From: ICLR.cc/2023/Conference/Paper934/Authors
title: Submission Withdrawn by the Authors

From: ICLR.cc/2023/Conference/Paper934/Reviewer_uMZh
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: This paper proposes a method to detect whether the sequences are adversarially attacked and localize the attack patches in optical flow.  The main contribution of this paper is to utilize spatial constraints in patch attacks. Two modules, Spatial-Channel Optimization (SCO) and Proximity Constraint (PC) are designed based on this constraint. The experiments are on the SOTA optical flow networks. 
strength_and_weaknesses: Strengths:
- Applying spatial constraints to detect and localize the attack patches is intuitive and the experiments show the effectiveness of the design.

- This paper is very straightforward and easy to understand.

Weaknesses:
- As mentioned in Section 2.3, this paper is the first to detect and localize the adversarial attack in optical flow. However, the main method designs focus on `patch` without any design on the optical flow task itself. 
> The optical flow task is different from other tasks because it is `on sequential images across temporal`, and is a `regression` task. 

- How do AP and AR compute in Table 3? 

- In Table 3, why the AP/AR varies from 0 to 1 for different patch sizes with the same optical flow network? It seems a little confusing. (e.g., 0.04 vs 0.92 w/ FlowNet2 on MPI Sintel for p=153 vs 51) Besides, why sometimes AP/AR is lower when the attack patch is large?

- A lot of grammar mistakes and typos, e.g., has/have; is/are.

- What does the subscript $j$ mean in  p-value Computation part.

- Can you explain more about the detection performance across layers (figure 4) from the network architecture perspective?


clarity,_quality,_novelty_and_reproducibility: Clarity:
- It is easy to follow.

Quality: 
- The quality of this paper is slightly below the acceptance threshold. 
- The experiments are extensive. However, the experiment on attack localization is somewhat confusing. 

Novelty:
- This paper is the first to detect and localize the adversarial attack in optical flow. 
- However, the main design follows Cintas et al. (2020), The core proposed modules are Spatial-Channel Optimization (SCO) and Proximity Constraint (PC). There is no special design for the optical flow task. 

Reproducibility:
- Will the authors release the code if the paper is accepted?

summary_of_the_review: This paper is the first to detect and localize the adversarial attack in optical flow. However, the technical novelty is not based on optical flow. Besides, the experiment on localization is confusing, and seems not convincing enough.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper934/Reviewer_qbxi
confidence: 2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: This paper presents a method that detect patch attack in the setting of optical flow. It shows that the patch attack can seriously influence the performance of the overall network features, leading to poor performances for deep optical flow. Thus, the paper proposes to analysis the activation layer of features, and detect and localize the region of attacks. The experiments are conducted on the popular networks, i.e. FlowNetC, FlowNet2, PWCNet, and RAFT, which are verified on the leading dates, KITTI and Sintel.  
strength_and_weaknesses: Good performances on the leading benchmark with popular network structure. The novelty is somewhat limited. 
clarity,_quality,_novelty_and_reproducibility: Fine with limited novelty
summary_of_the_review: Existing works has already introduced subset scanning to detect adversarial attacks. Although some differences can be found, such as applied to patch-based attach, regression instead of classification, they are intuitive and overall not that novel. 

Patch-based attack should be described early in the introduction, bear in mind that not all authors are familiar with the topic. For example, patch-based attack, whereas p x p adversarial patch is pasted onto the input frames I_1 and I_2 at the same location. 
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
details_of_ethics_concerns: N.A
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper934/Reviewer_Cn4T
confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
summary_of_the_paper: This paper introduces an approach to detecting and localizing adversarial patch attacks to optical flow networks. The approach is based on subset scanning to compare the activations of the network with the distribution of such activations extracted from normal images. Constraints are added to the subset scanning mechanism to restrict the channels and spatial regions considered in the process.
strength_and_weaknesses: Strengths:
- The method is well motivated and justified.
- This is the first approach to detecting and localizing adversarial attacks on optical flow networks.
- The experiments show that the method outperforms a simple subset scanning approach.

Weaknesses:

1) Technical novelty:
As acknowledged by the authors, subset scanning has been used for adversarial attack detection in the past. This leaves the spatial-channel optimization and proximity constraints as technical contributions for this work. These two components are shown to help, but they are not of great originality. 

2) The experimental results are fine but could be strengthened in several aspects:

2.1) I would be curious to see the runtimes of the proposed method, particularly considering the multiple random restarts mentioned in the spatial-channel optimization.

2.2) I would recommend the authors to consider the scenario where the attacker is aware of the detection strategy. In essence, can the adversarial attacks be generated so as to take into account the subset scanning procedure (in essence, encouraging the p-values to be as uniform as possible).

2.3) In Section 6, the effect of the proposed SCO and PC components are evaluated by removing both of them jointly. Wouldn't it be possible to ablate them separately?

2.4) The authors perform a good number of ablation studies. However, I am curious about the motivation/justification of choosing the first layer in every network component to apply the proposed approach (beginning of Section 4). I am also interested in seeing the influence of the number of random restarts in the optimization.

2.5) Do the authors have an explanation why, according to Table 2, the baseline is less sensitive to the change in patch size (outperforming the proposed method for two networks with 51x51 patches)?
clarity,_quality,_novelty_and_reproducibility: - The notion of localization should be clarified. In essence, as shown in Fig. 1, when a patch is attacked, the perturbation can go beyond the patch's extent. I suspect that the authors use the patch area to evaluate the localization accuracy, but it might seem more reasonable to use the perturbation area (i.e., the region affected by the attack). Without this, I do not see why localization matters; even if the patch is located, one cannot trust the predictions outside of the patch. I suspect that, in practice, one would typically rather entirely discard a frame that has been detected as attacked, thus making localization irrelevant.
- Other than that, the paper is in general clear, although the notion of nodes used in the method overview was initially not too clear to me.
- As mentioned under Weaknesses, I find the novelty to be limited for acceptance to ICLR.
- The paper seems reproducible.
summary_of_the_review: In essence, the proposed method is reasonable and seems to work. However, its originality is limited, the experiments could be strengthened in several aspects, and I am not entirely convinced by the need for localization.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 3: reject, not good enough