Paper: MATT: Random Local Implicit Purification for Defending Query-based Attacks (ICLR-2024)

Reviewer comment (Presentation):
Some figures in the paper are unclear and difficult to understand, which can hinder readers' comprehension of the research.

Author response:
We would like to express our gratitude to the reviewer for pointing out the issues in our figures. We have revised Figures 3 and 4 according to the suggestions. Additionally, we have also updated Figure 2 for a better illustration of our methods. Please find below our modifications to the figures.

Reviewer comment (Novelty):
The defense mechanism and its components appear to be incremental improvements on existing methods rather than introducing a truly novel approach. It could benefit from a more innovative perspective.

Author response:
We acknowledge your concerns regarding the novelty of our work. We would like to clarify that our work's novelty lies in two main aspects:
1. **Theoretical Advancement:** Through rigorous theoretical analysis, we demonstrate that **a deterministic purification process** is unsuitable for black-box attack defense. This conclusion is also corroborated by our experimental findings (Robust accuracy **2.2%** for CIFAR-10, **6.70%** for ImageNet). This represents a significant theoretical advancement.
   
2. **Technical Contribution:** Stemming from this analysis, we introduce a random patch-wise mechanism with **constant inference cost** to enhance robustness, which signifies our technical contribution. Actually, we have addressed other efficiency issues (cancelling local ensemble, utilizing smaller encoders) for the existing purification methods but not listed as the main contribution in the paper. An acceleration from **linear time** to **constant time** is achieved in Figure 7 and Figure  8 compared to simple ensemble method, which enables the application of purification methods in real-world MLaaS systems (**million-fold extra cost**).

We hope the observations from theoretical analysis will be instrumental in designing purification-based methods for black-box systems. We have emphasized these insights in our contribution section (Section 1) for further clarity in the revised version of the paper.

Reviewer comment (Presentation):
Figure 3 lacks a clear explanation for the small batch of examples shown in (II). It would greatly benefit the readers if this could be clarified in the Figure.

Author response:
* **Small batches:** The small batches are extracted from the original image, which is segmented into several patches. We have now added additional annotations to the figure to clarify this (*Cut up* operation).

Reviewer comment (Experiments):
In Figure 4, there is a reference to "Attack during Training" phase, but it's not clear whether adversarial training is conducted. Could you please provide more details on this matter?

Author response:
* **Attack during Training:** This step aims to provide adversarial images for our training process. For better illustration, we have listed out the attack algorithms used (PGD, BIM, and FGSM).

Reviewer comment (Presentation):
Generally, the figures used in the paper do not effectively convey the ideas or methods, and they need improvement to enhance the paper's accessibility.

Author response:
We would like to express our gratitude to the reviewer for pointing out the issues in our figures. We have revised Figures 3 and 4 according to the suggestions. Additionally, we have also updated Figure 2 for a better illustration of our methods. Please find below our modifications to the figures.

Reviewer comment (Novelty):
In Section 4.2, most of the design elements mentioned do not appear to offer significant contributions. They seem more like incremental improvements built upon the DISCO paper. For instance, the removal of positional encoding and local ensemble inference does not constitute a major innovative contribution, and some modifications in the "Random Patch-wise Purification" section seem more like workarounds than novel contributions.

Author response:
We acknowledge your concerns regarding the novelty of our work. We would like to clarify that our work's novelty lies in two main aspects:
1. **Theoretical Advancement:** Through rigorous theoretical analysis, we demonstrate that **a deterministic purification process** is unsuitable for black-box attack defense. This conclusion is also corroborated by our experimental findings (Robust accuracy **2.2%** for CIFAR-10, **6.70%** for ImageNet). This represents a significant theoretical advancement.
   
2. **Technical Contribution:** Stemming from this analysis, we introduce a random patch-wise mechanism with **constant inference cost** to enhance robustness, which signifies our technical contribution. Actually, we have addressed other efficiency issues (cancelling local ensemble, utilizing smaller encoders) for the existing purification methods but not listed as the main contribution in the paper. An acceleration from **linear time** to **constant time** is achieved in Figure 7 and Figure  8 compared to simple ensemble method, which enables the application of purification methods in real-world MLaaS systems (**million-fold extra cost**).

We hope the observations from theoretical analysis will be instrumental in designing purification-based methods for black-box systems. We have emphasized these insights in our contribution section (Section 1) for further clarity in the revised version of the paper.

Reviewer comment (Novelty):
Local implicit functions have already been employed to defend against adversarial attacks, and the proposed method of using local implicit functions to randomly purify patches in images lacks novelty.

Author response:
Our work **theoretically** and **experimentally** addresses the limitations of existing **purification** methods for **black-box defense**. We have listed the key points below:
* Our work provides a theoretical analysis for **purification-based defense** in black-box setting. The analysis **quantifies** the relationship between the **number of purifiers** and the **robustness** of the system. (**Theoretical Contribution)**
* Random-patch wise mechanism has **constant** inference cost with the number of purifiers and uses the most efficient purifier, which makes our mechanism the most efficient purification method. This method is suitable for real-world MLaaS systems (**million-fold inference cost**). (**Technical Contribution**)

Reviewer comment (Writing):
In the second paragraph of Section 1, should "extremely low" be changed to "extremely high"?

Author response:
The term 'extremely low' in Section 1's second paragraph refers to the **impracticality** of deploying **resource-intensive** defense algorithms against query-based attacks in **real-world** scenarios. Following this sentence, **'a million-fold cost'** for large corporations is used to illustrate the impracticality of the defense mechanism.

Reviewer comment (Writing):
In Section 4.3, "the robustness of the system is averaged across different purifiers" implies what? It lacks explanation.

Author response:
We understand the ambiguity of this phrase and have revised the sentence to clarify its meaning:

"While adversarial optimal points persist, the presence of multiple optimal points under different purifiers serve as the first trial to enhance the robustness of all purification-based methods."

We acknowledge the challenge of identifying adversarial points for any purification function and present our solution as a pioneering effort to obscure these points, thereby bolstering the system's robustness.

Reviewer comment (Novelty):
I cannot see a clear motivation from the design to the goal. The existing purification defense is for white-box attacks, and to do black-box attacks, why do the authors design a random patch-wise image purification mechanism using the local implicit function? The method seems to be a lot of improvements in purification and the design enables theoretical analysis of query-based attacks. But the technical contribution does not directly serve the goal: you can also use it to increase the robustness against white-box attacks. In 4.1, the motivation is claimed to be an ensemble multiple purifier & adversarial examples are in low-D manifold, which is about the general defense for all attacks, not motivated for query-based attacks.

Author response:
## Motivation for the Design
We propose our random patch-wise purification method to facilitate the application (**low extra inference cost required**) of **multiple purifiers** (proved necessary to defend black-box attacks) in a real-world MLaaS system. We have updated our motivation in Section 4.1 accordingly and listed the key points below:
* Our theoretical analysis has proved that **a single deterministic purifier** cannot improve the system's robustness against black-box attacks.
* Since directly ensembling multiple purifiers will **linearly increase** the inference cost, we propose a random patch-wise method to **maintain a constant inference cost** regardless of the number of purifiers. It is the key point since extra inference cost for each image lead to a **million-fold** cost increase in real-world MLaaS systems.
* Our method is the purification method with the **lowest inference cost** among all the purification methods as illustrated in Table 1 in the paper.
* We can surely use this method to defend **white-box attack**, which is not the focus of our paper.

Reviewer comment (Writing):
The presentation of the method details is not very clear.

Author response:
## Presentation of the method detail.
We have revised our paper for presentation of the method detail and found that the **clarity** of our paper is influenced by **lack** of explanation and annotations on figures as suggested by reviewer cfuj. In the revised paper, we have made the following changes to improve the clarity of our paper:
* **Figure 2:** We have circled the main body of a purifier model for later reference. 
* **Figure 3:** We have added annotations to the figure to better illustrate the difference of our method and the ensemble method. 
* **Figure 4:** We have added more details to present the training process of our method. The caption is also revised for better illustration.