesses: 1. The threat model requires further clarification. It is unclear whether the adversary has control over the model training process or if their attack is limited to the data collection process (i.e., data poisoning attacks). Additionally, the practicality of the threat model raises questions. If this is indeed a data poisoning attack, then the assumption that "previous models remain accessible" may not hold in general. This assumption should be further justified.
2. The writing in the technical part is confusing. For example, in Section 3.2 Perturbation Training, the authors said “we first trained the attack model and update perturbation”, but in the end, there seems to be another training. The author can reorganize this paragraph to make it more clear.
Comments, suggestions and typos: 1. Can you justify why CL-Attack needs the goal of knowledge forgetting? Can we remove L_{kd} in the continue learning part to achieve a similar attack performance? 
2. What does the “best attack result” in Table 1 mean? Compare with baselines? It is a little bit confusing.
3. Reference year error: Sang and De Meulder, 1837
4. Seems that the memory of the A100 GPU is wrong.
Overall assessment scores: 2.5