Paper: Optimal transport based adversarial patch to leverage large scale attack transferability (ICLR-2024)

Reviewer comment (Experiments):
One limitation currently not discussed in the paper is the target data requirements. The proposed attack method relies on a substantial number of target examples to generate the patch to accurately approximate the target class distribution. This means that the attack has access to a lot more information compared to attacks that match a single feature point. This data dependency could be an important limitation in practice.

Author response:
> Concerning the data dependency to construct the target class distribution. 

To generate patches, we split the validation set of ImageNet into a training set on which we train patches and into a test set on which we evaluate them. To model the target class distribution, we select images from targeted class included in training set of ImageNet dataset (composed in practice by at most 1300 images). In this regard, we agree with the reviewer that our method has more information than single feature point method, but this information is available as the model was trained on it. In Figure 9 in Appendix we show the evolution of the transferability of out attack with respect to the number of points used to model the target class distribution. As been shown, the targeted success rate (tSuc) increases with the number of considered target points. This figure is added to the supplementary material in the ablation study section. Thank you for pointing out this interesting experiment.

Reviewer comment (Experiments):
I would like to see a study on the strength of the proposed attack, depending on the number of target images used to approximate the target distribution.

Author response:
-   We appreciate the feedback concerning Figure 9. To compare exactly in the same setting and to enhance the clarity of Figure 9, we add three additional runners-up baselines (GAP, LaVAN and TTP), and the supplementary material is updated correspondingly.  
Considering a larger number of targeted data points smooths the patch optimization and reduces the performance variability of the obtained patch (this result joins the results presented in Appendix B). We agree with the reviewer that a larger number of data points leads to a better estimation of the target class distribution and then to stronger patches. Figure 9 shows that considering ten target points significantly increases the patch transferability. However, the attacker may prefer to consider a larger set of target points for statistical soundness.

Reviewer comment (Experiments):
For qualitative experiments, this paper gives some results by selecting three objects present in ImageNet-1K (banana, cup, keyboard) and recording videos of them when one patch is placed or not next to the object. Yet, the performance of model in the physical world may be affected by the different angles or intensities of light. Thus, it would be more meaningful if this paper could provide the performances of the proposed approach with the change of angles or lights for the qualitative evaluation.

Author response:
> Concerning providing additional experiments on the robustness of patches according to physical conditions. 

We have investigated the robustness of our produced patches against physical transformations. We have detailed this point in the general response (see point 2 in general response). Table 6 and Figure 7 in Appendix H show the results. Our patches transfer even in the worst-case scenario (far from the camera or when rotated), while other patches do not.

Reviewer comment (Evaluation):
For digital experiments, the authors select from the previously defined families the following models and measure the attacking transferability when the resulting patch is used to fool the remaining models. The results show that the proposed approach can generate the stronger patch attack than its counterparts. Yet, the visual perception to human vision should also be considered. It would be more convincing if the image with the generated adversarial patch with the proposed method and its counterparts can be evaluated with the PSNR or SSIM as the evaluation metrics for the degree of recognition for human vision.

Author response:
> About the visual perception of patches to human vision. 

PSNR and SSIM metrics are commonly used to measure the potential detectability of perturbations induced by invisible adversarial examples. Adversarial Patch Attacks (APAs) rely on adding a visible textured patch to the scene: metrics such as PSNR and SSIM are not adequate in this context, because they would produce high values when comparing clean and attacked images. We want to emphasize that the purposes of invisible adversarial examples and adversarial patch attacks are different: APAs do not attempt to be made invisible by humans, as they consist of a strong image modification with a limited spatial extent. They are potentially detectable by humans as an object or region in an image but are expected to fool a deep neural-network and to be physically realizable.

Reviewer comment (Reproducibility):
This work designs a new patch attack with optimal transport to narrow the distribution gap in the generation of adversarial patch and achieve the superior performance with empirical evidence. Yet, it would be better for this work to provide more details and explanations.

Author response:
> On providing more details and explanations on why our method outperforms other methods.

In Appendix C, we provide a proof to show that our method generalizes the L2-based method. In the main article we try to provide some insights on why our method outperforms decision boundary based methods. Our method may outperforms other decision boundary based methods as they tend to create a patch that overfits on the source model decision boundaries.

Reviewer comment (Novelty):
I believe the main drawback of this article is that it does not discuss other methods based on distribution matching.

Author response:
> About the comparison against different distribution matching methods. 

We thank the reviewer for identifying this ambiguity in the text. As this point has been also raised by other reviewers, we have provided a general response (see our general response point 1). Moreover, we want to emphasize that even if the exact and the sliced optimal transport are based on optimal transport, they have different behaviors. The sliced OT relies on one-dimensional projections and the exact OT on a cost and coupling matrix. Theses differences are noticeable in high-dimension space, like the feature space of networks. Our experiments evaluate these two different methods and show their superiority over other methods.

Reviewer comment (Experiments):
The article's main claim is somewhat ambiguous; is it advocating that distribution-matching methods are superior, or that methods based on optimal transport are superior? A comparison with other distribution-matching methods would make the paper more compelling.

Author response:
> About the comparison against different distribution matching methods. 

We thank the reviewer for identifying this ambiguity in the text. As this point has been also raised by other reviewers, we have provided a general response (see our general response point 1). Moreover, we want to emphasize that even if the exact and the sliced optimal transport are based on optimal transport, they have different behaviors. The sliced OT relies on one-dimensional projections and the exact OT on a cost and coupling matrix. Theses differences are noticeable in high-dimension space, like the feature space of networks. Our experiments evaluate these two different methods and show their superiority over other methods.

Reviewer comment (Theory):
Another issue is that the article's statements are not sufficiently rigorous. The statements seem to suggest that the method presented can relax dependency on specific models. However, in reality, the method still relies on a particular model, even though it exhibits better transfer performance in experiments.

Author response:
We thank the reviewer for pointing out that the model dependency statement may be ambiguous. We want to add that our method is by design, independent of the classification layer. For example, our method allows the training of the patch on self-supervised networks without requiring training an extra classifier on top of it. We have clarified it in the main article (see Section 1 Introduction).