Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions
Authors: He Zhao
Trung Le
Paul Montague
Olivier De Vel
Tamas Abraham
Dinh Phung
Venue:  (2020)

Abstract: Deep neural network image classifiers are reported to be susceptible to adversarial evasion attacks, which use carefully crafted images created to mislead a classifier. Recently, various kinds of adversarial attack methods have been proposed, most of which focus on adding small perturbations to input images. Despite the success of existing approaches, the way to generate realistic adversarial images with small perturbations remains a challenging problem. In this paper, we aim to address this problem by proposing a novel adversarial method, which generates adversarial examples by imposing not only perturbations but also spatial distortions on input images, including scaling, rotation, shear, and translation. As humans are less susceptible to small spatial distortions, the proposed approach can produce visually more realistic attacks with smaller perturbations, able to deceive classifiers without affecting human predictions. We learn our method by amortized techniques with neural networks and generate adversarial examples efficiently by a forward pass of the networks. Extensive experiments on attacking different types of non-robustified classifiers and robust classifiers with defence show that our method has state-of-the-art performance in comparison with advanced attack parallels.

Under review as a conference paper at ICLR 2020
PERTURBATIONS ARE NOT ENOUGH: GENERATING ADVERSARIAL EXAMPLES WITH SPATIAL DISTOR- TIONS
Anonymous authors Paper under double-bling review
ABSTRACT
Deep neural network image classifiers are reported to be susceptible to adversarial evasion attacks, which use carefully crafted images created to mislead classifier. Recently, various kinds of adversarial attack methods have been proposed, most of which focus on adding small perturbations to input images. Despite the success of existing approaches, the way to generate realistic adversarial images with small perturbations remains challenging problem. In this paper, we aim to address this problem by proposing a novel adversarial method, which generates adversarial examples by imposing not only perturbations but also spatial distortions on input images, including scaling, rotation, shear, and translation. As humans are less sus- ceptible to small spatial distortions, the proposed approach can produce visually realistic attacks with smaller perturbations, able to deceive classifiers with- out affecting human predictions. We learn our method by amortized techniques with neural networks and generate adversarial examples efficiently by a forward pass of the networks. Extensive experiments on attacking different types of non- robustified classifiers and robust classifiers with defence show that method has offie-of-theaare performance in comparison with advanced attack parallels.
INTRODUCTION
Recently, Deep Neural Networks (DNNs) have enjoyed great success in many areas such as com- puter vision and natural language processing. Nevertheless. DNNs are demonstrated to be vulner- able to adversarial attacks (Goodfellow et al., 2014b] Nguyen et al., 2015 Kurakin et al. (0166), which are data samples carefully crafted to be misclassified by DNN classifiers. For example, in image classification, an adversarial example may imperceptibly look like legitimate data sample in ground truth class but misleads DNN classifier to predict it into maliciously-choser target class or any class different from the ground truth. The former and latter are referred to as targeted attack and untargeted attack, respectively. In addition, adversarial attacks poisoning attacks (attacks during the training phase of classifiers) vs evasion attacks (attacks during the testing/inference phase) and whitebox attacks vs blackbox attacks. For whitebox attacks, the attacker has full access to the model architecture and parameters of a classifier, while those kinds of information invisible to blackbox attackers. In this paper, are particularly interested in untargeted, evasion, and whitebox attacks. However, many of the attacks discussed in this paper (including the proposed ones) can be easily adapted into targeted or blackbox settings.
be categorised into
Shown in Goodfellow et al. (2014b), image classifiers based on DNNs (c.g.. Convolutional Neural Networks (CNNs) (LeCun et. | 1998)) are susceptible to small but carefully-chosen perturbations. Therefore, significant research efforts have been devoted into perturbation--asel adversarial at- tacks, such as those in Goodfellow et al. (201bb); -oosavi-Dezzooll et al. (2016): (Callini Wagner 2017); Xiao et al. (2018a). Usually, a classifier is more easily fooled with larger perturbations, but this may result in adversarial examples that are less similar to original/real images. In practice, is equally important that adversarial examples should mislead the classifier well as "look like" real images. Therefore, the general task for perturbation- based methods can be formulated as misleading classifier with minimum amount of perturbation.

---

Under review as a conference paper at ICLR 2020
It is reported that the intermediate feature maps (convolutional layer activations) in a CNN not actually invariant to spatial transformations of the imput data, due to its limited, pre-defined pool- ing mechanism for dealing with spatial variations (Jaderberg et al. 2013 Cohen & Welling 2015 Lenc & Vedaldi, 2015). Therefore, one can imagine generating adversarial examples by incorpo- rating spatial distortions to original images. For example, Figure Ta shows that CNN classifier successfully classifies the digits of MNIST (LeCun & Cortes] 1998). However, it is misled by the adversarial examples with properly-chosen spatial distortions. In contrast, humans are usually less influenced by such distortions. Motivated by this demonstration, by combining spatial distortions with perturbations, we may be able to generate more realistic adversarial examples with smaller perturbations, which can challenge classifiers without affecting human predictions.
To further demonstrate this idea, given some samples of original MNIST images shown in Figure Tb we apply widely-used perturbation-based attack, Projected Gradient Descent (PGD) (Madry et al. 2018), with the maximum perturbations of = 0.3 (the standard setting of the attack), to attack the previously-mentiones classifier, the corresponding adversarial examples of which are shown in Figure Ic] can be observed that those adversarial examples, though they fool the classifier, can be detected by humans, meaning that one can easily distinguish real and adversarial examples. On the other hand, shown in Figure [d] the approach introduced in this paper, combines spatial distortions and perturbations to achieve similar attack performance PGD, but with much smaller perturbation (e = 0. Our adversarial examples are clearly less distinguishable from real images by humans.
Motivated by the above idea, in this paper, we propose a kind of adversarial attack DNN- based image classifiers, which generalises the conventional perturbation-based attacks with ad- ditional spatial distortions. We name our framework SdpAdv (Spatial distortion perturbation Adversary). Specifically, to attack a pretrained classifier, our approach leverages a trainable joint process of two major steps, where first generates a spatially distorted intermediate image by per- forming fefine-tranffrmmatie adding perturbations to the intermediate image.
on real image and then generates the final adversarial image by
The proposed SdpAdv has the following appealing properties:
With the help of spatial distortions, our method is able to achieve state-of-the the- adversarial attack performance with much less perturbations than existing approaches purely based on perturbations, which generates less distinguishable adversarial examples.
With a differentiable framework, the learning of SdpAdv can be done efficiently in an amortized way, where two neural networks are learned to generate the specific parameters of the spatial distortions and perturbations for an input image. After SdpAdv is trained, only takes one-step forward propagation in the two neural networks to generate adversarial examples, which enjoys better efficiency in the testing phase.
As most of existing robust classifier with defences, like those in Samangouei et al. (2018); Matyasko & Chau (2018). are designed to defend against perturbation based attacks, they can be less effective to our attacks based on spatial distortions (Xiao et al. 2018b).
Unlike many other whitebox attack methods, which usually require full access to the model structures and parameters of the classifier, SdpAdv only needs to be trained with access to the predicted probabilities of the classifier and directly generates adversarial examples from input images in the testing phase. That is to say, SdpAdv fits the settings of the semi-whitebon attack (Xiao et al. 2018a), which can be more applicable practice.
To demonstrate the superiority of our proposed method, we conduct extensive comparisons with state-of-the-at adversarial attacks. The experimental results show that SdpAdv is able to achieve better attack performance against both unprotected and robust classifiers. More interestingly, using less perturbation, our adversarial examples are much less distinguishable from real images.
2 BACKGROUND AND RELATED WORK
We now introduce the background and related work on adversarial attacks. Suppose that an image in the ground-truth label y is the input of neural network classifier f. The predicted label of given x is denoted as fx). We assume f() = y for a well well-trained classifier and will use them inter- changeably hereafter. The general goal of adversarial attacks is to generate an adversarial example
2

---

Under review as a conference paper at ICLR 2020
(a)
(b)
(c)
(d)
Samples of original images
0
6
0
6
0
0
6
0
6
6
0
0
6
0
0 2 8
/
/
1
/
7
/
1
1
/
/
1
1
Predicted labels
0
3
7
2
2
2 3
2 3 4
2
2
2
2 3
2 3
2
2
2
2
2 3
Samples of spatially distorted Images
0
3
3
3
9
3
3 3
3
3
3
3
111 4 2
Predicted labels
7
11
4
4
4
4
4
4
7
4
9
4
4
4
4
4
Figure 1: Image classification demo on MNIST dataset. The CNN classifier trained with the training set of the original images achieves 99.15% test accuracy. (a) Original image samples and corresponding spatially distorted images with the predicted labels. (b) Original image samples.
(c) The corresponding adversarial examples of PGD with the maximum perturbations of 0.3. (d) The corresponding adversarial examples of the attack method proposed in this paper with spatial distortions plus the maximum perturbations of e 0.1. The accuracies under both kinds of attacks are less than 0.05.
I A,, which should "look like" x but change the prediction of f, i.e. f(z) f(x Conversely, the goal of a defender is to train robust classifier to defend against adversarial attacks.
2.1 PERTURBATION- BASED ADVERSARIAL ATTACKS
As the name implies, perturbation based attacks generate zA by adding small perturbations 17 to x: AΛ = x x++ 17. In general, 17 can be constructed by either: == arg max (z y) or || can
7 arg f(x)) ||7/11, where (-(-) denotes the cross-entropy loss of f and || be the Ls in accordance with Madry et al. (2018); AAthaly et al. (2018) or other norms. As finding the closed-form form solution for the above problem can be hard, Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2014b) is a one-step attack that applies a first-order approximation: ?) = 6 sign( v (x, Several extensions and variants to FGSM have been proposed, such as Randomized FGSM (Tramèr al.) 2018). Basic Iterative Method (BIM) (Kurakin et al., 2016),, and Projected Gradient Descent (PGD) (Madry et al. 2018). In addition to FGSM, there are numerous perturbation-basee attacks that use different approximations
the above problem. For example, DeepFool (Moosavi-Dezfool) et al., 2016) generates adversarial perturbations by taking a step the direction of the closest decision boundary in an iterative manner and CW (Carlini & Wagner 2017) is an attack based on the optimisation of a modified loss function with implicit box-constraints.
Despite their success, the optimisation process of the above methods may have to be done for every test image, which could be inefficient in practice. To alleviate this problem, several attack meth- ods have been proposed to directly generate perturbations by feeding real images into generator: = g(z), which is usually implemented by neural networks. For example, Adversarial Transfor- mation Networks (ATNs) (Baluja & Fischer 2018) trains g by minimising the combination of the re-ranking loss and an L2 norm loss, so as to constrain aA to be close to in terms of Lz. Instead of using an L2 norm, the AdvGAN (Xiao et al. 2018a) attack adopts Generative Adversarial Net- work (GAN) (Goodfellow et al. 2014a) framework with a discriminator to encourage the perceptual quality of the generated attacks. Moreover, the Rob-GAN (Liu Hsieh 2019) attack also uses a GAN framework, where the discriminator is trained to distinguish between the attacks generated by PGD and those by the generator.
2.2 NON-PERTURBATION BASED ADVERSARIAL. ATTACKS
Here we consider non- ann-perturbation-baseed methods as attacks that do not purely rely on manipulating the pixel values of original images. Compared with perturbation-base attacks, to our knowledge, research on non-perturbation-baase methods is relatively rare. Recently, by adding perturbations to the latent space learned by Auxiliary Classifier GAN (AC-GAN) (Odena al. 2017). the attack in Song et al. (2018) generates adversarial examples for a specific label from scratch without taking a real image as input. Alternatively, there are attacks that apply spatial transformations to original images. Spatial Transformation Method (STM)) used in the CleverHans library (Papernot et al.
2018) constructs adversarial candidates by rotation and translation then selects the one that chal-
https://cleverhane http:///eecccceeeccccccccce//e/s
3

---

Under review as a conference paper at ICLR 2020
lenges the classifier most. As the selection process is non-differentiable, STM relies the SPSA adversary (Uesato et al. 2018), which is a gradient-free frre optimization method. Given a real image, stAdv (Xiao et al.] (018b) is differentiable method that finds flow field, each cell of which captures the transformation direction of one pixel of an input image.
3 METHODS
3.1 PROBLEM DEFINITION
Here we first present the problem definition of adversarial attacks, which generalises the of perturbation-be based methods, discussed in Section 2 Suppose that a real image and its ground-truth label is denoted by x E RL and y (1,..., k. respectively, where L represents the image dimension and K is the number of unique labels. We consider a pretrained classifier f taking as input and implemented with multilayer neural networks, where the last layer has K output units, denoted by f1(z). The output label of f(x:) : IRL + {1..... K} is obtained by: f(x) := arg max, (f(())) Given image x, we would like find adversarial example, 2A Ozz). that challenges the classifier f most, i.e., f(xA) * f(x), where O(z) denotes the set of candidate adversarial images. Given the notation, the most challenging adversarial example Z can be generated by the following optimisation:
ZA arg max ( (z) x'EO(x)
(I)
In particular, (xx) is usually defined along with the way of generating attacks. For example, for perturbation-based methods, (zz) can be a Lylball (or other norms) centred at x with the radius of Oxx) = {a', || z|I S <}. To make the candidates "perceptually close" to z, e set to a small value. However, this definition clearly does not fit the proposed approach with spatial distortions, as a small spatial distortion usually keeps an image looking similar but can result in a large L2 difference. Before introducing our definition of ((r). we present the proposed way of generating adversarial examples in SdpAdv. Given an real image x, SdpAdv conducts two major steps: 1) the spatial distortion step, where a spatial transformation t R- + I is applied to generate distorted image Zr := t(x); 2) the perturbation step, where a perturbation 7j is imposed on IT to generate the final adversarial example: FA FT 1).
In the spatial distortion step, we consider the affine transformation, which is a widely-used geo- metric transformation for images. Simply parameterised by matrix of six real numbers, affine transformation can be a composition of four linear transformations including scaling, rotation, shear, and translation. Given the position of pixel on 2D image, (nt, v), affine transformation with parameter matrix 0 transforms the pixel into a new position (μ', v²) as follows:
T
b
e
1/d
d
f
0
0
1
1
= where d and = O, we get the parameter matrix for the identity transformation, denoted by 0,. In the case of an image transformation, the new position (n', x') can be fractional numbers and so not necessarily lie on the integer image grid, we apply bilinear interpolation to the original image before transformation, following (Jaderberg et al. 2015). With this notation, to generate a distorted image ZT from x, we apply an affine transformation with a parameter matrix Og specific x: IT to (x). Recall that Py has to be perceptually close x, thus we would like to avoid tren-transoorming FT- Therefore, we enforce O₂ to be the Lall of 05: 100-0 S 7. After the spatial distortion step, we add the perturbation of 1he into vr generate A in the perturbation step: A := xT T/a where ||v=]| S e. This step is similar to the conventional perturbation- based methods, except that the perturbations are added into the intermediate image FT instead of the input image x.
Finally, the optimisation problem of SdpAdv can be described as: Given an individual image x, finding the optimal 0₂ and 1/2 under the constraints of 10_ 0yll S and I|m=ll S which can also be formulated as:
BrwPa
max
1sT C (x) + +
(3)
4

---

Under review as a conference paper at ICLR 2020
Perturbation Network: Bg
Localisation
Network: Agd
Grid
X
generator
XT
XA
8
Spatial distortion step
Perturbation step
Figure The adversarial generator architecture SdpAdv.
where Pa denotes the data distribution of the image training set. It is also noteworthy that the constraints on 0 and 17 define the set of candidate adversarial examples, i.e., ((z).
3.2 AMORTIZED OPTIMISATION SOLUTION
In general, directly solving the problem in Eq. 3 involves the optimisation for every input image r, as in many existing perturbation-baser algorithms such as CW (Carlini & Wagner (017). Such an optimisation process can be challenging and inefficient in practical cases, where real-times attacks may be important. Alternatively, we leverage the amortized optimisation with neural networks to bypass this problem.
First, we introduce two families of neural networks: Hyd := (had 0' h= A -100010000 0y1 7 and Hp := (hp : 1/' := (x) A ||7'|| || S e). In particular, the family of Hed consists of neural net- works with the same network architecture, each of which, hed, takes parameter matrix 8' the Lz-ball with 0, as the centre. Similarly, hp outputs the perturbation of n/. Due the infinite capacity of neural networks, they can be used to approximate any continuous function up to any level of precision. Therefore, our goal is to find two neural networks h E Had and hgg E Hpp which are used approximate the optimisation in Eq. 3 based on the following theorem:
input and outputs the affine
Theorem 1. If the family H defined above has infinite capacity, the optimization problem in Eq. is equivalent to the following:
3
had Had EuwPa [&s (2) + hep (x))
max
(4)
-Lai
The proof is in the appendix.
3.3 MODEL ARCHITECTURE OF SDPADV
With Theorem I we can amortize the optimisation of SdpAdv by training two neural networks: had and hn- Equipped with the two neural networks, we are able to build an end-to-end adversarial generator, g. that takes z as input and outputs zA by imposing spatial distortions and perturbations: A == g(z). The architecture of the proposed generator of SdpAdv is shown in Figure 2 In the spatial distortion step, we adopt the architecture of STN (Jaderberg al. 2015). Specifically, following Jaderberd et al. a (2015). we name hed to the "localisation network".. which takes as input and outputs the optimal parameter matrix of the affine transformation, 0z. After that, O2 fed into the "grid generator" to create a sampling grid, which is a set of points where should be sampled to produce Iy (Jaderberg et al. 2013). In the perturbation step, the adversarial generator takes the output of the previous step, Ty, and then adds the optimal perturbation, 7e obtain ZA- In particular, 7/ generated from hp. named the "perturbation network": 7 := (xp))). Finally, the operations of the adversarial generator can be summarised as:
g(x) == (x))(a)())) Atp (t)(hhs(())(x)))
(5)
5

---

Under review as a conference paper at ICLR 2020
3.4 LEARNING OF SDPADV
Given the architecture of the adversarial generator, the learning of SdpAdv is equivalent to that of the two neural networks: had and hp. by minimising the loss of Lad in Eq. (4) To train the model with stochastic gradient descent (SGD), it is important to show that the model construction is differentiable
that the loss gradients can be backpropagated. It is not hard to see that hp is trainable, which follows a similar construction to residual neural networks (He et al. 2016). Shown in Jaderberg et al. (2015), the construction of STN also allows the loss gradients to flow back to the grid generator as well as the localisation network htd.
In addition to Lade; recall that we need to enforce 1|0z 0yll y and || c. Therefore, introduce two regularisation loss functions, respectively, as follows:
Lo == Ez Pa [1|0g 0r
byy == Ex [ma n> - -)],
(7)
where ||- is the L2 norm and Eq. 77 is the hinge loss used in Xiao al. (2118a). In our implemen- tation, after generating 0g and Ta. we apply 0₂ := min(O, + 7; 0zz and 7/2 == min(e, 72) to keep
A in the candidate set (ar) defined by our method.
Inspired by the GAN construction in Xiao et al. (2018a), we also introduce a neural network-based discriminator d to encourage that adversarial images are perceptually close to real images. However, different from Xiao et al. (2)18)), our d distinguishes between ær (positive sample) and x a (negative sample) and does not care about the spatial distortion step. This is because #r expected to nat- urally "look similar" to the original image under small affine transformations. Therefore, it is unnecessary to use the discriminator to check this. Following Goodfellow al. al. (2014a), the GAN loss is as follows:
LGAN := PaPa
[lg (og)) +I E
Pa #y (=))) [lo((1 D(xa)))
(8)
(1)
In conclusion, the learning of the adversarial generator can be done by minimising the following loss function:
bg == Ladv + aLa 3L, XLGAN,
where a, B, y are the weight parameters for the losses. In addition, the discriminator can be trained by maximising the GAN loss, similar Goodfellow et al. (2014a) Xiao al. (2018)).
3.5
COMPARISON TO OTHER METHODS
Among the many related adversarial attack methods discussed in Section 2 we consider Adv- GAN (Xiao et al. 2018a STM implemented in CleverHans (Papernot et al. 2018). and stAdy (Xiao) et al. 2018b) as the most related ones. To our knowledge, SdpAdv is the first technique that com- bines both spatial distortion and perturbation to generate adversarial examples, while others only consider either of the two attacks. Our method can be viewed as generalisation to AdvGAN, That say, we set 7 to 0, then the affine transformations in our method will approach to the identity transformation and our SdpAdv reduces to AdvGAN. Despite the fact that STM and stAdy only con- sider spatial transformations, the way of conducting spatial transformations in our model different from theirs. Specifically, STM only allows two kinds of transformations: rotation and translation while affine transformations used in our model are more flexible. More importantly, STM proposes spatially distorted candidates and uses non-differentiable approach to select adversarial examples from those candidates, while ours is a differentiable method, which is more flexible and easier to train. In stAdv, each pixel in the input image has its specific flow vector to capture the transformation direction of the pixel, making the optimisation of the flow vectors potentially inefficient in practice. In contrast, ours image. Consequently, we only need to optimise for the six cells in the affine parameter matrix for each image, which can be efficiently done by a forward pass in the localisation network.
affine transformation that is specific to one image, for all the pixels of that

---

Under review as a conference paper at ICLR 2020
4 EXPERIMENTS
In this section, we conduct experiments to compare the performance of SdpAdv with other state-of- the-art adversarial attack methods on attacking both non-robustified image classifiers (raw classifiers without defences) and robust classifiers with defences.
4.1 EXPERIMENTAL SETTINGS
Here we mainly consider the MNIST (eCunn & Cortes 1998) and Fashion MNIST (iiao et al. 2017) datasets, each of which consists of 60,000 images of ten classes,
Settings of the classifiers: For non-robustified classifiers, we consider: Model-A, CNN-based classifier with "X-Conv(64, 8x8, P.ReLU-CConv(222 6x6, 2) RReLU-Conv(128 5x5, 1)-ReLU- FC(10)-Softmax" and Model-B, a fully-comnected (FC) classifier with "X-FC(200)-
ReLUU-FC(10)-SSotmaaY (Samangouei et al. (018)) where X denotes input layer of image. The two classifiers were pretrained on the standard training set (50,000 images) of MNIST and Fashion MNIST. Additionally, we consider robust classifiers based on the following three state-of-the-an art defences: Defense-GAN (Samangouci et al.) 2018). Adversarial-Crine (Adv-Critic) (Matyasko & Addv-Train with FGSM (c = 0.3) (Tramer et al.) 2018)- All three robust classifiers share the same model architectures with the non-robustified classifiers but defend adversarial attacks in different ways. We used the original implementations of Defense- and Adv-Critid and implemented Ady-Train ourselves on top of CleverHans.
Chau 2018), and Adversarial-Trainin
GAN and
Settings of SdpAdv: In the experiments, we used the following architectures for the adversarial generator (g) and discriminator (d): the localisation network (haa) with "X-FC(20)-FC(6"": the per- d with FCCC)//A)FCC())-FCCC)Sttttt It is noteworthy that other architectures for the above neural networks can also be used in SdpAdv. In the training phase of SdpAdv, we held out 10,000 images in the training set as our validation set and trained our method on the remaining images in the training set with 100 iterations. We reported the attack results with the best model the validation set. We initialised a to 5.0 and used a decay factor of 0.8 for every ten iterations until it reached to 0.8. 3 and À were set to 1.0. We set 7 to 0.3 and varied in the range of (0.0, 0.1, 0.2, 0.3). If = 0.0, it means that perturbation turned off in SdpAdy and we name this variant of our model to "SdAdv". The learning of the adversaria genera- tor and discriminator was done by Adam (Kingma & Ba 2014) with the learning rate of 0.0005 and 0.00005, respectively.
turbation network (hp) with (FFC(12)-FC(128))
Settings of the other attacks: Here we mainly focus on whitebox attacks, where the attackers have full access the classifiers. However, our SdpAdv only needs the output logits of the classifier in its training phase and does not require any additional information in the testing phase, simi- lar AdvGAN (Xiao et al.) 2018a). For comparison, perturbation- attack methods: FGSM (Goodfellow et al.) (214b)), PGD (Madry et al.) 2018)) Momentum Iterative Method (Dong et al.) 20188), and AdvGAN (Xiao al. 2018a). We used the CleverHans (Papernot et al.) 2018) implementations of the first three attacks with the standard set- tings except varying c in the range of (0.1, 0.2, 0.3). We implemented AdvGAN by turning off the spatial distortion step in our SdpAdv. For non- perturbation- based attacks, we consider STM imple- mented in CleverHans and stAdy (Xiao et al. 2018b) implemented by Dumont et al. (2018 All the classifiers and attacks (including the proposed ones) were implemented in TensorFlow
consider the following state-of-the-art
4.2 RESULTS
For quantitative results, we report the classification accuracies on the test set of the classifiers under the attacks. For attackers, lower accuracy indicates better attack performance. The accuracy results for MNIST and Fashion MNIST are shown in Table I and Table respectively.
We have the following remarks our results: 1) In general, our proposed SdpAdv performs the best on attacking both non-robustified and robust classifiers in the comparison with other attacks. This
httee///ttaablccommaaaaaaattttet critii http:://ww.
critic
7

---

Under review as a conference paper at ICLR 2020
Table 1: Classification accuracies on MNIST. The first row shows the accuracies
classifiers under disaol-distttto--be methods. The
no attack. The first three attacks (including the proposed SdAdv) are following four attacks are perturbation based methods. SdpAdv with e > 0.0 is the proposed method with both spatial distortions and perturbations. For the non-robustified classifiers, varies in the range of {0.1,0.2 0.3] while for the robust classifiers, set 0.3. the last column of "sum", show the summation over the accuracies all the classifiers with e 0.3. Best results from the attacks with perturbations are boldface. (a) Model
Classifier
Non-robustffed
Adv-Critic
Defense-GAI
Adv--rrain
Sum
Attack
No attack
0.9914
0.9901
0.9914
0.9916
3.9645
STM
0.4959
0.4449
0.1434
0.9481
2.0323
stAdv
0.130S
0.9933
0.2015
0,5388
1.864
SdAdv (ours)
0.0517
0.2365
0.0476
0.074
0.4098
0,7
0.2
0.3
0,3
0.3
0.3
FGSM
0.7788
0.3457
0.1902
0.3595
0.8104
0.9481
2.3082
PGD
0,4239
0.0128
0.0059
0.0462
0.8545
0.0926
0,9992
MIM
0.4134
0.0911
0.0868
0.1140
0.8032
0.1584
1.1624
AdvGAN
0,9915
0.7679
0.1573
0.6820
0.3010
0.9278
2.0681
SdpAdy (ours)
0,0418
0.0259
0.0204
0.2536
0.0266
0.033
0.3336
(b) Model
Classifier
Non-robustified
Adv-Critic
Defense-GAN
Adv-Train
Sum
Attack
No allack
0.9831
0.9817
0,9831
0,9757
3.9236
STM
0.1999
0.2044
0.0792
0.1200
0.5975
StAdv
0.1270
0.9860
0.1207
0,3436
I,5773
SdAdv (ours)
0.0502
0.1363
0.0666
0.0744
0.3275
0.7
0.2
0.3
0.3
0,3
0,3
FGSM
0.3584
0.0901
0.0457
0.3147
0,7710
0.8753
2.0067
PGD
0.1198
0.0205
0.0137
0.0920
0.8509
0.0147
0.9713
MIM
0.1146
0.0272
0.02TT
0.7087
0.7635
0.0373
0.9306
AdvGAN
0.6006
0.2432
0.0504
0.7733
0.TTTO
0,2868
1.2215
SdpAdv (ours)
0.0281
0.0233
0.0223
0.0821
0.0252
0.0741
0.2037
is particularly demonstrated the "Sum" column, which can be viewed as a measure of the overall performance. 2) In comparison with attacks using perturbations, with very small perturbation mag- nitudes (e.g., = 0.1), other methods struggle to perform, while with the help of spatial distortions, SdpAdv is able to achieve impressive attack results, generating less noisy attacks without sacrificing performance. 3) Among the attacks with spatial distortions, our variant, SdAdy, achieves the best attack results most cases. 4) We observe that robust classifiers such as Defense-GAN, which are usually designed to defend against perturbations, are much less effective against spatial distortions.
To further study our methods. we compare the test accuracies, L2 norm, and running time of the compared attacks in Table It can be found out that our proposed approaches are able to perform attacks as efficient as FGSM, which a one-step operation, but with much better performance. is also noteworthy that the adversarial examples generated by our methods can result in large values of Ta2 norm but they can look very realistic, shown Figure and Figure
CONCLUSION
In this paper, we have introduced new adversarial attack method, named SdpAdv, named SdpAdv, which generates adversarial examples with both spatial distortions and perturbations. Specifically, given an input image, SdpAdv applies affine transformations to conduct spatial distortions and then adds perturbations the spatially distorted image to generate the final adversarial example. As differentiable approach, SdpAAd leverages the amortized optimisation with two neural networks to obtain the optimal parameter of affine transformations and the optimal perturbations, respectively. Extensive experiments of attacking different kinds of non-robustified classifiers and robust classi- fiers have shown that our method achieves the state-of-the-arr performance in the comparison with advanced attack parallels. More importantly, in the use of spatial distortions, our proposed approach can produce more realistic adversarial examples with smaller perturbations, which can challenge classifiers well without affecting human predictions.
8

---

Under review as a conference paper at ICLR 2020
Table 2: Classification accuracies on Fashion MNIST.
(a) Model A
Classifier
Non-robustifeed
Adv-Critic
Defense- Cefense-GAN
Adv-Train
Sum
Allack
No attack
0.9016
0.9032
0.9016
0.9057
3.6121
STM
0. 1063
0,2153
0.3548
0.1296
0.8060
stAdy
0.0705
0.8868
0.0628
0.1930
1.2131
SdAdv (ours)
0.1762
0,3286
0.1372
0.1502
0.7922
0.1
0.2
0.3
0.3
0.3
0.3
FGSM
0.2924
0.2494
0.2435
0.0888
0.5661
0.8838
1.7822
PGD
0.1789
0.1270
0.0896
0,0286
0.6265
0.0764
0.8211
MIM
0,2375
0.2356
0.2356
0.0529
0.5300
0.1054
0.9239
AdvGAN
0.4974
0.1239
0.0568
0.1907
0.1238
0.1854
0.5567
SdpAdy (ours)
0.0330
0.0234
0.0121
0.1213
0.0204
0.0444
0.1982
(b) Model
Classifier
Non-robustifed
Adv-Critic
Defense-GAr
Adv-Train
Sum
Attack
No attack
0.8910
0,8842
0.8910
0.8869
3.5531
STM
0.11 12
0.1718
0.2817
0.0967
0.6614
stAdy
0,2196
0.8286
0.1812
0.4614
1.6908
SdAdv (ours)
0.1079
0.2780
0.1298
0.1420
0.6577
0.1
0.2
0.3
0.3
0.3
FGSM
0.2291
0.1674
0.1666
0.
0.4236
0.8558
1.6170
PGD
0.1157
0.0719
0.0518
0.0731
0.3547
0.0431
0.7227
MIM
0.1629
0.1540
0.19
0.0813
0.4236
0.0515
0.7093
AdvGAN
0,2969
0.0703
0.0286
0,2040
0.0605
0.1015
0.3946
SdpAdv (ours)
0.0203
0.0095
0.0075
0.1028
0.0152
0.0392
0.1647
Table 3: Comparison of test accuracy, Le norm, and running time Here report the above metrics for the non-ro robustified classifier with Model A. The test accuracies are copied from Table Table sample 100 images from each of the two datasets and calculate Er, [|| - ælI. which the La norm between the input and adversarial images. In addition, we report the running time (seconds) to generate attacks for those 100 sample images. All the attacks in the same machine with the same environment. 0.3 is used for the attacks with perturbations, unless stated otherwise.
Dataset
MNIST
Fashion MNIST
Metric
Acc
Lg
Time
Ace
Lg
Time
FGSM
0.1902
33.42
0,05
0.2435
38.11
0.05
PGD
0.0059
25.98
0.12
0.0896
30.52
0.13
MIM
0.0868
27.17
0.10
0.2356
31.23
0.11
AdvGAN
0.1573
8.29
0.01
0.0568
10.91
0.02
STM
0.4959
71.08
0.15
0. 1063
57.21
0.15
stAdv
0.1305
13.35
620.8
0.0705
6.19
609.7
SdAdy
0.0517
120.66
0.05
0.1762
94.23
0.05
SdpAdv (e 0.1)
0.0418
111.7
0.06
0.0330
81.70
0.06
SdpAdv 0.3)
0.0204
112.92
0.06
0.0121
44.73
0.06

---

Under review as a conference paper at ICLR 2020
(a) Original images
(b) PGD, c=0.3, acc=0.0059
(c) AdvGAN, c=0.3, acc=0.157
0
0
/
/
/
F
7
$
1
7
2
2
2
2
2
2
3
2
2
2
2
2
2
2
2
3
3
3
3
3
3
3
3
3
8
3
3
3
3
3
4
4
H
4
9
3
4
(d) STM, acc=0.4959
(c) stAdv, acc=0.1305
(f) SdpAdv, c=0.1, acc=0.0511
0
0
0
0
/
/
1
3
/
2
2
2
2
2
3
3
2
2
2
2
2
2
2
2
3
3
3
3
3
3
3
3
3 7
3
3
3
3
3
3
4
4
3
4
4
+
Figure 3: Sample images and their adversarial attacks against Model A in MNIST. The predicted labels of
Model A are shown above the images. The test accuracies copied from Table
(a) Original images
(b) PGD, c=0.3, 0cc=0.0896
(c) AdvGAN, c03.3, 0.050.056
POOT
(d) STM, acc=0.1063 1063
(c) stAdy, acc=0.0705
SdpAdv, c=0.1, acc=0.0330
Dress
Dost
Dress
Drees
Dress
Doees
Drens
Drane
Fost
Tap
Top
Doees
Stirt
Draes
JOPAL
CO
DC
GO
Figure 4: Sample images and their adversarial attacks against Model A in Fashion MNIST. The test accuracies copied from Table 2
10

---

Under review as a conference paper at ICLR 2020
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML, pp. 274-283, 2018.
Shumeet Baluja and lan Fischer. Learning to attack: Adversarial transformation networks. AAAI, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pp. 39-57, 2017.
Taco S Cohen and Max Welling. Transformation properties of learned visual representations. ICLR, 2015.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In CVPR, pp. 9185-9193, 2018.
Beranger Dumont, Simona Maggio, and Pablo Montalvo. Robustness of rotation-equivarianl net- works to adversarial perturbations. arXiv preprint arXiv:1802.06622) 2018.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NeurlPS, pp. 2672-2680, 2014a.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2014b.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, pp. 770-778, 2016.
Max Jaderberg, Karen Simonyan, Andrew Zisserman, et al. Spatial transformer networks. In NeurIPS, pp. 2017-2025, 2015.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint UrXiv:1412.69988 6980, 2014.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. ICLR, 2016.
Yann LeCun and Corrina Cortes. The MNIST database of handwritten digits. 1998.
Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haffner, et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 1):2278-2233 1998.
Karel Lenc and Andrea Vedaldi. Understanding image representations by measuring their equivari- ance and equivalence. In CVPR, pp. 991-999, 2015.
Xuanqing Liu and Cho-Jui Hsieh. Rob-GAN: Generator, discriminator, and adversarial attacker. In CVPR, pp. 11234-1 12243, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
Alexander Matyasko and Lap-Pui Chau. Improved network robustness with adversary critie. In NewrlPS, pp. 10578-10587 2018.
Seyed-Mohsen Moosavi-Dezfooli Alhussein Fawzi, and Pascal Frossard. DeepFool: A simple and accurate method to fool deep neural networks. CVPR, pp. 2574-2582, 2016.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confi- dence predictions for unrecognizable images. CVPR, pp. 427-436, 2015.
Augustus Odena, Christopher Olah, and Jonathon Shlens. Conditional image synthesis with auxil- iary classifier GANs. In ICMI., pp. 2642-2651, 2017.

---

Under review as a conference paper at ICLR 2020
Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Ku- rakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy. Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang. Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, and Rujun Long. Technical report on the cleverhans v2.1.0 adversarial examples library. arXiv preprint
2018.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. ICLR, 2018.
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with generative models. In NeurlPS, pp. 8312-8323, 2018.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. ICLR, 2018.
Jonathan Uesato, Brendan ODonoghue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In ICML, pp. 5032-5041, 2018.
Chaowei Xiao, Bo Li, Jun- Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adver- sarial examples with adversarial networks. In IJCAI, pp. 3905-3911, 2018a.
Chaowei Xiao, Jan Zhu Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially trans- formed adversarial examples. ICLR, 2018b.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: A novel image dataset for bench- marking machine learning algorithms, 2017.
A APPENDIX
A.1 PROOF OF THEOREM 1
Proof. Give x, suppose u (x) and v(z) are the optimal solution of the affine parameter matrix and perturbation for Eq. 3 respectively. We first prove that [u(x), vxx)] := h- (x) almost everywhere w.r.t the probability measure Pa. where ht (x)) [tta(z), hig (#=:,t>(()) h" (xx consists of the optimal solution of Eq. 4). By the definition of u, u, it is obvious that
E, (fng)())(a)= + hi (fn=)(o(())) S ey (t
Furthermore, it follows that:
Erg [es (fnz)(o)(1)) + hG ((ns))a((0))) s Er, [e)(tu(o)(z) + (x:)].
Since Had has infinite capacity, there exists hya E Had such that haa = u. We further define k(x) = v (Wlate)) (x)) and obtain (Ihy,ce) (x)) = v(x). Similarly, with the infinite capacity property of Hp, there exists hy E Hpp such that hy = k.
Referring to the definition of h" we have:
Ep [er (Ins)co)()) + hi (Inc. 2 Er, [es (Insstor (x) + ni (Inz,ce)( (o)) Ep, [er (tnr,(e0(()) + hp (mns))))))))) 2 Ee, [e (tucon) (x) + (x))],
which further implies the equality:
Erg (es (Inzs(e)(0) + hū (m))) Wr, (e (eg((u(o)(()) + (x))],
and also (u(x), o(x))]= ; h" (x) almost every w.r.t the probability measure Pa-
12


Reviews:
[{"review_id": "r1xnXDVnFH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a new adversarial attack method by combining spatial transformations with perturbation-based noises. The proposed method uses two networks to generate the parameters of spatial transformation and the perturbation noise. The whole architecture is trained by a variant of GAN-loss to make the adversarial examples realistic to humans. Experiments on MNIST prove that the proposed attack method can improve the success rate of white-box attacks against several models.\n\nOverall, this paper considers an important problem of adversarial robustness of classifiers, and present a new approach to craft adversarial examples. The writing is clear. However, I have some concerns about this paper.\n\n1. This paper seems to integrate multiple ideas studied before into a single attack method. Perturbation-based adversarial examples, spatial transformation-based adversarial examples, generating adversarial examples based on the GAN loss are all studied before. And the proposed method integrates them together to form a new attack.\n\n2. The experiments are only conducted on MNIST and Fashion MNIST. More experiments on CIFAR-10 and ImageNet can further prove the effectiveness of the proposed method.\n\n3. More robust defense models should be incorporated in experiments, at least the PGD-based adversarial training model (Madry et al., 2018).", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "r1e3Y-QTFH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper builds upon the work of AdvGAN and proposes to add spatial transformations on top of it. The resulting attacking framework is demonstrated to outperform AdvGAN on attacking several defense approaches, such as Defense-GAN, AdvCritic and adversarial training. Compared to previous approaches on generating spatially transformed adversarial examples, this approaches amortizes the attacking procedure and can produce spatially transformed adversarial examples much faster. This approach also simultaneously combine spatial transformations and perturbations to make the attack stronger.\n\nI cannot recommend acceptance of this paper because of several reasons:\n\n- The idea is not novel enough. It is simply an A + B paper where A = AdvGAN and B = spatial transformer networks. The idea of adversarial attacks with spatial distortion is not the innovation of this paper and has been proposed and extensively studied by many previous papers. This paper does not have additional innovation and does not lead to additional insight that can warrant an acceptance at ICLR.\n\n- The general narrative of this paper is misleading. The title seems to indicate this paper is the first to discover the importance of considering spatial perturbations, which is misleading. There is no mention of previous work on spatial transformation attacks in either the abstract nor the introduction (except at the very last). The introduction simply analyzes some well-known phenomenon in the literature, does not place this work well in the literature (even true in the related work section as well), and can mislead readers in believing that this work was the first to realize the importance of spatial transformation attacks.\n\n- Theorem 1 is a vacuous statement. It is automatically true based on the universal approximation assumption of neural networks. Including the statement of Theorem 1 is decorative and a waste of space.\n\n- The experiments are not convincing. For example, there is no \\gamma value reported in the tables. Since \\gamma is as important as \\epsilon in the proposed attacking method, the missing of this important variate is suspicious. Also the adversarial training only uses FGSM not PGD. The Defense-GAN is already shown not robust by Athalye et al. and cannot be considered as one of the state-of-the-art defenses. ", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I did not assess the derivations or theory."}, "extra_text": {}}, {"review_id": "BkgXRYNaYB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper introduces a new approach to generate adversarial examples for deep classifiers. As opposed to the majority of work on adversarial attack models, which generally limit the attacker on pixel-space distortions measured with respect to an Lp norm, the authors here consider a slightly more general attack model that is a combination of an affine transformation and additive L2 perturbation of the input example. \n\nFinding optimal attacks for this model can be non-trivial (standard due to the highly nonlinear coupling between the affine parameters and the additive perturbation), so the authors instead propose training a surrogate neural network that generates the attack affine-transformation and distortion- parameters sequentially. This can, in principle, be done in a traditional supervised training setup; however, to force the adversarial images to look perceptually close to natural looking images, the authors throw a discriminator loss on top, and train the attack generator network adversarially.\n\nThe paper is well-written in general, the idea is intuitive, and the experiments are well-described. However, I have a few concerns that lead to me to give a low score (at least in the first round of reviews).\n\n- Novelty. \nLeveraging spatial distortions (or other visually meaningful transformations) to generate adversarial attacks is not a new idea, but the authors seem to have been unaware of this very large body of work. See, for example:\n** Engstrom et al, \"Exploring the landscape of spatial robustness\", ICML 2019\n** Poovendran et al, \"Semantic adversarial examples\", CVPR 2018\n** Ho et al, \"Catastrophic Child's Play\", CVPR 2019\n** Joshi et al, \"Semantic adversarial attacks\", ICCV 2019\namong many others.\n\nUsing GAN-like transformation models to generate attacks is also not a new idea. A few of the above papers use this approach, and the authors refer to a few other such papers as well.\n\nSo as such, the conceptual novelty of the contribution seems to be low (beyond the specific choice of combining affine and L2 perturbations).\n\n- Experimental evaluation.\nThe authors do a commendable job thoroughly laying out the experimental setup. However, a couple of red flags emerge in the experiments. First, why not look at L-infty perturbations (as opposed to L2)? Second, why not test on more challenging datasets (CIFAR, CelebA, etc) as opposed to simple black/white datasets such as MNIST/Fashion-MNIST? One would imagine that the smaller, simpler datasets are easier to optimize for, and therefore the \"amortized\" attack generator networks are not necessary here.\n\n- Weakness of theoretical part.\nI am not sure the theorem is saying anything strong or useful (since the underlying transformer neural network is assumed to possess infinite capacity). I would suggest just removing it.\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The method proposed and explored here is to introduce small spatial distortions, with the goal of making them undetectable by humans but affecting the classification of the images. As reviewers point out, very similar methods have been tested before. The methods are also only tested on a few low-resolution datasets. 

The reviewers are unanimous in their judgement that the method is not novel enough, and the authors' rebuttals have not convinced the reviewers or me about the opposite.
Decision: Reject