Paper:
Recent analysis of deep neural networks has revealed their vulnerability to carefully structured adversarial examples. Many effective algorithms exist to craft these adversarial examples, but performant defenses seem to be far away. In this work, we explore the use of edge-aware bilateral filtering as a projection back to the space of natural images. We show that bilateral filtering is an effective defense in multiple attack settings, where the strength of the adversary gradually increases. In the case of adversary who has no knowledge of the defense, bilateral filtering can remove more than 90% of adversarial examples from a variety of different attacks. To evaluate against an adversary with complete knowledge of our defense, we adapt the bilateral filter as a trainable layer in a neural network and show that adding this layer makes ImageNet images significantly more robust to attacks. When trained under a framework of adversarial training, we show that the resulting model is hard to fool with even the best attack methods.

Review:
The paper proposes the use of bilateral filtering as a defense to adversarial examples (AE). Bilateral Filtering (BF) is a smoothening technique that averages pixels that are close to each other both in position and value. As a result BF preserves sharp edges and the denoised images appear to be of higher quality than those produces via simple Gaussian smoothing.
First, the method is evaluated on black-box attacks by constructing AE for the undefended network and then applying the defense. The method is then tested on white-box attacks which attack the defended system end-to-end with first order methods. Finally, the authors propose combining their defense with adversarial training.
Overall, I find the main idea of the paper interesting. BF seems like a natural approach to remove low-magnitude perturbations from the image while preserving the salient characteristics of the image. Thus, if it did not hurt classification accuracy significantly it might be considered as part of a cheap preprocessing pipeline that protects the model from simple attacks. However, as shown in Table 3 and 6, BF reduces the accuracy of the original model by at least 5% on ImageNet and CIFAR10.
My main objection about the paper is that BF is proposed as a defense that is extremely robust against even the best attacks. However, the evaluation is clearly incomplete for such a claim and fails to pass simple sanity checks.
*Epsilon values used to claim robustness are way too high*. Table 4 reports an L_infinity bound of 0.793 (almost 40% the image range) and L_2 of 187 (again roughly a quarter of the L2 radius of the image domain). One can change the class of the image completely (even for humans) with a smaller epsilon bound. This is a very clear indication that the attacks used are not sufficient to properly evaluate the robustness of the defense. Even in the images produced by the authors (Figure 2) it is clear that these perturbations are sufficient in terms of magnitude to completely distort the image.
*Only first-order attacks are considered*. From the point about epsilon values above, it is fairly clear that the defense is not easy to attack with first-order methods. This is understandable since BF, even if "fully differentiable", will lead to vanishing gradients for certain pixels. I think it is necessary that the authors to evaluate their defense on other attacks such as a) a straight-through approximation of BF (see BPDA from https://arxiv.org/abs/1802.00420), b) a finite-differences-based attack (see SPSA from https://arxiv.org/abs/1802.05666). As a sanity check, I would even recommend evaluating using the nearest neighbor of each image from a wrong class. It is clear that this attack will always succeed and the L_p distance will be smaller than those reported here.
I believe that these are fundamental issues about the paper that need to be addressed before even considering the paper for acceptance and I thus recommend rejection at this time.
Other comments and concerns:
--Table 6: what is the performance of BFNet without adversarial training? This is a necessary baseline to understand the results of the table.
-- I am confused by the adaptation of adversarial training to BFNet (last equation of section 3.4). The equations themselves are confusing since x is used twice (as a parameter to f and sampled from D). My first guess would be that the method is performing end-to-end adversarial training from the loss to the input x (before BF). It appears however that adversarial training is performed with respect to the image *after* applying the BF filter. If this is the case, it goes against the fundamental principles of adversarial training.
-- I do not see the point of adaptive filtering (AF) as a defense. BF is attractive because it is simple. Adding a classifier to figure out the right parameters seems dubious at best. The idea seems fundamentally flawed given that the classifier is only trained on known attacks and might thus not capture new, different attacks. Lastly, since the classifier is a ML model, it will clearly be susceptible to adversarial perturbations. So the adversary can choose an attack that fools the original model and forces the classifier to choose bad BF parameters. I would suggest that the authors completely remove AF from future versions of their paper.
-- The performance on ImageNet is significantly better than the performance on MNIST and CIFAR10. This is counter-intuitive since a much harder dataset both from a standard and adversarial point of view.
Minor comments to authors:
-- A JPEG compression-based defense can be bypassed (https://machine-learning-and-security.github.io/papers/mlsec17_paper_54.pdf).
-- Last paragraph of page 3 is too informal ("less holes for adversarials to maneuver on").
-- Top of page 4: you seem to confuse "iterative methods" with "small magnitude" attacks. One can use iterative attacks to create large adversarial perturbations (e.g. PGD).
-- I would suggest normalizing to the more common [0, 1] range as the current numbers can be confusing.
-- I am confused by Tables 2, 3. First row of Table 2 shows that on 95% of the clean inputs the label is not changed after BF. But table 3 shows that the accuracy drop from 78.8% to 71.7%. What is going on here?
-- Last part of first paragraph of 4.2 is hard to understand.
-- End of page 8, "the higher dimensionality of CIFAR10 makes it harder than MNIST". Yet the paper claims excellent performance on ImageNet.