Kati8/ICLR_2023_2025 huggingface dataset:
authors: Qihao Liu
authors: Adam Kortylewski
authors: Yutong Bai
authors: Song Bai
authors: Alan Yuille
reviews: 
Comments: Text-guided diffusion models (TDMs) are prone to unexpected failures, such as generating incorrect images from natural-looking text prompts or producing inconsistent images from the same text with different latent variable samples. To address this, the study introduces SAGE, an adversarial search method that explores TDMs' prompt and latent spaces to identify failures, using image classifiers for guidance and human verification for accuracy. The investigation reveals four main failure modes, highlighting issues with semantic capture, latent space structure, prompt-latent misalignment, and the fragility of language representations, suggesting avenues for future improvement.
Strengths: - Proposed a smart adversarial search algorithm to identify failures in TDMs, finding “reasonable” tokens, texts, and latent codes to input into the TDMs, leading to failure generations.

- Here, “reasonable” latent code implies that we draw the code close to N(0,I), and the text should be human-readable. This proposed adversarial attack is not only fair to the TDMs but also practical for users.

- The algorithm demonstrates an intelligent method (using residual connections) to avoid backpropagating through the entire extensive diffusion model, thereby enhancing computational efficiency.

- The text is well-composed, accompanied by a self-explanatory figure delineating the overall pipeline.

- The system is fully automated and reinforced by human evaluation.
Weaknesses: - Given that the pipeline heavily relies on the robust classifier, I'm curious if this means the SAGE system will primarily detect the blatantly poor cases, while struggling to identify the more subtle, not-so-good ones.

- While SAGE employs an ensemble of classifiers, it still seems akin to a handful of neural classifiers trained on the same dataset. True, one might outperform another, but I'm inclined to think that these classifiers would exhibit similar decision boundaries.
Recommendation: 10: strong accept, should be highlighted at the conference
Reviewer confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
Soundness/correctness: 4 excellent
Clarity: 4 excellent
reviews: 
Comments: This paper presents an automatic way of detecting failure text prompts in text-guided diffusion models (TDMs). A robust image classifier based surrogate loss is proposed to detect accurate failure cases due to diffusion models. In addition, to deal with vanishing gradient issue, the authors apply approximate gradients to back-propagate, via residual connection. Adversarial based approach helps to identify the natural text prompts (non-outlier) that cause the failure cases. The experimentation results show the model is efficient in finding the failure cases (SSR), and evaluated via human annotation.
Strengths: I think the task the paper is presenting is novel and is important in the research of TDMs. The authors managed to present thorough experimentation and analysis on evaluating the proposed model performance. The presented samples do show the effectiveness of model in identifying the true failure cases from natural text prompts.
Weaknesses: 1. Overall, while the paper is one of the first to target such a problem in finding actual failure in TDMs, the problem itself is rather similar to some of the previously well studied tasks, with adversarial-based approaches. The discriminator here is to identify and remove the irrelevant feature in the latent space, so that it becomes task oriented. Such an approach has been used in tasks such as fair classification. 
2. Though various evaluation being conducted, it is hard to measure the effectiveness of each proposed component in the model. To better connect the intuition of each contribution of the work and the actual analysis/effectiveness, it would be great to have some ablation study.
Recommendation: 6: marginally above the acceptance threshold
Reviewer confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness/correctness: 3 good
Clarity: 3 good
reviews: 
Comments: This paper proposed a method called SAGE to search natural and human-understandable texts that text-guided diffusion models (TDMs) cannot generate images correctly for the first time. This method explores the discrete prompt space and the high-dimensional latent space to discover undesirable behaviors automatically. This method utilizes algorithms of adversarial attack and image classifiers as surrogate loss functions. To generate natural prompts, the authors use large language models (LLMs) like LLaMA to search for suitable prompts. The authors conduct experiments on several metrics to demonstrate the effectiveness. The authors also conclude 4 different failure types of TDMs by analyzing the results of failure examples.
Strengths: 1.	The topic is meaningful for researchers to understand the failures of diffusion models. Natural prompts are closer to real-world scenarios and are more beneficial for improving the robustness of TDMs.

2.	This work further analyzes the deeper causes and possible solutions through the structure of TDMs and the corresponding language features. These discussions appear to be both comprehensive and effective.

3.	The paper is well-structured and easy to follow. The procedure is demonstrated well in Figure 2 and its description. The author provided detailed descriptions of the method and experiments.
Weaknesses: 1.	The authors do not demonstrate their method in pseudo-code. The code is not included in the supplement material either. Would the authors demonstrate their method in pseudo-code?

2.	Time cost is not shown in the paper.
It seems time-consuming to run a LLaMA and an ensemble of classifiers simultaneously in the attack. How much GPU memory and how long does it take to find an example?

3.	The detail of human evaluation is missing. 
The paper doesn't demonstrate differences in the ratings of different human evaluators. How does the author handle rating differences and assess the accuracy of human evaluators?

4.	The metric needs to be clarified.
Could the authors further explain why the Non-Gaussian Rate (NGR) is reported? What is the purpose of this metric in the experiments?
Recommendation: 6: marginally above the acceptance threshold
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 3 good
Clarity: 3 good