Morié Attack (MA): A New Potential Risk of Screen Photos
Authors: Dantong Niu
Ruohao Guo
Yisen Wang
Venue: NeurIPS 2021 Poster (2021)
Keywords: Moiré effect
Adversarial attack

Abstract: Images, captured by a camera, play a critical role in training Deep Neural Networks (DNNs). Usually, we assume the images acquired by cameras are consistent with the ones perceived by human eyes. However, due to the different physical mechanisms between human-vision and computer-vision systems, the final perceived images could be very different in some cases, for example shooting on digital monitors. In this paper, we find a special phenomenon in digital image processing, the moiré effect, that could cause unnoticed security threats to DNNs. Based on it, we propose a Moiré Attack (MA) that generates the physical-world moiré pattern adding to the images by mimicking the shooting process of digital devices. Extensive experiments demonstrate that our proposed digital Moiré Attack (MA) is a perfect camouflage for attackers to tamper with DNNs with a high success rate ($100.0\%$ for untargeted and $97.0\%$ for targeted attack with the noise budget $\epsilon=4$), high transferability rate across different models, and high robustness under various defenses. Furthermore, MA owns great stealthiness because the moiré effect is unavoidable due to the camera's inner physical structure, which therefore hardly attracts the awareness of humans. Our code is available at https://github.com/Dantong88/Moire_Attack.

Moiré Attack (MA): A New Potential Risk of Screen Photos
Dantong N Ruohao Guo2
Yisen Wang
'Department of EECS, University of California, Berkeley "oolleee of Information and Electrical Engineering. China Agricultural University KKey Lab. Machine Perception, School of Artificial Intelligence. Peking University Innttittee for Artificial Intelligence, Peking University
Abstract
Images, captured by a camera, play a critical role in training Deep Neural Net- works (DNNs). Usually. we assume the images acquired by cameras are consistent with the ones perceived by human eyes. However, due the different physical mechanisms between human-vision and computer-vision systems, the final per- ceived images could be very different in some cases, for example shooting on digital monitors. In this paper, we find a special phenomenon in digital image processing, the moiré effect, that could cause unnoticed security threats to DNNs. Based on it, we propose a Moiré Attack (MA) that generates the physical-worke moiré pattern adding to the images by mimicking the shooting process of digi- tal devices. Extensive experiments demonstrate that our proposed digital Moiré Attack (MA) is a perfect camouflage for attackers to tamper with DNNs with a high success rate (100.0% for untargeted and 97.0% for targeted attack with the noise budget = 4), high transferability rate across different models, and high robustness under various defenses. Furthermore, MA owns great stealthiness be- cause the moiré effect is unavoidable due to the camera's 's inner physical structure, which therefore hardly attracts the awareness of humans. Our code is available at com Saam/DDDnoon@@@/irr__ettee
Introduction
Deep Neural Networks (DNNs) present huge potential in solving varies of vision tasks such as image classification [19]. instance segmentation [18), and object detection (32]. While such algorithms bring huge productivity and greatly facilitate the daily life of humans, security risks also arise. It was first revealed by Szegedy et al. [38] that small and imperceptible to human eyes perturbation on the
inputs can totally fool a DNN model and dramatically alter the results [14]. Since then, large amounts
of studies [14 24 22 23 10 29
11 have focused crafting adversarial examples to mislead DNNs to make wrong predictions which is called adversarial attack.
In the application of DNNs, assumption are usually assumed that image samples used in the test phase should follow the same distribution of the training data. However, in real-world applications, the image samples are usually captured by various sensors (cameras, scanners, etc.) in different conditions (light, angles, etc.). Such differences are reasonable to human eyes while may confuse a seemed robust DNN. Especially, under some situations, the strange distortions beyond the commonly used data augmentation methods may severely decrease its accuracy. One of such non-typical distortion we focus in this paper is moiré pattern, artifact caused by interference of overlapping lines, grids
Work was done during an internship Peking University. Corresponding author: Yisen Wang (yisen. wang @ pku.edu.cn)
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

and patterns, Moiré effect commonly occurs in the image when the frequency of the details in a scene exceeds the sensors' resolution 36.. Despite both human observers and image-capture sensors view the same image, the human perceives normal image while colorful strange waves (moiré effect) are generated as a by-product by the sensors when the camera interacts with the frequent details of the objects (as shown in Figure [ (a)). The moiré effect is a typical example showing such difference between the human eyes and camera sensors. To be specific, in terms of human eyes, three different types of cone cells respond differently to light of different wavelengths, the received different color signals the cone cells allow the brain to perceive a continuous range colors. However, the color vision perceived by the digital sensor called color filter array (CFA) receives color discretely. The CFA is composed of many tiny color filters arranged periodically, thus the camera samples the color signals either discrete intervals or locations. Moreover, the human observer does not even know the existence of moiré patterns for robotic observers.
VIVRE DECOUVRIR
S'EPANOUR
(b)
Figure I: (a) Moiré pattern in the physical life; (b) Potential security risk brought by moiré pattern. Moiré pattern disturbs the normal shooting of images and has drawn the attention of many photog- raphers and electronic screen manufacturers. Especially, The NTIRE challenge on example- based demoiréing organized every year remove moiré pattern in imagesfl Simultaneously, we are wondering: 1) whether the above-mentioned difference between human eyes and image-capture sensors can be a potential physical risk to DNNs? 2) if can be maliciously utilized by allackers to compromise the DNN-based applications? For example, objects with frequent stripes or lines (Figure (a)) may produce moiré when recorded by camera and then lead a wrong classification. Another more common real-world scenario is illustrated in Figure (b): an autonomous car is required to make real-time predictions of camera-captured images. Since the LCD monitors are now broadly existing on the streets (traffic signs, advertisements, etc.), the image captured by the sensors is highly possible to include a moiré pattern, which may trigger the subsequent false predictions of the detection and recognition system of the self-driving car, incurring catastrophe.
In this work, we find that DNNs are vulnerable the moiré pattern and be easily fooled make the false prediction (the corresponding experiments are shown in Section 3.T). This demonstrates the effectiveness of the moiré pattern as potential physical-worke attack. Then we propose a Moiré Attack (MA) by mimicking the shooting process of the camera when taking images on the LCD monitor. From the perspective of attackers, the moiré pattern can be a perfect camouflage of the adversarial perturbations. Especially, the proposed Moiré Attack is more controllable and enables the attackers to deliver the targeted attack. While from the perspective of humans or supervisors, few of them pay attention to the moiré pattern because of its unavoidability in the physical world. In summary, the contributions of our work are listed as follows:
We first discover and analyze the potential security threat of the moiré artifacts DNNs. Due to the mechanism of the camera's 's inner property to generate images, moiré pattern is unavoidable, which make the attack stealthy.
We propose Moiré Attack (MA) by mimicking the shooting process of the camera sensors, which gives the attackers more freedom and controllability to tamper with DNNs.
We perform comprehensive experiments to evaluate the proposed MA, which has high attack success rate and transferability across the different victim models. In addition, it possesses high robustness that resistant to many extant image transformation methods.
Mooe information about the challenge is here: http:://tww: vision. ee. wtw..ttzzecco chabz.cc/ntire0////

---

2 Related Work
2.1 Adversarial attacks
Adversarial attack is to generate adversarial examples by maximizing the classification error of the victim model [38]. It can be applied either in digital setting or in physical-wood woolld setting.
Digital attacks. Based on the attacker's ' purpose, can be divided into the targeted attack and the untargeted attack. Meanwhile, according to the information the attacker has owned, it can also be divided into white-box, black-box and gray-box attack [24].
white-box attack, information about the whole internal structure of the victim model is available and utilized by the attacker, most of them are combined with the optimization strategy and solved as an optimization problem. For example, represented as the basic gradient-based attack methods, FGSM and FGSM series (I-FGSM, BIM, and etc.) 14 22 23 TO [9] use the gradient of classification loss with respect to the inputs as perturbations to disturb the classifiers. By contrast, in black-box attacks, attackers only know the input and final output of the victim model. In such cases, they usually construct a substitute model to simulate the victim model which is called transfer attack 38 22 model to generate corresponding attacks (5] [2]22] 2)
33
40 39
query the victim
Physical attacks. In terms of physical attack, Kurakin et al. 23 first showed that, by printing and recapturing using a cell-phone camera, digital adversarial examples can still be effective. However, follow-up works had found that such attacks are not easy to realize under physical-world conditions due to viewpoint shifts, camera noise, and other natural transformations []. Strong physical-world attacks require large perturbations and specific adaptations over the distribution of transformations, including lighting, rotation, perspective projection, etc. Thus physical-world attacks need to generate large perturbations increase adversarial strength, and it is always challenging to produce both effective and stealthy perturbations. Previous works proposed either controlling the perturbation into small area or camouflaging the perturbation into target stealthy styles [3
21]
In this paper, corresponding to the scenario discussed in Figure D we propose to use moiré pattern as adversarial perturbation intuitively. Different from previous physical attacks which achieve the adversaries by manipulating the input, the implementation of the proposed Moiré Attack is achieved by mimicking the physical shooting process of the camera. Thus unlike previous adversarial attacks aiming to conduct stealthy adversarial examples, our proposed attack based on moiré patterns even totally unaware by human observers.
3 The Proposed Moiré Attack
In this section, we first investigate the moiré effect and its threat DNNs in the physical world. Then, we formulate the problem and describe the implementation details of our proposed targeted and untargeted Moiré Attack.
3.1 The investigation of moiré pattern
Moiré effect. Moiré pattern is large-scale interference phenomenon. It is the perception of a distinctly different third pattern caused by the inexact superimposition of two similar patterns. moiré pattern presents different shapes (ripples, waves, and wisps of intensity variations) and frequencies when the two components move relative to each other. When the degree of their misalignment increases, the frequency of the pattern may also increase (as shown in Figure (a)).
Despite almost never being seen in nature, the occurrence of the moiré pattern is ubiquitous in real photographing. When using the camera or other digital devices to capture scene or object, if the repetitive details (such as lines, dots, etc.) within the scene exceed sensor resolution, the camera produces strange-look patterns. Moiré pattern can be easily found when photographing daily objects around us such as all kinds of fabrics (jackets, towels, shirts, and curtains), ttripe-decoann architectures, various display screens and even straight hairs, shown in Figure (a). In other cases, especially when taking photos on LCDs, the moiré pattern is unavoidable because the process of displaying and capturing image discrete in digital imaging. In detail, the digital display is composed of many pixels. The pixel grid is further divided into single-color regions for either displaying or sensing the color. As most displays and aaqeaaacuiiitiinn systems cannot display or sense the different color channels at the same site, color is typically represented by subpixel, including several
3

---

component intensities such red, green, and blue, in which the intensity of each pixel is variable. The pixel (composed of subpixels) appears single color to the human eyes because of blurring by the optics and spatial integration by nerve cells in the eye. However, the subpixels are visible when viewed by a high-resolution camera sometimes appear with moiré patterns. Cameras perceive the color information by CFA, which filters the light by wavelength range (as shown in Figure 2 (b)). The image perceived by CFA is called a raw image, then demosaicing is used to recover the raw image into full-color image. In the process of image processing, the sample of color information is discrete, resulting in moiré patterns overlaid on the final image. With the variations in position of camera, types of cameras, the moiré patterns appear the images always diverse.
Incomine
Fllter layer
Nerooar
padiera.
Rositing pattern
(a)
Figure 2: (a) Generation mechanism of moiré pattern. The upper line basic stripes, the lower are five generated moiré patterns by overlapping them with different frequencies (the frequency increases from left right). (b) Bayer pattern used in single-chip cameras.
Threat to DNNs. We consider the unavoidable moiré pattern generated in the shooting may become a physical threat to DNNs that leads to wrong predictions. For further exploration, we conduct the following experiment. We adopt different LCD displays: Outdoor LCD display, Sony TV display, large display and Dell computer monitor. In terms of the cameras, we use Google Pixle 4, Sony Camera, and Huawei Pro20. For each type of digital display, use all the cameras to take 20 photos of each. The photos are taken from several angles: 30 355, 60% 75 90 105%, 130", and 145%. The photos taken the display by the camera and the original digital images are both feed into DNNs to make predictions. Some of the results are shown in Figure 3 It indicates that moiré pattern can be a potential security risk in real- col-w scenarios when we use digital devices take images on LCD monitors. The irregular pattern may trigger DNNs to make false predictions or be maliciously utilized by attackers as camouflage to deliver digital moiré attacks. the next part, we try to use the moiré pattern to further craft the digital attack by implementing its generation process.
Angle
Outdoor LCD
TV Sereen
Large Screen Display Computer Monitor
45
90
133
Figure 3: The threat of moiré pattern to DNNs. Red frame represents a successful attack where moiré pattern triggers DNN to make false prediction, while the green frame represents the failed one.

---

3.2 The formulation of Moiré Attack
Preliminaries. Given a clean image 2 E Rd with the ground truth Yeruth, a DNN classifier f E + [L.....k] which maps the image data to a discrete label classes, and target class Yado F Utruth for the targeted attack. The goal is to find an adversarial example x for the clean restricted by Lp norm:
image that leads f(=") + Ytruth or f(x") = Yadv- Typically,
||0" =lp
where denotes the perturbation budget.
In this work, we generate the adversarial examples by mimicking the shooting process of camera to take photos LCD. The process be g(r, 6, k), where is the sensor noise, & denotes the other parameters. The goal our digital Moiré Attack is optimize the sensor noise 5 to craft the adversarial images that leads f(g( 5, x)) of Utruth (untargeted attack) or [g( 6, к)) = Jado (targeted attack), where x = g(x, 5, k). It should be noted that different from most of the digital adversarial attack methods, the moiré pattern is an unavoidable physical phenomenon, which means people tend to consider it reasonable even the moiré distortion relatively large. Based this, the Lp norm restriction is unnecessary for the generated examples with the moiré pattern. However, for comparison, we still use Loc norm in our attack process and finally find that the proposed Moiré Attack is budget-free, which a great property of the Moiré Attack.
differentiable transformation that denote as
As mentioned ahove, the aim of Moiré Attack is find sensor noise during the shooting process so that induces the classifier to make the wrong predictions. To solve the problem, we reformulate optimization problem, and objective is:
min Ladu (x", Struth); where x² g 0,
s.t. |001 S.;
where g(x, 6, x) denotes the differentiable process of simulating the generation of moiré pattern, the sensor noise of the digital image-capture device. We calculate the gradients during the backward propagation find the suitable craft the adversarial examples. The pipeline of the proposed Moiré Attack is shown in Figure
Rasampling on LCD
Bayer CFA
Demaicing
Output
Input
Neat (154)
Ned 8L22
Sensor moise
Updately by back propagation
CNNN
Figure 4: The pipeline of the proposed Moiré Attack (MA). To generate the moiré pattern, the input image is first fed into the yellow module which mimics the shooting process of taking photos on LCD monitors in which iterative sensor noise ó is added in the step of Bayer CFA. The output image with moiré pattern is then fed into CNN to make a prediction where backpropagation is conducted to iterate the sensor noise 5 that misleads the CNN make wrong predictions.
Adversarial loss. We use cross-entropy loss as the adversarial loss Lado(-) ()) for Moiré Attack, is defined as:
(og(p((=*)) log(Py (x*)) for targeted attack
for untargeted attack.
Ladv
(2)
5

---

where p(-) is the probability output (softmax on logits) of the target model f with respect to class Daddo or ytruth- By minimizing loss Ladv. Moiré Attack finds an optimal sensor noise to simulate the image capturing process on the LCD of digital devices.
3.3 The implementation of Moiré Attack.
In our Moiré Attack, we strictly follow the process of the image display on a LCD and the pipeline of optical image capture and digital processing of the camera or smart phone. The pipeline is similar to [27 44 and can be summarized the following steps. The complete pseudo-code for Morié Attack
shown in Appendix A.
Resize the image the size of the LCD monitor. Before an image is displayed on an LCD monitor, it should be resized to a suitable size to cater to the resolution of the LCD device. In our paper, we denote the size transformation parameter as a. Section 4.5 relationship of the generated moiré pattern and the parameter a.
we further explore the
2) Resample the input RGB image into a mosaic RGB subpixels. Image displayed on the LCD is spatially resampled to subpixels. In our experiment, we model the RGB pixels as 9 subpixels [R, G, B; R. G, B; R, G, BJ. It is shown that this step causes the final images to be darker.
3) Apply random projective transformation on the image. In order to simulate the different relative positions and orientations when capturing image the LCD, we rotate the image displayed on the LCD with random angle y, in our experiment, y is in the range from -45 to 45". In addition, the radial distortion function is used simulate the lens distortion.
4) Resample the image using bayer CFA to simulate the raw reading of the camera sensor. In digital imaging, a color filter array (CFA) or color filter mosaic (CFM) is a mosaic of tiny color filters placed over the pixel sensors of an image sensor to capture color information [30). The most commonly used CFA is Bayer CFA (as shown in Figure 4 The Bayer pattern (also called RGGB filter) is in a size of 2 x 2 and measures the green image on a quincunx grid (half of the image resolution) and the red and blue images rectangular grids (quarter of the image resolution) 225
5) Add the perturbation simulate the senor noise. To simulate the sensor noise, Gaussian noise is used in previous work [27 44.. Here we denote the sensor noise as 5 with a Lox budget e and optimize through the back propagation of the DNNs.
6) Apply demosaicing and denoising. Demosacing is the inverse processing of mosaicing. It is used reconstruct a full-color image from the incomplete color sample output from image sensor overlaid with a color filter array (CFA). To reconstruct the image from the data collected by the CFA, we use bilinear interpolation in this work. Finally, we denoise the image with the standard denoising function provided by OpenCV. Until now, an image with the moiré pattern is generated.
Experiments and Evaluation
4.1 Experiment setup
The proposed Moiré Attack is implemented by Pytorch on the NVIDIA Tesla V100 GPU.
Dataset. Since ImageNet is a large and comprehensive dataset, we conduct experiment on ImageNet g validation dataset and randomly select 5000 images which can be correctly classified by the victim model as the clean examples.
Victim model. We use Inception V3 37 the victim model for all the experiments. To analyze the transfcrability of Moiré Attack, we use Resnet34 [19], Resnet50 [19], Densenet121 [20). VGG16
351 and VGG19 335 evaluate the generated adversarial examples.
Baselines. To evaluate the robustness of Moiré Attack, different defense methods (Image Transfor-
mation (IT) (15), JPEG compression [4)] Pixel Deflection [II] Feature Squeezing (2) are adopted.
For comparison, we compare our proposed Moiré Attack with: PGD 28 BIM 23), and MI-FGSM
10 under the Loc setting, and C& W 4 under the La setting.
Metrics. We use the success rate (Suce (%) to evaluate the attack ability of our method, which is the proportion of the successful attacks among the total number of test images.

---

4.2 The effectiveness of Moiré Attack
To evaluate the effectiveness the proposed Moiré Attack, we conduct the targeted and untargeted Moiré Attack. To exclude the effect of rotation and dim light, we also test the rotated and dim images under the same setting. The generated examples and details are shown in Figure 3 and the attack sucessful rate is shown in Table T From the results, we can see the processing of rotation and dimming hardly change the predictions of the victim model, which means DNNs are relatively robust against such common transformations, For targeted attack. the generated adversarial examples are shown in Figure 5 (a) (the shown the figure is set to 4). The targeted attack class is set to "hen". From the results, the success rate reach 97.0% when
4. With the increase of the success rate of attack increases. For untargeted attack, the generated adversarial examples are shown in Figure (b) (the shown in the figure is set to 2), the success rate reach 100% with small noise budget. In the following ablation study (Section 4.5). we further explore the influence of the noise budget in the perspective of perception human eyes, which presents another great property of the proposed Moiré Attack the budget-free sensor noise can be a perfect camouflage of the attack. that the generated adversarial example visually natural in the sense of an physical attack, its visual rationality can be confirmed by the comparison with other physical attacks in Appendix B.
From Figure
Table 1:
Success rate of Moiré Attack.
Targttdd MA
Untargeted MA
Attack
Rotate
Rotate Dim
2
6
2
8
Suce
0.122
0.163
0.876
0.970
0.990
0.995
1.000
1.000
1.000
1.000
S19
Clean
JARK stark 13.5%
01.0%%
Ambalanee
Adv
Willet
(a) Targeted MA
(b) Untargeted MA
Figure Adversarial examples generated by targeted (a) and untargeted (b) Moiré Attack.
4.3 Robustness analysis
Under simple median value normalization. During the real shooting process, the shoot image with moiré pattern is darker than the original digital images (the rationality of the darkness is discussed in Appendix C). In our experiment, adversarial example and then re-test the success rate of the Moiré Attack. We set the mean value of the final adversarial examples the same the clean image by subtracting their difference. We the noise budget as 2, 4, 6, and 8. The attack success rate is shown in Table 2, we can see MA is relatively robust such mean value processing.
perform mean value normalization brighten the generated
Table 2: The success rate of untargeted MA after mean value normalizing.
Attack
Untargeted MA
Noise budget e
2
4
6
Success rate (mean value normalized)
0.960
0.987
0.994
0.998
7

---

Resistant to JPEG compression. JPEG compression has been revealed by many studies to be an effective defense against the adversarial attack [2] 34 the added small perturbation can be removed in the process of compression. In JPEG compression, the quantifiable quality q/ decides the degree of the compression (smaller of means more information are reduced). our experiment, we test the success rate of Moiré Attack under JPEG compression with different gf and make comparison with the baselines. The success rate is shown Table From the results, we can see that Moiré Attack is very robust against JPEG compression. Even the quantifiable quality of is 20 that is a relatively low value, the attack success rate can still remain a high value 93.8 8% while other baselines are subject to such compression.
Table Success rate of Moiré Attack under the JPEG compression. The second left column the attack success rate on Inception-V3: V3 model, the right 4 columns are the corresponding attack success rate under the JPEG compression with different q/.
Inception V3 gf = 20 of =
qf = 60
gf 80
MA BIM (Loo)
1.000
0.938
0.949
0.956
0.9881
0.989
0.286
0.431
0.606
0.853
PGD (Loo)
0.99
0,276
0.379
0.522
0.797
CW (Los))
0.762
0.205
0.207
0.226
0,354
MI-FGSM (L2)
0.991
0.491
0.776
0.892
0.964
Under other image transformation methods. In this part, evaluate Moiré Attack under several other transformations and denoise methods: pixel deflection (PD) [31], feature squeezing [42], and total variance minimization (tvm) and image quilting (image transformation (IT) methods) [TS] All the parameters are set following their original papers. We set noise budget = 4. All the attacks untargeted attacks. The results are shown in Table we relatively stable compared with other baselines and can still retain high success rate under varies image transformation methods.
the proposed Moiré Attack is
Table Attack success rate under different transformation methods. The second left column shows the attack success rate on victim model Inception- V3 without transformations.
Feature Squeezing
IT
Attacks
Inception-Va V3
PD
bit depth
median smoothing
tvm quilting
4
2*2
3
MA
1.000
0.988
0.998
1.000
0.848
0.880
0.985
0.978
BIM
0.989
0.714
0.930
0.984
0.918
0.850
0.810
0.530
PGD
0.990
0.661
0.945
0.984
0.890
0.796
0.812
0.522
CW
0.762
0.109
0.062
0.182
0.074
0.121
0.804
0.516
MI-FGSM 0.991
0.931
0.976
0.988
0.962
0.945
0.820
0.557
Under demoiréing methods. We further explore whether Moiré Attack will be affected by the extant demoiréing methods. We search for the challenge of demoiréing 43 -e] in recent years and choose
four SOTA methods MopNet [16], MDDN 6 FHde2Net [7]] and AMNet 45 to test MA (the settings the same the ones in their papers). We show the success rate of untargeted MA (c 4) under demoiréing methods in Table and the visualization of demoiréing results in Appendix D.
Table 5: The success rate of untargeted MA under demoiréing methods.
Demoiréing method MDDM FHDe2Net
Untargeted MA
Inception V3
MopNet
AMNet
1.000 1,000
0.989 0.994
0.997
1.000
0.974
1.000
1.000
0.989
We find that moiré pattern actually annoying and intractable to be greatly removed. Even moiré pattern is partly mitigated under such demoiréing methods in perception, the image still remains

---

adversarial to the victim CNN model (as shown in Table 5 the success rate is still high under demoiréing methods). In this view, moiré pattern not only causes visual impediment but can really be a threat to the safety of CNN, which should be aware and more exploration should be devoted to remove or weaken potential threat.
4.4 Transferability analysis
In this part, we study the transferability of the proposed Moiré Attack. We choose Inception-Ve V3
37
the source model attack and Resnet34 [19], Resnet50 [19], Densenet121 (20), VGG16 335 and
VGGI9 [35] as the remote target models to test the generated adversarial examples. The noise budget
All the attacks are untargeted attack. Table shows the proposed Moiré Attack (MA) has
high transferability across different DNNs (the success rates are all about 95%), while the baselines behave poorly the transferability.
Table 6: The attack success rate of different models. The second left column is the source model Inception-V3. V3 and the right 5 columns the remote target models.
Attacks
Inception-V3
Resnet50
Resnet34
Densenet121
VGGI6
VGG-19
MA
1.000
0.967
0.927
0.959
0.982
0.973
BIM
0.989
0.176
0.202
0.173
0.233
0.202
PGD
0.990
0.166
0.202
0.167
0.224
0.201
CW
0.762
0.116
0.133
0.121
0.170
0.146
MI-FGSM
0.991
0.254
0,294
0.247
0.312
0.298
4.5 Ablation Study
Budget-free Moiré Attack. To explore the relationship between the sensor noise and the final generated moiré pattern in perception, set the sensor noise budget from 4 to 32. Te details of the generated adversarial examples are shown in Figure
Adv Images
Clean Images
Untargeted
Details
Rotate Images
16
24
budegger
ayrer
Rotate Dim
Untargeted
BIM
Details
Figure 6: Comparison of the details of the adversarial examples generated by Moiré Attack (MA) and BIM.

---

We can see that with the increase of the added sensor noise budget the details of moiré in the adversarial example hardly change, which means there no obvious change perceptible human eyes. While for BIM, when the perturbation is up to a threshold (e.g. 32), the noise can be easily noted by human eyes. In this aspect, our proposed Moiré Attack is budget-free attack.
Factors affecting the synthesis moiré pattern. In this part, we further explore different factors that will influence the generated moiré pattern including the shooting rotation angles 7 and the size the LCD monitor (size scale factor (t). The sensor noise budget is = 4. The results are shown in Figure For rotation angles, the results show that moiré patterns with different rotation angles generated by Moiré Attack are different. Another factor influencing the moiré pattern is the size scale degree when displaying an image on the monitor. We can see that when the size of the monitor increases, the generated moiré pattern becomes more obvious and the distortion is more evident. In addition, we also discuss the position of the introduced fabricated noise' position to MA in Appendix E.
Clean Images
Ady Images
100.0%
132.3%
Figure 7: Factors that influence the generated moiré pattern. The top row shows the different moiré pattern with different rotation angles yy and the bottom shows moiré pattern under different size scale factor a.
5 Conclusion and Future work
In this paper, we revealed the threats of DNNs from a new perspective. We utilized the physical property of the camera when shooting, i.e., the moiré effect, and demonstrated its potential security risk for DNNs. Then we proposed Moiré Attack by mimicking the shooting process of a camera. Extensive experiments have been conducted to present great properties of the proposed Moiré Attack, e.g., high attack success rate, high transfcrability across different models, and high robustness under various image transformation methods. However, the sensor noise is uncontrollable in a sense and may be difficult when delivering the targeted MA in practice. Our work is just small step to open up new possibility to craft attacks against DNNs. We will continue explore more general moiré effect generation methods.
Acknowledgments and Disclosure of Funding
Yisen Wang partially supported by the National Natural Science Foundation China under Grant 62006153, and Project 2020BD006 supported by PKU-Baidu Fund. We would like thank Hanyue Lou at Peking University in the discussion at moiré phenomenon in daily life.
10

---

References
[1] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In ICLR, 2017.
[2] Yang Bai, Yuyuan Zeng, Yong Jiang, Yisen Wang, Shu-Tao Xia, and Weiwei Guo. Improving query efficiency of black-box adversarial attack. In ECCV, 2020.
[3] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. In NeurIPS Workshop, 2017.
[4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In S&P, 2017.
[5] Pin- Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. arXiv preprint arXiv: 7708.0399, 2017.
[6] Xi Cheng, Zhenyong Fu, and Jian Yang. Multi-scale dynamic feature encoding network for image demoiréing. In ICCV Workshop, 2019.
[7] Nilaksh Das, Madhuri Shanbhogue. Shang-Tse -se Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv: 1705::7000002000 2017.
[8] Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li, Li Chen, Michael E Kounavis, and Duen Horng Chau. Shield: Fast, practical defense and vaccina- tion for deep learning using jpeg compression. In SIGKDD, 2018.
jpeg
[9] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[10] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
[11] Ranjie Duan, Xingjun Ma. Yisen Wang, James Bailey, Kai Qin, and Yun Yang. Adversarial camouflage: Hiding physical-worid attacks with natural styles. In CVPR, 2020.
[12] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.000 00853, 2016.
[13] Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust ahysical-world attacks on deep learning models. In CVPR, 2018.
[14] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICIR, 2015.
[15] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In ICLR, 2018.
[16] Bin He, Ce Wang, Boxin Shi, and Ling-Yu Duan. Mop moire patterns using mopnet. In ICCV, 2019.
[17] Bin He, Ce Wang, Boxin Shi, and Ling- Yu Duan. Fhde net: Full high definition demoireing network. In ECCV, 2020.
[18] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In ICCV, 2017.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[20] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinherger. Densely connected convolutional networks. In CVPR, 2017.

---

[21] Lifeng Huang. Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In CVPR. 2020.
[22] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 1rXiv: 2016.
[23] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint urXiv:
2017.
[24] Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In NewrIPS, 2018.
[25] Xin Li, Bahadir Gunturk, and Lei Zhang. Image demosaicing: A systematic survey. In VCIP, 2008.
[26] Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In ICML, 2019.
[27] Bolin Liu, Xiao Shu, and Xiaolin Wu. Demoiréing of camera-captured screen images using deep convolutional neural network. arXiv preprini
2018.
[28] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1xXiv:7006.0683. 2017.
[29] Seyed- Moosavi-Dezfoole Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In CVPR, 2016.
[30] Junichi Nakamura. Image sensors and signal processing for digital still cameras. CRC press, 2017.
[31] Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer. Deflecting adversarial attacks with pixel deflection. In CVPR, 2018.
[32] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. In CVPR, 2016.
[33] Yucheng Shi, Siyu Wang, and Yahong Han. Curls & whey: Boosting black-box adversarial attacks. In CVPR, 2019.
[34] Richard Shin and Dawn Song. Jpeg-resistant adversarial images. In NeurlPS Workshop, 2017.
[35] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1554 2014.
[36] Yujing Sun, Yizhou Yu, and Wenping Wang. Moiré photo restoration using multiresolution convolutional neural networks. IEEE Transactions on Image Processing, 276)):416044172 2018.
[37] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zhigniew Wojna. Re- thinking the inception architecture for computer vision. In CVPR, 2016.
[38] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties neural networks. arXiv preprint arXiv: 131.,199, 2013.
[39] Xin Wang. Jie Ren, Shuyun Lin, Xiangming Zhu, Yisen Wang, and Quanshi Zhang. A unified approach to interpreting and boosting adversarial transferability. In ICLR, 2021.
[40] Dongxian WI, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020.
12

---

[41] Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu- tu-Wing Tai. Boosting the transferability of adversarial samples via attention. In CVPR, 2020.
[42] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017.
[43] Shanxin Yuan, Radu Timofte, Ales Leonardis, and Gregory Slabaugh. Ntire 2020 challenge image demoireing: Methods and results. In CVPR Workshop, 2020.
[44] Shanxin Yuan, Radu Timofte, Gregory Slabaugh, and Aleš Leonardis. Aim 2019 challenge on image demoireing: Dataset and study. ICCV Workshop, 2019.
[45] Huanjing Yue, Yan Mao, Lipu Liang, Hongteng Xu, Chunping Hou, and Jingyu Yang. Re- captured screen image demoiréing. IEEE Transactions on Circuits and Systems for Video Technology, 31(1):49-66 60, 2020.
13


Reviews:
[{"review_id": "rdflB8zwd8p", "reviewer": "Reviewer_zVAp", "summary": "This paper presents an interesting new deep attack method, which utilizes the morie effect caused by digital image processing. It mimics the shooting process of digital devices and generates the physical-world morie pattern, which is then added to the targeted images to attack a given deep model. Extensive experiments are conducted to support the proposed method.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n-\tStrong and clear motivation. The authors first analyze the special phenomenon in digital image processing, the morie effect, which could cause unnotic3ed security threats to DNNs. And then based on this phenomenon, it develops the morie attack methods. The method is well motivated.\n-\tSolid technical approach. The proposed morie attack can mimic the shooting process of digital devices and generate the physical-world morie pattern by the proposed adversarial loss. The obtained morie pattern can then be added to images to attack a given deep model.\n-\tState of the art experimental results. Their simple approach yields significant attack performance on ImageNet and various DNN models.\n\nCons: \n-\tThe generated adversarial examples are not so realistic compared with images with normal morie pattern.\n-\tThere should be more explanation in the title of Figure 4 to make the figure self-explainable.\n-\t(minor) There are several typos, that should be revised. For example: in line 135, \"a physical threat to DNNa that ...\". The presentation can be improved.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "No concern was found. This paper should have positive social impact.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "2"}, "extra_text": {}}, {"review_id": "W38ScPGRcI2", "reviewer": "Reviewer_FN6p", "summary": "This paper discovers a special phenomenon, the Moire effect, that can be used for adversarial attack. A Moire Attack method is proposed by mimicking the shooting process of the camera sensors by optimizing the sensor noise. Empirically, this method has a high success rate and transferability across different victim models.", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Originality:\nThis paper discovers a novel way to construct an adversarial attack.\n\nQuality:\nI have several technical concerns.\n1. Should the 'Morié effect' be 'Moiré effect' in the title?\n2. I think the perturbation budget $\\epsilon$ should be a constraint on x rather than on the sensor noise $\\delta$, as the same budget on $\\delta$ will result in much more significant changes on the image x perceived by DNNs.\n3. Can the authors show the images after demoire algorithms? Will there be some special patterns when the moire patterns are removed?\n4. It seems the proposed method depends on the manipulation of the optical image capture pipeline, which I believe is in practice embedded in a physical camera and cannot be altered by hand. This makes the proposed method impractical as, for my understanding, no one can actually control the perturbation on the sensor noise in a camera. It is much more convincing to show successful attacks on physical cameras.\n5. The last point also raises another one: it seems the method is device-specific, e.g. it can only impact a single device even the attack method can be deployed on a physical camera device. On contrary, most existing adversarial attacks generate perturbations on raw images, leading to general attacks that can affect many devices.\n\nClarity:\nThis paper is clear and easy to follow.\n\nSignificance:\nThis is an interesting direction of research. Maybe there are some alternative ways to construct the Moire Attack that can avoid the problems I am concerned with. Therefore I believe this is a fairly significant paper.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Some alternative attacks based on the Moire effect can be explored, e.g. optimization on image instead of on the sensor noise, which can eliminate the concerns.", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "Pwrob7HhyNb", "reviewer": "Reviewer_LYp3", "summary": "A new white-box attack to deep neural network is proposed. The authors observe that a large number of digital images are affected by the so called moiré effect or moirè pattern. When images are displayed on a digital monitor they are obviously sampled, then they are sampled again when acquired by a new device. The display and acquisition sampling grids are usually non-aligned, which gives rise to visible distortion patterns of varied geometry in the acquired image, known as moiré patterns. The proposed attack takes a generic image, introduces a synthetic moiré pattern on it, by replicating its generation process, and then attacks it by conventional methods. Experiments support the effectiveness of the proposed method.\n", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "A first observation is on the language, which should be definitely improved. There are many errors and typos, to begin with moiré which is consistently (108 times) spelled morié. The organization is also questionable, with too much space devoted to relatively well-known facts (the moiré effect) and too little to experimental validation. Even the presentation needs to be improved. Apart from this, my main criticism is methodological. As far as I understand, in fact, no new attack is really proposed but rather a means to disguise an attack. The original image is not attacked: only a strongly distorted version of it is. As the authors observe, moiré patterns occur frequently in images, so this type of added distortion may remain unnoticed. However, many images are also highly noisy, under or overexposed, almost all of them are compressed, so one could use any of these facts or a combination of them to disguise attacks. Accordingly, the proposed cannot be fairly compared with methods that work on the original image, but rather with other \"attack disguising\" methods. Moreover, as the authors themselves acknowledge, methods to reduce or remove the moiré patterns exist and should be taken into account, e.g. [*].\n\nConcerning the implementation of the attack, the authors remark that \"step 2 causes the final images to be darker\" and in fact all visual examples show very dark attacked images. I find this quite weird, considering that attacked images should look natural, not to raise suspects (this is in the spirit of mimicking moiré patterns). These images could be easily singled out and subject to a deeper scrutiny just based on their mean value. In addition, it is very difficult to asses their quality by visual inspection. Also, it appears that after the backpropagation-based attack (step 5) the image is subject to further processing (step 6) which could weaken it. I do not understand why the attack is not performed as the last step. \n\nExperiments, though encouraging, are very limited and do not consider several datasets usually adopted in the field. Finally, the subsection ablation study does not present any ablation, but other types of analyses. \n\nOverall, I believe that this paper needs substantial work to make it acceptable for possible publication.\n\nReferences\n- [*] He et al. Mop Moiré Patterns Using MopNet, ICCV 2019.\n\n--------------------------------------------------------------------------------------------------\n\nUPDATES\n\nFirst of all, I want to thank the authors for answering my questions.\n\nSome of my concerns have been solved, in particular authors clarified the type of attack, \nthey analyzed methods to remove the Moiré patterns and ensured that they will improve the presentation.\nThey also added a comparison with a simple baseline to show that their proposal works better.\nI still have a concern about the visible and strong distortion introduced with this attack since I believe that \nit is not reasonable and indeed it would raise human attention. In this respect in my opinion comparisons with state-of-the-art are not fair. \nHowever, given that some major issues have been addressed, I increased my score.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors did not describe limitations and potential negative societal impacts of their work. For what concern limitations it would be important to show what happens when it is applied a method to detect and even remove the moirè pattern.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "4"}, "extra_text": {}}, {"review_id": "A6O6ssu6W45", "reviewer": "Reviewer_iszk", "summary": "The paper found a very interesting phenomenon in current digital devices, called morie effect, that can be used for attack. They proposed a Morie Attack (MA) that generates the physical-world morie pattern adding to the images by mimicking the shooting process of digital devices. MA is with great stealthiness that hardly attracts the awareness of humans. Extensive experiments show that MA can attack DNN with a high success rate and high transferability rate. ", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\n(i) The morie effect maybe heard by many people, but it is very interesting to see that it can be used as an attack method. There is a fact we maybe ignored before that the final perceived images by human-vision and computer-vision systems could be very different in some cases, for example shooting on digital monitors due to the different physical mechanisms. Thus, the exploration in this paper is novel and is clearly of interest for the adversarial community.\n(ii) The proposed morie attack is simple but effective. The authors mimic the shooting process of the camera sensors, which gives the attackers more freedom and controllability to tamper with DNNs. And the generated morie effects seem real and hardly distinguishable for human beings. \n(iii) The experiments seem to be completed and comprehensive. The authors have conducted the targeted and untargeted evaluations, and also checked the effectiveness of morie attack under various transformations. Detailed ablation studies convince the effectiveness of morie attack. \n\nWeakness:\n(i) Is the morie attack sensitive to the angle of shooting devices?\n\n(ii) How the perturbation is added into the generation of morie process? It is better if the authors provide an algorithm to show the process of morie attack. \n\n(iii) Why MA is so effective under median smoothing in Table 3?\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Pls refer to weaknesses.", "review_text": "", "extra_scores": {"ethical_concerns": "None", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper presents a novel kind of attack: Moire attack. It is inspired by that there will be Moire effect when shooting images on the LCD monitors. Although the Moire effect is perceptible by human eyes, it is very hard to distinguish between images with different Moire effects. Moire attack therefore is hard to recognize and will be harmful. Current algorithms are not robust to Moire attack. The authors are calling for our attention to this attack. We suggest the author carefully merge the rebuttals in the final version.
Decision: Accept (Poster)