One for Many: an Instagram inspired black-box adversarial attack
Authors: Alina Elena Baia
Alfredo Milani
Valentina Poggioni
Venue: ICLR 2022 Submitted (2022)
Keywords: black-box adversarial attacks
instragram-based image filters
evolutionary algorithm
multi-network attacks

Abstract: It is well known that deep learning models are susceptible to adversarial attacks. To produce more robust and effective attacks, we propose a nested evolutionary algorithm able to produce multi-network (decision-based) black-box adversarial attacks based on Instagram inspired image filters. Due to the multi-network training, the system reaches a high transferability rate of attacks and, due to the composition of image filters, it is able to bypass standard detection mechanisms. Moreover, this kind of attack is semantically robust: our filter composition cannot be distinguished from any other filter composition used extensively every day to enhance images; this raises new security issues and challenges for real-world systems.  Experimental results demonstrate that the method is also effective against
ensemble-adversarially trained models and it has a low cost in terms of queries to the victim model.

Under review as a conference paper at ICLR 2022
ONE FOR MANY: AN INSTAGRAM INSPIRED BLACK- BOX ADVERSARIAL ATTACK
Anonymous authors Paper under double-blind review
ABSTRACT
We propose nested evolutionary algorithm able craft multi-network (decision- based) black-box adversarial attacks based on Instagram inspired image filters. Due the multi-network training, the system reaches a high transferability rate of attacks and, due to the composition of image filters, it is able to bypass standard detection mechanisms. Moreover, this kind of attack is semantically robust: our filter composition cannot be distinguished from any other filter composition used extensively every day to enhance images; this raises new security issues and chal- lenges for real-world systems. Experimental results demonstrate that the method is also effective against ensemble-adven aavessrrlll trained models and it has a low cost in terms of queries to the victim model.
INTRODUCTION
It is well known that deep learning models are susceptible adversarial attacks and many recent researches in the field have been devoted to produce ever more reliable and effective attacks. Attack reliability is strictly connected its applicability in real-world scenarios and its ability bypass potential defense mechanisms; this is why the hard-label black-box setting (also called decision- based attack) and the transferability property of white box attacks gained increasing attention. Sev- eral techniques have been proposed to increase the transferability of both black-box and white-box attacks (Cheng al. (2020); Wu et al. (2020); [Brendel al. (2018) among the most popular). One of the most commonly adopted technique is to craft the attacks by using an ensemble of multiple models as proposed by Liu et al. (2017).
Besides the categorization in white-box and black-box methods, attacks can be classified as re- stricted or unrestricted, considering the amount of modifications they apply to the images in order to fool the systems.
Restricted attacks: they generally use a Lp- norm distance to bound the modifications. The attacks crafted with the aim of minimizing the differences between the original image and the adversar- ial one, even if it means having visible (more or less) artifacts. In Figures Tb and [d] the attacks produced by Dong al. (2019) and Wu et al. (2020), two of the most recent state-of-the-arr adver- sarial methods, are shown. In both the cases the generated artifacts are clearly visible.
Unrestricted attacks: they employ large and visible perturbations while keeping the images realis- tic, natural looking and non-suspicious. The idea is to obtain images that can admit great differences from the original one but, beyond a direct comparison with the original one they cannot be distin- guished from any other real (maybe filtered) image. In Figures If and Th the attacks produced by ACE-InS (Zhao et al. 2020)) and Colorfool (Shahin Shamsabadi et al., 2020) are shown. The differ- ences between the original image and the adversarial one are evident but, if the modifications are good enough, looking just at the adversarial one we might not be able to say that it is the attacking image.
Another aspect that has to be taken into account for real-world attacks is the amount of queries to the victim model that are necessary craft effective attacks. All the systems proposed in literature need a huge amount of queries and, also in the case of systems built to work with limited access to the victim model, several thousands of queries are needed to produce reliable attacks.
In this paper we propose system to craft reliable, effective and highly transferable attacks by com- posing image filters. In previous papers (for Destylization) has been shown that Instagram

---

Under review as a conference paper at ICLR 2022
(a) Raw image
(b) TI-FGSM
(c) Raw image
(d) SGM
(c) Raw image
(f) ACE-Ins
(g) Raw image
(h) Colorfool
Figure 1: Examples of adversarial samples generated by TI-FGSM (Dong al. 2019), SGM (Wu
et al. 2020). ACE-Ins (Zhao et al. 2020), and Colorfool (Shahin Shamsabadi et al. 2020).
inspired filters can have adversarial, but limited effects, when applied singularly. Hence, we de- cided to study the effects of filter composition with the aim to increase the adversarial effectiveness. Moreover, in the usual photo editing process people use more than one filter in order obtain the desired effect. We just wanted to simulate more realistic scenario.
This kind of attack offers multiple benefits: (i) it is naturally robust to detecting methods able to find noise, injected patterns and irregularities in the high frequencies image (Moosavi-Dezfooli et al.) maskinng-radients
2018 Liao et al. 2018). (ii) it is naturally robust to masking gradients (and their numerical estimate) defending methods. (iif it produces natural looking artifacts-fic free images. (iv) produces adversarial attacks that cannot be distinguished from any other filtered images produced extensively every day, especially social media platforms.
The system works in the pure hard-label black box setting and implements a multi- netti- approach to inerease the attack transferability. It reach, with artifact-free images, transferability rate higher than 70% in the case of unsecured networks and, even more interestingly, higher than 60% in the case of adversarially trained network.
Moreover, the system requires a very low number of queries to find an attack, around 640 in the average case, and can be limited by construction adjusting the algorithm parameters. In the exper- iments presented here the maximum number of allowed queries is 1610.
Our contribution can be summarized as follows: (i) We propose the AGV-multinetwork attack, system able to craft powerful adversarial attacks capable of attacking even secured adversarially trained models by composing Instagram inspired image filters; (ii) we empirically demonstrate the high transferability of these attacks and we compare our results with other state-of-the-ar systems; (in)) we empirically demonstrate the efficiency of our system in terms of queries the victim model and we compare our results with other state-of-the-art systems.
2 BACKGROUND
2.1 ADVERSARIAL MACHINE LEARNING
Given an input image I X C dRd and its corresponding label y. let F' be a neural network classifier that (correctly) predicts the class label for the input image x F(x) y. An adversarial attack attempts to modify the input image æ by adding a perturbation into an adversarial image x² x + 8 such that the classifier is mislead into making wrong prediction, i.e. F(x*) # F(x).
we consider the type of the applied perturbation 8, the attacks can be classified as restricted or unrestricted. In the restricted case, the modifications applied to the original image usually small
2

---

Under review as a conference paper at ICLR 2022
and bounded by Ly-norm distance measure, forcing the adversarial image x² to be close as possible to the original one. On the contrary, unrestricted attacks use large perturbations without Lp Lp-bounded constraints that manipulate the image in order to create photo-realistic adversarial ex- amples. In this case the objective is not to limit the modifications on pixels but limit the human perception that modification has been applied (Shahin Shamsabadi al. 2020 /hao et al.) Wang et al. 2021
2.2
IMAGE FILTERS
We implemented ten of the most popular Instagram filters using Python3 and the Pillow, OpenCV and Numpy libraries: Clarendon, Juno, Reyes, Güngham, Lark, Hudson, Slumber, Stinson, Rise, and Perpetua, Each filter has distinct characteristics and effects given by different level of contrast, saturation, brightness, shadows, etc. For instance, Clarendon brightens and highlights a photo, Juno adds saturation and warmth making the colors more intense, Rise gives a warm glow by mixing a radial gradient with light sepia tone, while Hudson bumps up the blues giving a more colder feel. Examples of single filter applications are shown in Figure i Appendix A
Each filter is parameterized by two parameters that have to be optimized by the algorithm: intensity and strength s. The role of the parameter a is to alter the intensity of each basic component inside each filter implementation such as brightness, contrast, saturation, edge enhancement, gamma correction and many more. The parameter is used to control the strength of the filter application and defined as the convex interpolation between the original image x and the transformed image x=:
strength(x, x" 8) = (1.0 - 8) + 8
thus, s = 0 the output image of the filter is the original image, while with s = 1 the filter returns the modified image x².
APPROACH AND ALGORITHM
3.1 PROBLEM DEFINITION
Given set S =
fm of Instagram inspired image filters as described in Section 2.2 and
a clean image x, we want to find sequence of parametrized filters {f,, (a1, $1)..... ... fa, (an, 8n) able to produce adversarial attack against a classifier model F' starting from the image x, that is
F())= + F(x*) x = fki (an, s.) .. (az, (fk, (01, s1)))))
3.2 APPROACH
The algorithm used to optimize the sequence of filters and their parameters is inspired by Baia et al. (202T. In our proposal the universal approach proposed by Baia et al. has been transformed into a multi-network per-image approach, where the attack is crafted and optimized for just one image with respect to more target models.
Since the algorithm uses an evolutionary approach, the fitness function used to guide the search can have any (also non différentiable) form, and we decide to use it implement sort of generalization ability induced by attacking more models simultaneously. This is inspired by Liu et al. (2017) where the authors suggested that attacking an ensemble of multiple networks simultaneously can generate much stronger adversarial examples. Instead of attacking an ensemble network we decided to exploit the optimization ability of the evolutionary approach and try to simultaneously attack all the (or at least k) reference networks. Therefore, goal is to find one adversarial perturbation per-image that can fool many deep learning models. This objective is much harder to achieve than attacking a single model but it guarantees complete (100%) transferability of the attack towards the reference networks.
The proposed multi-networt approach has the objective to obtain adversarial images with better transferability avoiding the natural overfitting trap we can fall into when the attacks are crafted by using a unique reference model.
3

---

Under review as a conference paper at ICLR 2022
3.3 ALGORITHM
The optimization method consists of two evolutionary nested algorithms: the outer algorithm, using GA approach, in charge of finding the sequence of filters to use, and the inner algorithm, based on ES, used to choose the filter parameter values. The general structure of the
algo- rithm shown in Algorithm [ Given a set S [fi, f2. [m] of image filters, the outer algorithm genotype (with length n) is encoded as list of n integers k knn E {1....; m representing the corresponding filters in S, while the inner algorithm genotype is represented by a list containing the pairs of parameters used for each selected filter (((1,8)) s1)...., (ah, 8n)). The associated phenotype
sequence of parametrized filters able to generate the adversarial examples by applying the selected sequence of filters, with their corresponding optimized parameters, described in Eq
3.3.1 OUTER ALGORITHM
The outer optimization step is performed by genetic algorithm: a population of N candidate pertur- bations is iteratively evolved towards better solutions. In order to breed a new generation, population members are randomly selected and the crossover and mutation operations are performed. The qual- ity of the candidates is evaluated based on their fitness values and, at the end of each iteration, the N best individuals are chosen for the next generation.
Initial population: it is generated by randomly selecting / filters from the set S of available filters and their parameters are initialized with default values equal to
Crossover: standard one-point crossover is used to generate new off-springs from randomly selected members. Each child is guaranteed to inherit some genetic information from both parents, including the optimized parameters, For example, given two parent elements Pt (f' (1 s1..... fr (a s))) and P2 = (f", s")..... ........ (a s()) and crossover index = 2, obtain the child element (fi, fa $2),, (3). sg)...., (a",, *"))-
it is applied by substituting a filter with another one based on a mutation probabil- ity. The substituent filter is initialized with random parameter values. For example consider-
Mutation:
ing the element P = (fi $1), f2(02, 82). Ja(Cs, ss)..., (an,, 8x)) and supposing that fil- ters fi and f3 has been chosen to mutate with 9i and g2. the new generated element is p* (g) (ai, fa (02, 82), 92 (a2, ......, fn (a sn)), where a; 8f are randomly extracted from the parameter domains.
at the end of each iteration, we choose the N best individuals from the set of 2N can- didates (parents and offsprings) according to their fitness values. This process is repeated until the algorithm exhausts the allowed number of generations.
Selection:
3.3.2 INNER ALGORITHM
This algorithm is devoted to the parameter optimization and is achieved by using (1, evolution strategy with À = 5. ES iteratively updates a search distribution by following the natural gradient towards higher expected fitness. In case, for each list of parameters samples by perturbing the original individual, A gradient towards a better solution is estimated using the fitness values of the À samples. This gradient is then used to update the original individual. This process is repeated until the algorithm reaches the allowed number of iterations.
compute a batch of X
3.4 EVALUATION
We define the fitness function based on the attack success rate (ASR) since the objective of the algorithm is to fool image classification systems.
attacks we average the attack success rate values computed on multiple networks simultaneously. Specifically, given K F; neural networks models, / legitimate image, and the corresponding perturbed image /* obtained by applying the sequence of parametrized filters we want to evaluate, we defined the multi-network fitness function as:
In the case of
1 K
Fx(I,
K AS
(3)
4

---

Under review as a conference paper at ICLR 2022
where ASRR represents the attack success rate calculated by querying the k-thh target model: it returns 1 if (I) & Fk 0 otherwise with respect to the Top-1 prediction.
3.4.1 ALLOWED QUERIES
The algorithm works with limited accesses to the victim model. our algorithm the victim model is called every time we have to compute the fitness function. Besides the explicit calls to the evaluation function made in the initialization step and the last step of each outer iteration, we have consider the Ein x Ni calls made by the inner optimization phase (filters' parameters optimization) for each element the outer population. The maximum number of allowed queries can be easily computed as:
QMAX = Nout + Eout X (Nout x Ein X N + Nout)
(4)
The drawback of using evolutionary approach is highly mitigated by the needed reduced number of generations and population size.
Algorithm 1: AGV-mulii-nttwokk algorithm
Input: Image J, classification models, outer population size Nouts inner population size numbem of outer generations Bour, number of inner generations Ein, obj the number of target models we want to attack.
Initialize population P of Nout individuals;
foreach p E do
Evaluate the fitness of by Fk;
end
e=0:
while (e < Eout and FK K < obj) do
Offisringgs {0] for i = to Nout do
Select randomly two parents P1.P2 from P;
crossover(p1. p2);
V. = mutation(y:):
n: = ES ToStoptimi Ean N.n):
Offsprings + (
end
foreach O Offsprings do
Evaluate the fitness by Fx:
end
P selection(P, Offsprings)
+1;
end
return: best filter sequence for image 1;
EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Networks: To validate the proposed method we employed five state-of-the-ar neural networks for image classification as reference models to find the adversarial filter sequences, namely ResNet50, VGG19, DenseNer201, MobileNet and NasNetMobile. To evaluate the effectiveness of the transfer- ability we use as hold-out models two normally trained networks, i.e. Inception V3 and Inception V4, and one adversarially trained network. i.c InceptionResNetV2-ensss
(Tramèr et al. 2018).
Different architectures were chosen in order to explore the generalization capability of the algorithm given that these models are fundamental components of other deep learning models used for object detection and image segmentation. Besides, we decided to use MobileNet and NasNetMobile be- cause they architectures often used in ML-powered mobile apps thanks to their low-latener and lightweight nature which makes them an interesting case study. These models were trained on the large visual ImageNet training dataset (Deng et al. 2009) and they are publicly available.
5

---

Under review as a conference paper at ICLR 2022
Multi-network setup: In the multi-network configuration simultaneously attack multiple deep learning models. More specifically, we study three multi-network setups:
S-NET: includes MobileNet, ResNer50, VGG19, DenseNe1201, NosNetMobile
4-NET: includes MobileNet, ResNet50, VGG19, DenseNet201
3-NET: includes MobileNet, ResNet50, VGG19
Dataset: We performed the experiments on subset of 1000 images from the ImageNet validation dataset. The images were preprocessed according to the requirements of each pre-trained neural network.
Implementations details. The hyperparameters of the outer algorithm were set as follows: Nout = 10, Eout = 10 and mutation probability م 0.5; The hyperparameters of the inner algorithm were set as follows: Nn = 5. Ei = 3. initial learning rate = 0.1 and decay rate = 0.75. These values are the result of preliminary experimental phase conducted to find good trade-off between performance and computational time.
4.2 QUERY EFFICIENCY
Query efficiency considered a key characteristic for generating realistic attacks, As highlighted by Ilyas et al. (2018) a limit on the number of queries result from time limit budget limit, when querying the system costs. Considering the settings used, our system allows a maximum of 1610 queries to the victim model for each network used in the multi-network system. Direct comparisons with other methods are in general difficult due to the differences of the approaches, especially in the case of Lp-bounded modifications. We report the results obtained on the ImageNet dataset by very recent systems that can be considered query-efficient methods working in the hard-label black-box settings: Myas et al. (2018). that is based on an evolutionary strategy, reports that effective attacks can be crafted with 270k queries to obtain the 90% of accuracy; in Li et al. (2020) the authors report that their best system can produce attacks with a good quality in the 76% of cases with 10k queries or in the 98% of cases with 20k queries. In Cheng et al. (2020) the authors report that they can reach the 50% of accuracy with 30k queries, but they need 160k queries to reach the 90%. clear that, comparing these results with our maximum (that varies from 1610 for single network training to 8050 for 5-networks training), AGV-multinetwork is more efficient in all the cases.
4.3 ATTACKS AND TRANSPERABILITY
In this section, we analyze the multi- scenario. According to (Liu al. 2017), if an adver- sarial instance remains adversarial for multiple networks then it is more likely to transfer to other unseen networks as well. Therefore, we leverage the capabilities the AGV single-model by (Baia) et al.) 2021) algorithm to attack multiple neural networks simultancously in order to improve the adversarial robustness and generate adversarial examples with high transferability rates.
We examine the three different multi-network configurations 5-NET, 4-NET and 3-NET described before with filter sequences of length 3, 4, and 5. In this case, we consider a combination of filters to be adversarial if it is capable of misleading all models included in the multi-network setup with respect to the Top-1 predicted class. This is the strongest requirement because we ask the system to find an adversarial filter composition that is able fool all the networks in the multi-network configuration. This is different from attacking an ensemble network: we guarantee that these images (when they are found) surely will fool all the networks used, while this not guaranteed by the ensemble training. For example Xie et al. (2019) showed in their experiments for DIS-FGSM and M-DM--FGSM that the attacks trained with the ensemble reach the 90% ASR just in few cases. Results are reported in Table [T] where the Single-network columns can be considered the baseline results obtained by running the algorithm proposed by Baia et al. (02I) on single image. As expected, attacking multiple networks is a more difficult task than attacking single models. However, since the multi- network adversarial examples are guaranteed to work across all built-in models this reduces the need to run the algorithm for each single network individually. Unsurprisingyy. there is a correlation between the number of filters and the ASR: longer sequences produce more visible and large modifications that enables to guide an image towards adyersarial sample more easily.

---

Under review as a conference paper at ICLR 2022
We also computed the transferability using three test models, namely Inception Inception and the adversarially trained mucptionResnet22ennss.. The results shown in Table 2 In this case, we notice that the multi-network based attacks achieve higher transferability rates compared to the single-model setup.
for both multiple and single model attacks.
Moreover, attacks also mislead InceptionResNett2-ensss sarial samples. This shows that even restricted filter-based adversarial perturbations. This indicates the potential of the proposed method whose goal is to transform image filters into malicious applications.
than 60% of the adver- trained models are susceptible to un-
Table Attack Success Rate (ASR)
Multi-network
Single-network
Setup
5-NET
4-NET
3-NET
MobileNet
ResNet50
VGG19
3filters
44%
50 %
52%
64%
74%
70%
4filters
58%
50%
70%
74%
88%
82%
5filters
68%
66%
76%
78%
96%
86%
Comparisons with similar attack models.
We also compare our algorithm with other existing adversarial attack methods that have similar colorization and filtering characteristics.
SemanticAdv (Hosseini & Poovendran 2018) randomly changes the hue and saturation values of an image while not affecting the shape of objects.
Colorfool (Shahin Shamsabadi et al. (2020) uses image semantics to modify the colors by employing priors on color perception trying. It tackles the limitations of SemanticAdy which has been found to produce unnatural looking images. Edgefool (Shamsabadi et al.) and FilterFool (Shahin Shamsabadi et al. 2021 generate adversarial examples by applying generic image-enhancement filters obtained by means of neural networks, For example, FilterFool
tries to create perturbation that imitates the gamma correction filter. It is important to note that these methods do work in pure hard-label black-box setting because they use the logits information that in general are not exposed and visible to the final user.
ACE (Zhao et al. 2020), ReColorAdv (Laidlaw Feizi 2019), and cAdv (Bhattad et al.) 2019) methods use gradient information in order to optimize color transformation. In particular, we focus on ACE-Insl and ACE-Ins2 which employ two Instagram filters to guide the color optimization towards specific styles of enhancement, namely Nashville and Toaster. Ad- versarial samples generated by the above mentioned methods are reported Appendix
Table 2: Transferability rates
Trained on
5-NET 4f
4-NET
3-NET
Tested on
3f
5f
4f
4f
5f
Inception V3
0.636
0.655
0.617
0.600
0.517
0.575
0.500
0.457
0.578
Inception V4
0.545
0.793
0.705
0.600
0.551
0.757
0.538
0.657
0.657
IncRes V--ens-ayy
0.545
0.655
0.558
0.480
0.517
0.636
0.269
0.514
0.447
Trained on
MobileNet
ResNet50
VGG19
Tested
3f
4f
5f
3f
4f
5f
3f
4f
5f
Inception V3
0.375
0.378
0.410
0.216
0.340
0.312
0.257
0.365
0.348
Inception
0.437
0.540
0.564
0.405
0.477
0.541
0.342
0.439
0.441
IncRes Ve-en-2--yy
0.250
0.297
0.359
0.216
0.250
0.270
0.285
0.243
0.279

---

Under review as a conference paper at ICLR 2022
Table 3: Comparison with similar colorization and filtering techniques
AGV-5-NET 5f
AGV-single 5f
SemanticAdv
Colorfool
Edgefool
ASR-ref avg-TR
68%
96%
88 %
91.7%
98.1%
62.75 %
37.5%
65.45%
47.00%
43.45%
min-TR
55.88 %
27.08%
54%
34.8%
35.7%
(IRV2-ens-adv)
(IRV2-ens-avv)
(Resnet
(Resnet18)
(Resnet18)
Filterfool GC
ACE-Ins1
ACE-Ins2
ReColorAdv
cAdy
ASR-ref
99.9%
99.3%
99.4 %
89.2%
99.83%
avg-TR 34.7%
24.24%
26.31%
17.79%
29.78%
min-TR
29.2%
11.47%
9.9 %
10.77%
28.56%
(Resnet18)
(Inc
V3) (Dense
(Densel2))
In Table 3 we report the Attack Success Rates obtained by crafting adversarial samples on the ref- erence model (ASR-ref) and the average and minimum Transferability Rate (avg-TR, min-TR) with respect to different testing models. The reference model is ResNer50 for all the methods, with the exception of ReColorAdy that used Inception For the minimum values we also report the target network which represents the hardest model to attack. The experiments show that in most cases algorithm achieves better results than the other techniques while using less information (label vs logits).
From the ASR point of view, the AGV-single method performs better than SemanticAdy and Colorfool but it falls behind the transfer rate, while AGV-multi-networkk outperform almost all other systems on the hold-out models. Given the random nature of its approach, the SemanticAdy generates suspicious perturbations that lead to excessively transformed images (people with blue skin or green horses) which can induce misclassification in unseen models more easily. Even though Colorfool tries to limit the adversarial perturbations by using image segmentation to modify the colors within specific ranges, it often produces noticeable, artificial colorization effects. This is mostly due the inaccuracy of the image segmentation techniques that poorly identifies the objects resulting in unnatural colorization patterns, such as skies with pink clouds or dogs half white, half blue. Despite accessing only the final class-label decision of model, AGV reaches higher transferability rate than many other methods relying on richer information for the attack process, such as FilterFool, ACE, ReColorAdy and cAdv. Moreover, we have a great diversity in terms of filter styles, ranging from more bright and colourful to more soft and subtle transformations which are frequently found on many social media platforms, like Instagram. Examples that sucessfully transfer to the Inception -eeeoeeeaeeeteeeee-aaaa illustrated in Figure 2 and B in Appendix A
4.4 STEALTHINESS OF ADVERSARIAL EXAMPLES
We evaluate the stealthiness of the adversarial examples from two perspectives: stealthiness to hu- man perception and stealthiness to defense mechanisms. We measured the human perception by means of most common No-Reference image quality assessment metrics (NR-IQA), such as NIMA, NIQE and BRISQUE Talebi & Milanfar 2018 Mittal et al. 2012 2013). For this analysis, we calculated the average of the normalized difterences between the NR scores on the original images and the corresponding modified images. The results show no significant difference between the scores of clean images and adversarial samples obtained by applying the filter sequence found by the algorithm. Considering the average computed over 12 different experiments that produced about 60k adversarial images, we obtained values in 0.04499, 0.0006), with an average of -0.0144.
For the stealthiness to defense mechanisms we considered well-known detecting and sanitizing tech- niques proposed to counter adversarial attacks. As detection methods we tested Feature Squeezing (FS) (Xu et al. 2018) and detectors based autoencoders and model distillation available in the Alibi Detector library (Van Looveren et al. 2019). Experimental results on CIFAR- 10 dataset show that FS is able to detect less than 10% of adversarial examples as malignant. The autoencoder and distillation based methods were able to reach only 25% and 11 1 detection rate, respectively. The adversarial threshold was inferred by assuming 5% of the clean images outliers. As sanitizing
8

---

Under review as a conference paper at ICLR 2022
(a) OG: bakery
(b) Adv: purse
(c) OG: mouse trap
(d) Adv: birdhouse
(e) OG: Std. Schnauzer
(I) Adv: Mini. Schnauzer
(g) OG: Labrador
(h) Adv: Doberman
Examples of clean images and their corresponding adversarial example. The adversarial labels are obtained by transferring the modified images to the InceptionResNNet2--nssss model.
Figure 2:
techniques we tested jpeg compression, Destylization (Wu et al.) and Instragram Feeeeerileeeeeeeee Removal- Network (Kinli et al. 2021). Preliminary tests indicate that these methods cannot effectively remove the adversarial perturbations produced by combining multiple filters. In the case of jpeg compression obtain, in most cases, an increasing number of attacks.
4.5 DECEPTION ABILITY
An effective attack can be evaluated also with respect to its deception ability, that can be measured by the distance between the original and the assigned class after the modification. To do this we computed the rank of the class of the transformed image inside the class distribution of the original image (descending order with respect to the prediction probabilities): the further away, the stronger the deception is. Similarly, we also examined the rank of the right class the distribution of the modified images in order to check how far away it was moved.
Preliminary results showed that more than 38% of the modified images have been classified with class that in the original distribution was, average, over the 5th place. On the other hand, in more than 28% the right class was placed, on average, over the 5th position in the distribution computed for the filtered images.
CONCLUSIONS AND FUTURE WORKS
In this work we present the algorithm AGV-multi-networt for the optimization of Instagram-stt image filters multi-network setting able to fool classification systems with low cost in term of queries and high transferability rate.
The algorithm was experimentally tested on a subset of the ImageNet validation set. From the testing phase
conclude that: (i) the algorithm shows very good transfcrability rate also in the case of adversarial trained network and with respect to other method producing images with evident artifacts; (ii) the algorithm is able to craft the attacks using very limited number of queries.
There is a big room for improvements that are under study. In particular we aim to exploit the multi- objective fitness function of the original AGV algorithm in order to craft targeted deceptions, move the right classification even further away in the modified class distribution, apply automatic measure for image quality assessment and optimize the attacks also avoid detection methods.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Alina Elena Baia, Gabriele Di Bari, and Valentina Poggioni. Effective universal unrestricted adver- sarial attacks using moe approach. In In Proc of EvoAPPS 2021, 2021.
Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A. Forsyth. Big but imperceptible adversarial perturbations via semantic manipulation. CoRR, 1ess1990..0334,
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In 6th International Conference on Learning Representations, ICLR 2018, 2018.
Minhao Cheng. Simranjit Singh, Patrick H. Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. Sign- opt: A query-efficient hard-label adversarial attack. In International Conference on Learning Representations, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255, 2009.
doi: 10. 109/CVPR 55068488
Yinpeng Dong, Tianyu Pang. Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translationiivaaiian attacks. In Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition, pp. 4312-4321, 2019.
Hossein Hosseini and Radha Poovendran. Semantic adversarial examples. CoRR, abs/1800 1804.0049, 2018. URL http:::://axxi...rr/aaabb///////
C0499
Andrew Ilyas, L. Engstrom, A. Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. ArXiv, htss/804.0885% 2018.
Furkan Kinli, Baris Özcan, and Furkan Kiraç. Instagram filter removal on fashionable images. CoRR, abs/2104.05072, 2021. UtLhttts::/ http://:////axii.oor//oa//////// http://bs///04/// 05072
org.
Cassidy Laidlaw and Feizi. Functional adversarial attacks. In NeurlPS, 2019.
Huichen Li, Xiaojun Xu, Xiaolu Zhang, Shuang Yang, and Bo Li. Qeba: based blackbox attack. In 2020 IEEE/CVF Conference Computer Vision and Puttern Recogni- tion (CVPR), pp. 1218-1227, 2020. doi: 10.109//CV444660020000001133
boundary-
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1778-1787, 2018.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. Sth International Conference on Learning Representations, ICLR 2017, 2017.
Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assess- ment in the spatial domain. IEEE Transactions on Image Processing, 21(12):4695-4708 2012. doi: 10. 109/T1P.2012.2221405
Anish Mittal, Rajiv Soundararajan, and Alan C. Bovik. Making "completely blind" image qual- ity analyzer. IEEE Signal Processing Letters, 20(3):209-212, 2013. doi: 10.1109/LSP.2012.. 2227726.
Seyed-Mohsen Moosavi-Dezfooli,, Ashish Shrivastava, and Oncel Tuzel. Divide, denoise, and de- fend against adversarial attacks. arXiv preprint arXiv:1802.06688 060200608.00 2018.
Ali Shahin Shamsabadi, Ricardo Sanchez-Matilla, and Andrea Cavallaro. adversarial colorization. In Proc of CVPR 2020, 2020.
Colorfool: Semantic
Ali Shahin Shamsabadi, Changjae Oh, and Andrea Cavallaro. Semantically adversarial learnale filters. IEEE Transactions on Image Processing, 30:8075 8087, 2021. doi: 10.1109/TIP.021..
31 12290.
10

---

Under review as a conference paper at ICLR 2022
Ali Shahin Shamsabadi, Changjae Oh, and Andrea Cavallaro. Edgefool: an adversarial image hancement filter. Proc of ICASSP 2020.
H. Talebi and P. Milanfar. Nima: Neural image assessment. IEEE Transactions on Image Processing, 27:3998-400 2018.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Drew McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Conference on Learning Representations, ICLR 2018, 2018.
Arnaud Van Looveren, Giovanni Vacanti, Janis Klaise, Alexandru Coca, and Oliver Cobb. Alibi detect: Algorithms for outlier, adversarial and drift detection, 2019. URL URL https://g/thbb.
Yajie Wang. Shangbo Wu, Wenyi Jiang, Shengang Hao. Yu-an Tan, and Quanxin Zhang. Demiguise attack: Crafting invisible semantic adversarial perturbations with perceptual similarity. arXiv preprint arXiv:2107.01396 2021.
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In International Conference on Learning Representations, 2020.
Zhe Wu, Zuxuan Wu, Bharat Singh, and Larry Davis. Recognizing instagram filtered images with feature de-stylization. Proc. of AAAI 2020, 14:12118-2
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730-2739, 2019.
Weilin Xu, David Evans, and Y. Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. ArXiv, abs/ ftss/1044.1155, 2018
Zhengyu Zhao, Zhuoran Liu, and M. Larson. Adversarial color enhancement: Generating unre- stricted adversarial images by optimizing color filter. In Proc. of BMVC 2020.
Zhengyu Zhao, Zhuoran Liu, and Martha Larson. Adversarial robustness against image color transformation within parametric filter space. CoRR, abs/2011.00699) 2020.
A
APPENDIX
We report different adversarial examples generated by state-of-the-art methods and similar systems.
(a) OG: Std. schnauzer
(b) OG: Mini. schnauzer
(c) OG: Mini. schnauzer
(d) Adv: Mini. schnauzer
Figure 3: Examples of different adversarial perturbations styles crafted on the same image by AGV- multi-network with different configurations.
11

---

Under review as a conference paper at ICLR 2022
(a) Adv. samples crafted by SGM on ResNet- 152
(b) Zoom on the adv sample
(c) Adv. samples crafted by SGM on DenseNet-2201
(d) Zoom on the adv sample
Figure 4: Advesarial samples crafted by SGM (Wu et al. 2020 method. The adversarial perturba- tions creates visible artifacts in the image.
12

---

Under review as a conference paper at ICLR 2022
(a) Adv. samples crafted by AGV-mulli-network
(b) Zoom on the adv sample
(c) Adv. samples crafted by AGV-multi-netwer network
(d) Zoom on the adv sample
Figure 5: Examples of adversarial samples generated by AGV-multi-networkk The adversarial per- turbation does not create artificial patterns in the image.
13

---

Under review as a conference paper at ICLR 2022
(a) Original
(b) Clarendon
(c) Gingham
(d) Juno
(e) Reyes
(1) Lark
(g) Hudson
(h) Slumber
(i) Stinson
ii) Rise
(k) Perpetua
Figure The effects produced by applying filters individually with default paramters.
14

---

Under review as a conference paper at ICLR 2022
(a) Clean imange
(b) SemanticAdv
(c) Colorfool
(d) Clean image
(e) Colorfool
Clean image
Edgefool
(h) Clean image
(i) Filterfool
Figure 7: Adversarial examples generated with other filter-based and colorization systems.
15

---

Under review as a conference paper at ICLR 2022
BELSER
YUNN
2
HASAN
44
44
44
44
44
(a) ACE- Ins with color style guidance from Instagram filters
PARS
(b) ReColorAdy adversarial examples
(c) cAdv adversarial examples
Figure 8: Adversarial examples generated with other filter-based and colorization systems.
16


Reviews:
[{"review_id": "qDYdQgSrleH", "reviewer": "Reviewer_PWpF", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**\n1. An interesting research direction is explored and natural-looking attacks are proposed. \n2. The proposed family of attacks is a black box and more applicable in the real world.\n3. The attacks seem to use fewer queries making them more effective. \n4. Comprehensive set of experiments are performed to show the effectiveness.\n\n\n**Weaknesses**\n1. One interesting thing is that the attacks produce natural-looking artifacts. However, it would be interesting to see some fail cases.\n2. A comparison of the number of queries used by these attacks vs. other black-box attacks should be added. \n\n**Additional Recommendation**\n1. It would be interesting to see if Instagram filters can also be used to improve privacy, something similar to [1].\n\nReferences\n\n[1] Unlearnable Examples: Making Personal Data Unexploitable \n", "summary_of_the_paper": "This paper introduces a new family of black-box adversarial attacks. These attacks are constructed by composing Instagram filters-based transformation in the input space. Perturbations in the input space are unrestricted and large but only produce natural-looking artifacts. The input is transformed with 10 different filters. Each filter has two variables: alpha to control the intensity and s to control strength. To get the optimal values of these parameters, an evolutionary approach is used. Comprehensive experiments are performed to show the efficacy of the attacks. ", "summary_of_the_review": "This paper introduced an interesting set of black-box attacks and showed their utility through comprehensive experiments. It seems like a good paper. However, I am not very familiar with recent work on black-box attacks. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "_cEXxrjuiL", "reviewer": "Reviewer_eN8o", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strengths\n- Addressing an important problem: hard-label black-box setting is a more practical attack setting compared to existing white-box or soft-label black-box attacks.\n- Combining evolutionary algorithm and model ensembling to achieve good black-box attack and transferability performance.\n\n\n# Weaknesses\n- The intellectual delta from existing works is low. As also identified by the authors, the idea of using image filters is not new--many existing works (SemanticAdv, Colorfool, Edgefool, Filterfool, ACE, etc) have already adopted such a concept to generate benign-looking AEs. The difference is that prior works assume knowledge on the confidence scores or even model internals. The authors address this by using evolutionary algorithms to find the best filter parameters, which is also a straightforward solution and the results are not surprising. To improve this, the authors may consider comparing different evolutionary algorithms such as GA, PSO, to systematically understand the tradeoff between the different methods.\n- No evaluation on the AE stealthiness. Since the benefit of using image filters are the attack stealthiness as the generated AEs are intended to look benign. However, I cannot find any stealthiness evaluation in the paper. There are only a few images of the generated AEs shown in the paper. But that is not a systematic evaluation. There are two directions to address this. One solution is to calculate image perceptual metrics (such as those used in GANs [1]) of the AE. Another is to conduct a user study on the AEs to ask participants about the suspiciousness. For both solutions, random sampling of the successful AEs is required to ensure no biases in the selection.\n- The good transferability mostly comes from the model ensembling as can be seen from the much lower transferability of AVG-single 5f in Table 3. \n\n[1] An empirical study on evaluation metrics of generative adversarial networks, https://arxiv.org/pdf/1806.07755.pdf", "summary_of_the_paper": "The paper proposes a black-box attack method that uses an evolutionary algorithm to find the best image filter parameters that can achieve untargeted attacks. Model ensembling is also used in the AE generation to improve attack transferability. The proposed method is compared to other similar image filtering-based AE generation methods. Results show that the proposed method is able to outperform most of the related works in terms of transferability. ", "summary_of_the_review": "The paper studies an important problem. However, the current evaluation in the paper is still lacking. More systematic evaluations on the evolutionary algorithms and stealthiness are necessary.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "JDc8UcmH7C", "reviewer": "Reviewer_chwU", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Review of \"ONE FOR MANY: AN INSTAGRAM INSPIRED BLACKBOX ADVERSARIAL ATTACK\"\n\nThis paper presents a genetic algorithm (GA)  based method to generate adversarial images, i.e., images perturbed in a way such that it leads to misclassifications in a number of image classification models.\nInvestigation of GAs in the context of adversarial image generation task is a novel and interesting one.\nIt's however difficult to see the connection of this with Instagram filters. Why is a sequence of filtering required (Eqn 2) via composition of filters?\n\nMoreover, more details need to be included on the GA process. How is a particular state represented (each row indicating filter parameters)? Details need to be included on what happens during the cross-over and the mutation operations? Do cross-over operations exchange filter parameter values? Does all the filters use the same number of parameters?\n\nThe paper mentions about \"gradient towards a better solution\". However, GA-based approaches don't require computing gradients.\n\nAnother concern is the time it would take to generate one adversarial example. Evaluation of the fitness function of each state needs to be evaluated by making predictions\nwith the target models, which indicates that executing GA in this case is going to be time consuming.\n\nFrom a novelty perspective, the paper is quite limited because algorithm is also based on the AGV paper (Baia et. al. 2021). The only difference is that multiple target networks are used. It's not clear why (Baia et. al. 2021) wasn't used as a baseline. Moreover, there is no rational explanation provided on why zooming in on an AGV generated image wouldn't produce the visible artefacts --- what characteristics of the proposed approach is likely to ensure this?  \n", "summary_of_the_paper": "This paper presents a genetic algorithm (GA)  based method to generate adversarial images, i.e., images perturbed in a way such that it leads to misclassifications in a number of image classification models.\nInvestigation of GAs in the context of adversarial image generation task is a novel and interesting one.\n\n", "summary_of_the_review": "The strengths of the paper (extensive experiments) hasn't been able to outweigh the weaknesses (limited novelty, lack of AGV baseline, a seemingly slow approach). ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "6Sq9-V61LBx", "reviewer": "Reviewer_1MTN", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\nThis paper was clearly written and well organized with interesting motivations. Such Instagram-style filters are commonly used in daily life and might easily achieve lower suspicion than conventional techniques (large l_p perturbations). In addition, the authors compared a lot of other \"unrestricted attacking\" methods and demonstrated AGV can achieve higher transferability with less queries.\n\nWeakness:\nExperiments are not complete.\n\n(1) The paper claimed, \"our goal is to find one adversarial perturbation per-image that can fool many deep learning models\". Therefore, when evaluating the performance of methods, it is necessary to present the worst performance on one model besides the average one. (Table 3) Readers can learn what model structures are harder for unconstrained adversarial attacks.\n\n(2) It is unclear to me that the comparison between different methods is fair. In table 3, it seems the objective of AGV-5-NET 5f is to attack 5 different models. But I am not sure if other methods are also trained for attacking 5 different models.\n\n(3) In table 2, the test model is limed to InceptionV3, InceptionV4, adversarially trained InceptionResnetV2-ens-adv [1], one potential improvement for this paper is to test more model architectures (e.g. ViTs). Also, details of InceptionResNetV2-ens-adv are missing (how is it adversarially trained?).\n\n(4) I am not sure how to replicate this paper. To be specific, how does the inner algorithm in 3.3.2 perturb the original image? What is the initial learning rate and decay rate in the inner algorithm? I highly recommend the authors upload the codes or include more details for the methods.\n\n\n\nVisual examples are limited.\nThe authors claimed, \"our filter composition cannot be distinguished from any other filter composition used extensively every day to enhance images\". However, the paper only includes several visual examples to demonstrate that. I am not sure the proposed methods can achieve low suspiciousness without any human studies or quantitative analysis. In addition, ten image filters used in the paper should also be visualized. \n\nI think the paper can be largely improved if previous issues are solved.\n\nQuestions:\nHow does the proposed method perform in terms of computational efficiency compared to others?\nIs it possible to control the tradeoff between effectiveness and distortion of the image (e.g. constraining the parameters)?\n\nOther comments/suggestions:\nThe authors should add a section of related works and summarize some important papers in the adversarial ML community e.g. [2,3,4,5]. \n\n[1] Ensemble adversarial training: Attacks and defenses, Tramer et al., ICLR 2018\n\n[2] Explaining and harnessing adversarial examples, Goodfellow et al., ICLR 2015\n\n[3] Intriguing properties of neural networks, Szegedy et al., ICLR 2014\n\n[4] Adversarial examples in the physical world, Kurakin et al., CoRR 2016\n\n[5] Transferability in machine learning: from phenomena to black-box attacks using adversarial samples, Papernot et al., arXiv 2016\n", "summary_of_the_paper": "This paper proposed a nested evolutionary algorithm to generate adversarial perturbations under the black-box settings. Such perturbations are composed of various image filters inspired by Instagram and can simultaneously attack multiple neural networks. They claimed that the attacks were semantically robust and had a low cost of queries.\n", "summary_of_the_review": "The idea in this paper is very interesting and novel to the adversarial machine learning community, however, issues on experiments and presentations prevent me from accepting it.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "2ThK61iJFLE", "reviewer": "Reviewer_Cohx", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1) Interesting evolutionary strategy to craft strong transferable attacks using image filters.\n2) Adversarial examples look only as filtered clean images with no artificial patterns as in other gradient based methods.\n\nWeaknesses:\n1) Potentially weak attack. Judging by the examples shown in the paper, the adversarial images are mislabeled to a class which is very close to the ground truth (for instance, from “standard schnauzer” to “mini schnauzer” or from “Labrador” to “Dobermann” ) indicating that the attack strength is low. Is there any way to fix this? Can you make an attack more semantically strong?\n2) Minor grammatical errors (e.g. “simoultaneously”)\n", "summary_of_the_paper": "The paper proposes a new way to craft adversarial examples using Instagram inspired filters by means of evolutionary algorithms. The resulting adversarial attacks do not have recognizable artificial patterns as in other methods and show competitive performance including a difficult black-box scenario. \n", "summary_of_the_review": "Although the attack looks indistinguishable from just a filtered image, it seems that the strength of the attack is questionable, in most cases images are mislabeled to a class which is very close to ground truth. Unfortunately, it undermines the whole purpose of the method, its practicality and effectiveness. Therefore, I tend to be on the rejection side. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work proposed a nested evolutionary algorithm to choose image filters and filter parameters for back-box attacks, with the emphasize of high transferability. 

After reading the manuscript, the comments of reviewers and the authors' responses, I think the main issues of this work include: 
1. The limited novelty of the main idea, since there have been many filter-based attacks, and this work is very close to an existing work;
2. The solution is not new, since the evolutionary method is also well adopted in adversarial attacks; 
3. Many many black-box attack methods are not cited and compared, though the authors argued that their perturbation upper bound are different such that they cannot be compared, which is not convincing; 
4. The claimed high transferability is not well explained, maybe due to the model ensemble (as indicated by reviewer eN8o). Besides, many existing works that studied transferability are not cited and compared. 
5. Experiments are inadequate. The authors added some results in the revised version, but the current shape is still not ready for publication. 

Thus, my recommendation is reject. Hope the reviews can help to improve this work in future.
Decision: Reject