From: ICLR.cc/2023/Conference/Program_Chairs
title: Paper Decision
decision: Reject
metareview:_summary,_strengths_and_weaknesses: This paper has proposed a method for generating adversarial examples which satisfy multiple objectives based on multi-objective optimization (MOO). To solve the optimization problem, authors has leveraged a multi-gradient decent algorithm which combines all gradients with regards to different objectives into a single gradient direction. In addition, it has a regularization term so that it can focus on (or give higher weights to) unachieved tasks. In experimental part, the paper conducted four experiments to validate the utility of the proposed approach.

The main drawback is that the novelty of the problem formulations is not so clear to the reviewer, as some work also take this formulation into consideration in adversarial example generation scenario.
justification_for_why_not_higher_score: See the reviewers' discussion
justification_for_why_not_lower_score: N/A
summary_of_AC-reviewer_meeting: During discussion stage, reviewers still have concerns on the novelties and sufficient comparison with existing methods. 

Using MOO for adversarial example generation can be traced back to the paper "Adversarial example generation using evolutionary multi-objective optimization" in 2019 IEEE Congress on Evolutionary Computation (CEC). This paper is an incremental work based on the idea in CEC'19, the main difference is that it is combining two well-known methods -  MOO and geometry-based regulation, which makes its novelty somewhat limited. While authors have provided rebuttal, but it doesn’t address the concern where the proposed methods just borrows the multi-objective regularizor to conduct an very specific setting. Reviewers would see the proposed method in a wider used setting with several perturbation norm instead so that the novelty could better addressed by adapting the regularizor as well. 
 
This work lacks proper multi-objective optimization baselines as well as other approaches such as unitary scalarization. Reviewers have suggested several methods but the authors dismissed all of them. Without proper baselines, it is hard to properly assess the merits of this work, especially because the bulk of its contributions are empirical.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Our additional experimental results have been provided
comment: Dear Reviewer,

We appreciate your valuable time to review our paper. Given your latest feedback, we conducted more experiments regarding your suggested baselines [4, 6, 7].

We conducted experiments for [4] and [7] and reported the results in our previous feedback. For [6], we could not compare because the authors have not released the code yet. 

Given our intensive effort to run additional baselines in a short time period and your only left concern about the lack of baselines in MTL to compare, we really appreciate if you reconsider our current score at your earliest convenient time because the deadline for discussion is approaching very soon.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Comparison with baselines (part 2/n, n=2)
comment: 
**For the baseline [4]**. 

On the one hand, we would like emphasize that, due to the difference between MTL and Adversarial generation settings, not every behavior or finding in MTL can be implied in our setting. For example, in [4], the authors suggested that when possibly coupled with single-task regularization such as l2 penalty, or dropout layers, a single-task optimizer is strongly competitive with MOO methods. However, these regularizations are suitable for the MTL only (i.e., seeking optimal model' parameter) and not applicable to the adversarial generation task as in our setting (i.e., seeking adversarial examples).

On the other hand, we have tried to adapt the main finding from [4] such that a simple baseline with extensive fine-tuning might be compatible with complex MOO methods. As suggeted by the Reviewer, we have extensively fine-tuned the baseline by initializing with different sets of weights in Appendix E.8. More specifically, we replace the default uniform initialization of MOO by one of four sets A/B/C/D, where A/B are the final weights learned by MOO/TAMOO methods, respectively. In addition to the weight initialization, we also adjust the learning rate $\eta_w$ with three options {5e-3, 5e-5, 1e-8}.

The complete attacking progress can be seen in Figure 8. 
It can be seen from Table below that better initialization 
does help to improve the performance of the standard MOO. 
The best setting is the initialization with set D and $\eta_w=\text{5e-3}$ achieves 29.53\% in A-All metric, 
a 4.37\% improvement over the default MOO initialization. 
It can be seen from the evolution of the weights in Figure 8c that 
even initializing with the converged weights (i.e., set A) from the pre-running attack, 
the weight of each task does not stand still but converges to a different value. 
It is another different behavior in adversarial generation task compared to the multi-task learning problem. 
Additionally, despite of the extensive tuning, the performance of MOO is still far below the TA-MOO approach, 
with the gap of 8.48\% in A-All metric. 

|                  | $\eta_{w}=\text{5e-3}$ | $\eta_{w}=\text{5e-5}$ | $\eta_{w}=\text{1e-8}$ |
|------------------|-----------------------|------------------------|------------------------|
| $\text{MOO}^{A}$ | 28.64                 | 29.18                  | 29.12                  |
| $\text{MOO}^{B}$ | 29.13                 | 28.75                  | 28.65                  |
| $\text{MOO}^{C}$ | 29.38                 | 28.46                  | 28.33                  |
| $\text{MOO}^{D}$ | 29.53                 | 28.37                  | 28.18                  |
| MOO              | 25.16                 | -                      | -                      |
| TA-MOO           | 38.01                 | -                      | -                      |


**Finally, it is not clear to me the motivation for choosing CAGrad and PCGrad as baselines for comparison with TA-MOO as opposed to other approaches.**

PCGrad and CAGrad are two recent state-of-the-art MTL methods that have shown their superior performance over other MTL methods. Both PCGrad and CAGrad were proposed to tackle the gradient confliction and gradient dominating problem in MTL, therefore, were expected to be effective against the gradient domination problem in our setting. Moreover, implementations of these works have been released nicely, therefore, can be easier to adapt to our context. Both methods, especially, CAGrad have showed the superior performance over the standard MGDA in our setting. 

**All in all, I raised my score to 5 because some of my concerns were addressed by the rebuttal. However, I still believe this work is not ready for publication without a thorough comparison with appropriate baselines that allows the community to assess the merits of TA-MOO empirical contributions.**

We appreciate the Reviewer for acknowledging our response and raising the score. We are happy that there is only one remaining concern about comparing with other MTL methods. Given the shortage of time, we have tried our best to compare with as many as possible other MTL methods as suggested by the Reviewer. In total, we have conducted experiments with four new baselines: PCGrad, CAGrad, extensive-finetuning as [4], and Hypervolume Maximization as suggested recently. 
We also would like to reemphasize that our work focuses on the adversarial generation setting but not the standard multi-task learning setting. Our TAMOO method has been designed specifically to deal with the problem in the adversarial generation setting. Given this scope, we have conducted comprehensive experiments to not only show the superior of our method in both attack and defense but also analyze different aspects of our method. We believe that the contributions of our paper can be valuable to the AML community. With that all said, we really appreciate if the Reviewer can reconsider our new response.

Thank you so much, 

The authors

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Comparison with baselines (part 1/n) 
comment: Dear Reviewer, thanks a lot for the update of your score. To fully address your final concern, we have conducted new experiments with the suggested baselines. As the rebuttal ends soon, we have tried our best to provide new results in a very short time. Please see the details below and consider our effort. Thanks again.


**For the baseline [7]**. 

We thank the Reviewer for introducing this method. In what follows, we would like to describe how did we adapt this technique to our setting. More specifically, in each attack iteration, the adversarial perturbation has been updated as 
$\delta_{t+1} = \mathcal{P} \left( \delta_t + \eta g_t \right)$. 
$g_t$ is the gradient that aim to maximize the hypervolume as described in Section 4.2 in [7], i.e., $g_t = \sum_{i=1}^m \frac{1}{T (f_i - p)} \nabla_\delta f_i(\delta)$, where $T=\sum_{i=1}^m \frac{1}{f_i - p}$. 
Where $p$ is the nadir point which is dominated by all objectives $f_i$. Recall that unlike the setting in [7], our problem is seeking an adversarial example that maximizes all objectives simultaneously. Therefore, in our setting, the condition for the nadir point is that $p \leq f_i \; \forall i\in[1,m]$. 
Inspired by the algorithm in Section 4.1 in [7], we adaptively update the nadir point at each iteration such that $p = s \min_i \{ f_i \}$ where $s$ is the slack parameter (i.e., $s=0.9$). 

The result has been reported in the table below and will be added to the revision. 
It can be seen that, the hypervolume maximization method achieves a compatible performance to the Uniform weighting method in the diverse ensemble setting, and a slightly better performance in the non-diverse ensemble setting. In both settings, the hypervolume maximization's performance is far below ours. 

|                     |              | A-All | A-Avg | R/R1  | V/R2  | G/R3  | E/R4	 |
|---------------------|--------------|-------|-------|-------|-------|-------|-------|
| D                   | Uniform      | 28.21 | 48.34 | 48.89 | 49.08 | 48.38 | 47.03 |
|                     | HVM          | 28.06 | 48.26 | 48.47 | 49.21 | 48.08 | 47.27 |
|                     | PCGrad       | 28.25 | 48.28 | 48.81 | 49.03 | 48.13 | 47.14 |
|                     | CAGrad       | 30.23 | 48.34 | 47.03 | 48.22 | 45.92 | 52.20 |
|                     | MOO          | 25.16 | 44.76 | 39.06 | 46.83 | 37.05 | 56.11 |
|                     | TA-MOO       | 38.01 | 51.10 | 49.55 | 52.15 | 49.29 | 53.40 |
| ND                  | Uniform      | 28.17 | 48.75 | 51.94 | 45.55 | 54.15 | 43.34 |
|                     | HVM          | 28.54 | 48.84 | 51.36 | 46.20 | 54.01 | 43.80 |
|                     | PCGrad       | 28.30 | 48.75 | 52.02 | 45.42 | 54.35 | 43.21 |
|                     | CAGrad       | 35.22 | 51.07 | 54.22 | 47.84 | 55.24 | 46.97 |
|                     | MOO          | 32.50 | 52.21 | 53.25 | 49.05 | 56.80 | 49.76 |
|                     | TA-MOO       | 41.01 | 57.33 | 58.88 | 55.32 | 60.81 | 54.29 |

**For the baseline [6]**.
 
The code of this work has not been released yet, therefore, we couldn't compare with this work. 

We will discuss and cite these works in the revised version.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Reminder for the Reviewer! 
comment: Dear the Reviewer, 

Since the deadline for discussion is going to the end, we would like to kindly remind you about our responses. During the rebuttal phase, we added comprehensive analysis and additional experiments, which we wish could address your concerns thoroughly. 
Especially, for your concern about the novelty of our method, we believe that ours is the first work that tailors multi-objective optimization (MOO) to adversarial generation for classification problem. Our TAMOO method has been designed specifically to deal with the
problem in the adversarial generation setting. Given this scope, we have conducted comprehensive
experiments to not only show the superior of our method in both attack and defense but also analyze different aspects of our method. 
We also have conducted additional comparisons with recent multi-task learning methods so show the superior performance of our method. 
We believe that the contributions of our paper can be valuable to the AML community. 

With that all said, we hope our response can be considered. Thanks a lot for your effort. If our response helps, we look forward to your score update.

Best regards, 
The Authors,

From: ICLR.cc/2023/Conference/Paper2011/Reviewer_g196
title: Response to authors' comments
comment: Dear authors, thank you for your extensive comments. 

I appreciate the new results and my concerns regarding the motivation of the work are addressed. 

However, I still believe critical baselines are lacking in this submission, especially methods that aim at reaching the central of Pareto front, constrained approaches, and work that shows that, for example, unitary scalarization with proper regularization is outperforms multi-objective optimizers in some settings. I suggested several baselines comprising all the aforementioned aspects, but none of them were taken into account by authors for reasons I found hard to agree. For example, even though [7] was proposed for training Generative Adversarial Networks, hypervolume maximization can almost trivially be extended to different settings where multiple losses are simultaneously minimized. Also, the authors should notice the work of Kurin et al. [4] has been on Arxiv since January 2022 (https://arxiv.org/abs/2201.04122) and, therefore, cannot be considered as concurrent work to this submission. Also, [6] has also been available on OpenReview since July 2022. Finally, it is not clear to me the motivation for choosing CAGrad and PCGrad as baselines for comparison with TA-MOO as opposed to other approaches.

All in all, I raised my score to 5 because some of my concerns were addressed by the rebuttal. However, I still believe this work *is not ready* for publication without a thorough comparison with appropriate baselines that allows the community to assess the merits of TA-MOO empirical contributions.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Reminder for the Reviewer 
comment: Dear the Reviewer, 

Since the deadline for discussion is approaching, we would like to kindly remind you about our responses.
During the rebuttal phase, we added comprehensive analysis and additional experiments, which we wish could address your concerns thoroughly. We hope our response can be considered.
Thanks a lot for your effort. If our response helps, we look forward to your score update. We are happy to address any other questions about our paper if you have any.

Authors

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Reminder for the Reviewer 
comment: Dear the Reviewer, 

Since the deadline for discussion is approaching, we would like to kindly remind you about our responses.
During the rebuttal phase, we added comprehensive analysis and additional experiments, which we wish could address your concerns thoroughly. We hope our response can be considered.
Thanks a lot for your effort. If our response helps, we look forward to your score update. We are happy to address any other questions about our paper if you have any.

Authors

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Reminder for the Reviewer 
comment: Dear the Reviewer, 

Since the deadline for discussion is approaching, we would like to kindly remind you about our responses.
During the rebuttal phase, we added comprehensive analysis and additional experiments, which we wish could address your concerns thoroughly. We hope our response can be considered.
Thanks a lot for your effort. If our response helps, we look forward to your score update. We are happy to address any other questions about our paper if you have any.

Authors

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 9/n, n=9) 
comment: 
**Since in the case of MOO / MGD there is no constraint to enforce the
solutions to reach the desired preferred region of the Pareto front,
could it be the case that a particular initialization of MOO would
suffice to make it find the desired solutions? Also, could a previously
proposed constrained version of MGD such as \[3\] be able to do so and
potentially achieve a performance as good as
TA-MOO?**

(Please see the complete discussion in Appendix E.8)

In our method, the default initialization for the weight $w$ is $1/m$
equally for all tasks. Therefore, one raising valid concern is that
*Might better initialization can help to boost the performance?*. To
answer this question, we first find the optimal initital weight by using
the weight at the last iteration when running our MOO and TA-MOO attack
with the default initialization. For example, as shown in Figure 8a for
the ENS setting with diverse architectures, the average weight that MOO
assigns for model R/V/G/E converging to 0.15/0.17/0.15/0.53 (*set A*),
respectively. The average weights' distribution learned by TA-MOO is
0.19/0.25/0.19/0.37 (*set B*), respectively. It is a worth noting that,
we consider each set of weights for each data sample separately, and the
above weights are just the average over entire testing set (e.g., 10k
samples), while the full statistic (mean $\pm$ std) of weights can be
seen in Table 2. In order to make the experiment to be more
comprehensive with diverse initialization, we use two additional sets
including set C=\[0.22, 0.23, 0.22, 0.33\] and set D=\[0.24, 0.25, 0.24,
0.27\].

Given these above four weights sets A/B/C/D, we then init the standard
MOO with one of these above sets and adjust the learning rate $\eta_w$
with three options 5e-3, 5e-5, 1e-8 and report results in Table below.
The complete attacking progress can be seen in Figure 8. It can be seen
from Table below that better initialization does help to improve the
performance of the standard MOO. The best setting is the initialization
with set D and $\eta_w=\text{5e-3}$ achieves 29.53% in A-All metric, a
4.37% improvement over the default MOO initialization. It can be seen
from the evolution of the weights in Figure 8c that even initializing
with the converged weights (i.e., set A) from the pre-running attack,
the weight of each task does not stand still but converges to a
different value. It is another different behavior in adversarial
generation task compared to the multi-task learning problem. On the
other hand, despite of the extensive tuning, the performance of MOO is
still far below the TA-MOO approach, with the gap of 8.48% in A-All
metric.

|                  | $\eta_{w}=\text{5e-3}$ | $\eta_{w}=\text{5e-5}$ | $\eta_{w}=\text{1e-8}$ |
|------------------|-----------------------|------------------------|---------------------------------------|
| $\text{MOO}^{A}$ | 28.64                 | 29.18                  | 29.12                  |
| $\text{MOO}^{B}$ | 29.13                 | 28.75                  | 28.65                  |
| $\text{MOO}^{C}$ | 29.38                 | 28.46                  | 28.33                  |
| $\text{MOO}^{D}$ | 29.53                 | 28.37                  | 28.18                  |
| MOO              | 25.16                 | -                      | -                      |
| TA-MOO           | 38.01                 | -                      | 

**Recent work \[4, 5, 6\] on multi-task learning has shown that
well-tuned, simple baselines such as scalarizing the objectives with
fixed weights equal to 1 random weights, yields solutions as good as the
ones found by some multi-objective approaches, including MGDA, the base
method for TA-MOO. Given that, and the fact that it seems that the tasks
considered in this submission are similar to the considered multi-task
settings mentioned in \[4, 5, 6\], I wonder if similar conclusions would
be drawn in case extensive tuning of baselines were to be
performed**

Thanks for the suggested references. We find that \[4, 5\] are NeurIPS
22 papers released in Sep 22, while \[6\] is TMLR paper released in Oct 22.  Although they are related, we would consider them as concurrent
works to our ICLR submission. Please also refer to our above discussion
on additional experiments with different initialization sets of weights
for the naive MOO. The extensive tuning does improve the MOO adversary
performance, however, it is still far below the TA-MOO performance.

**As mentioned in the previous section of the review, the manuscript
lacks in the choice of multi-objective optimization baselines. For
example, I believe multi-objective approaches that aim at finding
solutions lying in the central region of the Pareto front \[7, 8\]
should be included, as well as methods that have been shown to prevent
the bias issue in MGD \[9\].**

Please refer to our above discussion on additional experiments with two
recent multi-task learning methods PCGrad and CAGrad.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 8/n) 
comment: \[1\] Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. ICML 2019

\[2\] Bui, et al. \"Improving ensemble robustness by collaboratively
promoting and demoting adversarial robustness.\" AAAI. 2021.

\[3\] Lin, J., Song, C., He, K., Wang, L., and Hopcroft, J. E. Nesterov
accelerated gradient and scale invariance for adversarial attacks. ICLR
2020.

\[4\] Wang, X. and He, K. Enhancing the transferability of adversarial
attacks through variance tuning.CVPR 2021.

\[5\] Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., and Ren, K.
Feature importance-aware transferable adversarial attacks. CVPR 2021.

\[6\] https://github.com/RobustBench/robustbench


**Conflicting between gradients in the adversarial generation task.**

(Please see the complete discussion in Appendix E)

We would like to correct the reviewer comment that the challenge in our
setting is not tasks' confliction as in multi-task learning but the
problem of gradient domination, i.e., gradient of one task is much
stronger than that of other task. In multi-task learning setting,
conflicting between gradient is the common issue to tackle with. More
specifically, the gradients with respect to the (shared) model parameter
of task $f_i$ and task $f_j$ can have a negative correlation (i.e.,
cosine similarity between $\nabla_\theta f_i (\theta, \delta)$ and
$\nabla_\theta f_j (\theta, \delta)$ is negative). However, in the
adversarial generation task, we consider the gradient with respect to
the input (e.g., $\nabla_\delta f(\theta, \delta)$) to update the
adversarial examples. As we explore through empirical experiments, the
issue that we to deal with is not the gradient confliction problem but
the gradient domination problem. These gradients with respect to the
inputs can have a positive correlation but also have a huge difference
in their strengths. In this specific challenge, the standard MOO which
solely relies on the gradient strengths to calculated the weight for
each task is strongly sensitive to the gradient domination problem and
in some cases cannot lead to a good solution as discussed in Appendix
E.1.

To further support our hypothesis, we would like to provide a
measurement on the cosine similarity between gradients of ensemble
members on the ENS setting in Table below. Each cell (row-ith,
column-jth) of the Table reports the cosine similarity between gradient
$\nabla_{\delta}f_{i}(\delta)$ of model ith and gradient
$\nabla_{\delta}f_{j}(\delta)$ of model jth (w.r.t. the same input
$\delta$). It can be seen that the gradients between different
architectures has the positive correlation instead of negative
correlation. On the other hand, as shown in the last row, the gradient
norm $\|\nabla_{\delta}f_{i}(\delta)\|$ varies widely among
architectures. While this observation is in line with the widely
accepted phenomenon about the transferability of adversarial examples,
it also does support our motivation to derive the TA-MOO method to
improve the standard MOO.


|                                    | R               | V               | G               | E	                |
|------------------------------------|-----------------|-----------------|-----------------|--------------------------------|
| R                                  | 1.00 $\pm$ 0.00   | 0.34 $\pm$ 0.15   | 0.44 $\pm$ 0.17   | 0.35 $\pm$ 0.19   |
| V                                  | 0.34 $\pm$ 0.15   | 1.00 $\pm$ 0.00   | 0.36 $\pm$ 0.19   | 0.41 $\pm$ 0.22   |
| G                                  | 0.44 $\pm$ 0.17   | 0.36 $\pm$ 0.19   | 1.00 $\pm$ 0.00   | 0.41 $\pm$ 0.18   |
| E                                  | 0.35 $\pm$ 0.19   | 0.41 $\pm$ 0.22   | 0.41 $\pm$ 0.18   | 1.00 $\pm$ 0.00   |
| $\|\nabla_{\delta}f_{i}(\delta)\|$ | 7.15  $\pm$  6.87 | 4.29  $\pm$  4.64 | 7.35  $\pm$ 7.21 | 0.98 $\pm$ 0.72 |

**Discussion on the convergence of the methods.**

Please refer to our above discussion which have been added in Appendix
E.7.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 7/n) 
comment: 
**Importantly, it is still unclear to me whether there are indeed
conflicts between the objectives in the considered test cases within the
paper. Notably, previous work showed evidence that adversarial attacks
are transferable across different models and architectures \[1, 2\].
Therefore, I believe that in such cases the conflict between gradients
should be negligible. Moreover, since there are no theoretical
guarantees that TA-MOO finds Pareto stationary solutions, empirical
evidence needs to be provided to illustrate why the proposed algorithm
works. As an example, the authors can report quantities such as the norm
of the common descent direction, since for Pareto stationary points this
quantity should be close to zero. Finally, as I mentioned in my review,
I strongly believe the authors should include in the empirical
evaluation further gradient-based multi-objective approaches that aim at
finding solutions in the central region of the Pareto
front**

**Previous work showed evidence that adversarial attacks are
transferable across different models and architectures \[1, 2\]**

We agree that there exist adversarial examples that can jointly attack
several models. However, finding those adversarial examples that can
jointly attack several models is a challenging problem, especially when
the architectures of component models are diverge \[3, 4, 5\]. The
reason is that given a benign example $x$, the joint adversarial space
of all models (i.e., the intersection of adversarial spaces for
component models) is a small sub-space of individual adversarial spaces,
hence making the search for adversarial examples on the joint sub-space
harder. In the context of ensemble learning, previous works \[1,2\]
emphasized the importance of finding joint adversarial examples in
improving the robustness of ensemble models. In Table 4 in Section 4.2,
we demonstrate that adversarial examples from our method when used in
adversarial training help to improve the adversarial robustness the
most.

To further demonstrate the challenge of finding the joint adversarial
examples, we conduct an experiment on the ENS setting with the ImageNet
dataset. We choose an ensemble of 3 models: robust pre-trained ResNet18,
robust pre-trained ResNet50, and non-robust pre-trained ResNet50. These
pre-trained models are available on the RobustBench repository \[6\]. We
use PGD-Linf ($k=20,\epsilon=4/255,\eta=1/255$) to craft adversarial
examples of each member, independently. We then use these crafted
adversarial examples to attack other members and measure the success
attack rate (higher SAR means they are transferable better). We also
measure the SAR-All which indicates the rate of adversarial examples
successfully attacking all members. We report the result in the Table
below, where a cell (row i, column j) represents a SAR of adversarial
examples from model "i" attack model "j".

It can be seen that the adversarial examples are not transferable well
in our setting. More surprisingly, the adversarial examples crafted from
a robust model do not attack well the non-robust model. For example, the
adversarial examples crafted from the ResNet18 model have 54.10% SAR to
attack itself, however, obtain only 28.30% (a drop by 25.80%) when
attacking the ResNet50 model, and obtain only 14.70% (a drop by 39.40%)
when attacking non-robust ResNet50 model.

| LE-UNTAR | SAR-All | R18   | R50   | STD	 |
|----------|---------|-------|-------|-------|
| R18      | 11.90   | 54.10 | 28.30 | 14.70 |
| R50      | 15.90   | 40.40 | 44.20 | 18.50 |
| STD      | 18.90   | 28.90 | 20.20 | 100.0 |

We also evaluate on the more robust ensemble set which includes ResNet18
(model ID: Salman2020Do_R18, robust accuracy 25.32%), ResNet50 (model
ID: Salman2020Do_R50, robust accuracy 34.96%) and ResNet50 (model ID:
Wong2020Fast, robust accuracy 26.24%). It can be seen that there is a
notable drop in attacking performance when transferring adversarial
examples across models.

| RE-UNTAR | SAR-All | R18   | R50   | R50-2 |
|----------|---------|-------|-------|-------|
| R18      | 26.60   | 54.10 | 28.30 | 41.70 |
| R50      | 32.80   | 40.40 | 44.20 | 41.90 |
| R50-2    | 27.00   | 40.90 | 29.20 | 56.60 |

(The experimental result can be reproduced easily based on the standard
PGD-Linf implementation and the pretrained models on RobustBench).

*To summarize, while the transferability of adversarial examples is
widely accepted, we demonstrate that finding joint adversarial examples
is a challenging problem, especially in our setting. We show that the
standard adversarial attacks which do not consider tradeoffs between
ensemble members achieve a low transferability. As discussed in Section
4.2 and Appendix D.1, our method on the other hand can help to improve
adversarial robustness because of the ability to find better joint
adversarial examples.*

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 6/n) 
comment: 
**The authors claim that in some cases multi-objective optimization does
not work. However, it is not clear to me if this is indeed the case. In
more details, the purpose of (unconstrained) multi-objective
optimization is to find a point within the Pareto front, and, perhaps in
the case of the reported results MOO was able to find point in a region
of the Pareto front that does not yield equally good performance across
all objectives, which means it is actually "working". I would like to
learn more about the authors' opinion on this aspect and suggest a more
detailed discussion is added to the manuscript**

(We have added the discussion in Appendix E.7)

First, we would like to recall the definition of the Pareto optimality.
Given $m$ objective function
$f(\delta) \triangleq [f_1(\delta), ..., f_m(\delta)]$, the Pareto
optimality $\delta^*$ of the multi-objective optimization
$\delta^* = \underset{\delta}{\text{argmax}} f(\delta)$ if there is no
feasible solution $\delta'$ such that is strictly better than $\delta^*$
in some tasks (i.e., $f_i(\delta') > f_i(\delta^*)$ for some $i$) while
equally good as $\delta^*$ in all other tasks (i.e.,
$f_j(\delta') = f_j(\delta^*), j \neq i$).

With this definition, we now would like to discuss about the attacking
progress of MOO and TA-MOO as shown in Figure 7 in the Appendix. It can
be seen from the loss progress of the MOO adversary in Figure 7a that
(i) from iteration 1st to around iteration 10th all the losses are
increased quickly showing that the method optimize efficiently; (ii)
after iteration 10th, the loss w.r.t. the EfficientNet model (i.e.,
model3 in the Figure) continually increases while other losses
continually decrease. Therefore, any solution after iteration 10th do
not dominate each other indicating that the method reaches the (local)
Pareto front.

On the other hand, it can be seen from Figure 7b that the loss progress
of our TA-MOO is more stable. TA-MOO also can optimize to the optimal
point efficiently as MOO does, however, after reaching the peak, the
losses in all tasks are more stable than those in MOO. This observation
indicates that the solutions after the peak point are also in the
(local) Pareto front but are more concentrated than those in MOO. It can
explain the stability of the success attack rate in TA-MOO in Figure 7b.
Comparing across both MOO and TA-MOO at their last iteration shows that
while the loss w.r.t. the EfficientNet model (model3) in MOO is a bit
higher than that in TA-MOO, these other losses w.r.t. V/G/E models in
MOO is lower than those in TA-MOO. This observation indicates that in
term of losses, the solutions of MOO and TA-MOO do not dominate each
other. However, the solution of TA-MOO is more stable and leads better
final attacking performance.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 5/n) 
comment: 
**Additional experiments with SOTA multi-task learning methods?**
Finally, as suggested, we compare to PCGrad and CAGrad which are two
more advanced baselines that outperform \[3\] in the multi-task learning
setting. To follow your suggestion, we applied two recent methods PCGrad
\[1\] and CAGrad \[2\] with implementation from their project
repositories on attacking ensemble of models setting. For PCGrad we use
the *sum* as the reduction mode. For CAGrad we use parameter
$\alpha=0.5$ and $\text{rescale}=1$ as in their default setting. We use
two ensemble settings, diverse set with 4 different architectures
including R-ResNet18, V-VGG16, G-GoogLeNet, E-EfficientNet and
non-diverse set with 4 ResNet18 models.

It can be seen from the Table below that in the diverse ensemble
setting, the two additional methods significantly outperform the
standard MOO method with the improvement gaps of SAR-All around 3% and
5%, respectively. In the non-diverse ensemble setting, while PCGrad
achieves a lower performance than the standard MOO method, CAGrad can
outperform the MOO method with a 2.7% improvement. The improvement on
the diverse set of PCGrad and CAGrad over the standard MOO method is
more noticeable than on the non-diverse set. It can be explained by the
fact that on the diverse set of model architectures, there is a huge
difference in gradients among architectures, therefore, requires a
better multi-task learning method to handle the constraint between
tasks. On the other hand, on both ensemble settings, our TA-MOO still
achieves the best performance, with a huge gap of (5.8%) 7.8% compared
to the second best method on the (non) diverse setting. It is because
our method can leverage a supervised signal from knowing whether a task
is achieved or not to focus on improving unsuccessful tasks. It is a
huge advantage compared to unsupervised multi-task learning methods as
MOO, PCGrad, and CAGrad.

*Please see the complete discussion in Appendix E.5*

|    |         | A-All | A-Avg | R/R1  | V/R2  | G/R3  | E/R4  |
|----|---------|-------|-------|-------|-------|-------|-------|
| D  | Uniform | 28.21 | 48.34 | 48.89 | 49.08 | 48.38 | 47.03 |
|    | PCGrad  | 28.25 | 48.28 | 48.81 | 49.03 | 48.13 | 47.14 |
|    | CAGrad  | 30.23 | 48.34 | 47.03 | 48.22 | 45.92 | 52.20 |
|    | MOO     | 25.16 | 44.76 | 39.06 | 46.83 | 37.05 | 56.11 |
|    | TA-MOO  | 38.01 | 51.10 | 49.55 | 52.15 | 49.29 | 53.40 |
| ND | Uniform | 28.17 | 48.75 | 51.94 | 45.55 | 54.15 | 43.34 |
|    | PCGrad  | 28.30 | 48.75 | 52.02 | 45.42 | 54.35 | 43.21 |
|    | CAGrad  | 35.22 | 51.07 | 54.22 | 47.84 | 55.24 | 46.97 |
|    | MOO     | 32.50 | 52.21 | 53.25 | 49.05 | 56.80 | 49.76 |
|    | TA-MOO  | 41.01 | 57.33 | 58.88 | 55.32 | 60.81 | 54.29 |


\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021.

\[3\] Lin et al. \"Pareto multi-task learning\", 2019

\[4\] Kurin et al. "In defense of the unitary scalarization for deep
multi-task learning", NeurIPS 2022.

\[5\] Xin et al. \"Do Current Multi-Task Optimization Methods in Deep
Learning Even Help?", NeurIPS 2022.

\[6\] Lin et al. "Reasonable Effectiveness of Random Weighting: A Litmus
Test for Multi-Task Learning", TMLR 2022.

\[7\] Albuquerque et al. \"Multi-objective training of generative
adversarial networks with multiple discriminators\", 2019.

\[8\] Miranda et al. "Single-solution hypervolume maximization and its
use for improving generalization of neural networks", 2016.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 4/n) 
comment: **Lack of strong baselines: I believe using unconstrained MGD (referred
to in the manuscript as MOO) is not a fair choice of baseline in a case
where it is known a priori that the desired solutions are in the central
region of the Pareto front since MGD has no mechanism whatsoever to
incorporate user preferences to guide the optimization. In the following
section of the review I suggest stronger baselines to be
considered**

**Comparing with more baselines as you suggested**

Thanks for the suggested references. We find that \[4, 5\] are NeurIPS
22 papers released in Sep 22, while \[6\] is TMLR paper released in Oct 22.  
Although they are related, we would consider them as concurrent
works to our ICLR submission.

Second, \[7\] was developed for generative adversarial networks with
multiple discriminators via hypervolume maximization. However, there is
no experiments on even standard multi-task learning in that work.

Third, \[8\] did only experiment on MNIST for some behavior studies. But
the paper did not compare with any baselines.

Fourth, for \[3\], it maintains and outputs multiple adversarial
examples, hence it is unfair to compare to our method which only uses
one adversarial example. Next, please refer to our answer for the next
question to see why it intuitively does not suit our task.

**Discussion about \[3\] in our problem context?**

As mentioned in \[3\], the user preference might be useful in some
applications such as recommendation system, self-driving car, AI
assistance. The reason is that this would provide diverge solutions to
serve diverge user requirements.

In our context, consider a clean example $x$ and the epsilon ball
$B_\epsilon(x)$, assume that we have three models with three loss
functions $L_1(.), L_2(.), L_3(.)$ and we use the preference vector
$v = [1, 1, 1]$. This implies that we have three restricted regions
$G_1 = \{x' \in B_\epsilon(x): L_1(x') > L_2(x'), L_3(x')\}$,
$G_2 = \{x' \in B_\epsilon(x): L_2(x') > L_1(x'), L_3(x')\}$, and
$G_3 = \{x' \in B_\epsilon(x): L_3(x') > L_1(x'), L_2(x')\}$. We need to
minimize the loss functions constrained by $G_1, G_2$ or $G_3$. Let
consider $G_1$. We aim to find the adversarial example $x^a$ such that
$L_1(x^a) > L_2(x^a), L_3(x^a)$. This means that the optimizer favors
the first attack task and less care the other two attack tasks.
Therefore, it maximizes the chance that $x^a$ attacks successfully the
first model, but in return reduce the chance that $x^a$ attacks
successfully three models. Moreover, this is opposite to the principle
we design our method, that is, balancing the attack performances on
three models for maximizing the chance to attack successfully all three.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 3/n) 
comment: 
**Alternative approach to analyze the convergence.** We would like to
propose a simple alternative approach to quantify the convergence of our
method in the adversarial generation setting. More specifically, we
leverage the advantage of the adversarial generation task such that we
can access to the label to audit whether the task is successful or not.
Therefore, we simply measure the loss and the success attack rate over
all attack iterations as shown in Figure 7 in the Appendix.

First, we would like to recall the definition of the Pareto optimality.
Given $m$ objective function
$f(\delta) \triangleq [f_1(\delta), ..., f_m(\delta)]$, the Pareto
optimality $\delta^*$ of the multi-objective optimization
$\delta^* = \underset{\delta}{\text{argmax}} f(\delta)$ if there is no
feasible solution $\delta'$ such that is strictly better than $\delta^*$
in some tasks (i.e., $f_i(\delta') > f_i(\delta^*)$ for some $i$) while
equally good as $\delta^*$ in all other tasks (i.e.,
$f_j(\delta') = f_j(\delta^*), j \neq i$). Bear this definition in mind,
it can be seen from the loss progress of our MOO attack in Figure 7a
that (i) from iteration 1st to around iteration 10th all the losses are
increased quickly showing that the method optimize efficiently; (ii)
after iteration 10th, the loss w.r.t. the EfficientNet model (i.e.,
model3 in the Figure) continually increases while other losses
continually decrease. Therefore, any solution after iteration 10th do
not dominate each other indicating that the method reaches the (local)
Pareto front.

On the other hand, it can be seen from Figure 7b that the loss progress
of our TA-MOO is more stable. TA-MOO also can optimize to the optimal
point efficiently as MOO does, however, after reaching the peak, the
losses in all tasks are more stable than those in MOO. This observation
indicates that the solutions after the peak point are also in the
(local) Pareto front but are more concentrated than those in MOO. It can
explain the stability of the success attack rate in TA-MOO in 7b.
Comparing across both MOO and TA-MOO at their last iteration shows that
while the loss w.r.t. the EfficientNet model (model3) in MOO is a bit
higher than that in TA-MOO, these other losses w.r.t. V/G/E models in
MOO is lower than those in TA-MOO. This observation indicates that in
term of losses, the solutions of MOO and TA-MOO do not dominate each
other. However, the solution of TA-MOO is more stable and leads better
final attacking performance.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 2/n) 
comment: **Limited evaluation: the main contribution of this work is proposing a
variation of a gradient-based multi-objective optimization algorithm
capable of dealing with objectives that converge at different rates.
However, it is not clear to me whether the choice of problems for
evaluation is in fact suffering from the issue TA-MOO is proposed to
solve. Moreover, the experiments in the main paper do not analyze
important aspects of the proposed algorithm, such as if it is able to
reach Pareto stationary solutions in practical
applications;**

(Please see the complete discussion in Appendix E.7)

We would like to answer the question about analyzing the convergence to
Pareto stationary points of our method from theoretical and practical
perspectives.

**Theoretical perspective.** Let us consider some recent SOTA works
using MOO in multi-task learning.

For \[1\], there is no theoretical analysis about the convergence to
Pareto front. Theorem 2 in that paper is not about the convergence to
Pareto front. Additionally, it requires the loss $L$ is differentiable
and the gradient of $L$ is Lipschitz continuous with constant $L > 0$
(i.e., strongly convex). Given this constraint, it is questionable
whether the method is realistic for the loss function of deep learning
models.

For \[2\], Theorem 3.2 in this paper states that the fixed points of
this approach converge to the Pareto stationary points of
${L_0, L_1,...,L_K}$ ($L_0$ is the average of $L_1,...,L_K$). Here we
note that this theorem requires the losses ${L_0, L_1,...,L_K}$ are all
**strongly convex**. Also, Pareto stationary points are much weaker than
Pareto optimality.

For \[3\] (the paper you mentioned), there is no theoretical analysis
about the convergence to Pareto stationary points or Pareto front.

For \[4\] (the paper you mentioned), this work provides largescale
empirical study of the algorithms presented in the literature and has no
theory about the convergence to Pareto stationary points or Pareto
front.

For \[5\] (the paper you mentioned), Theorem 1 in that paper proves the
convergence to the average of the task losses with the weight $\lambda$,
hence not the convergence to Pareto stationary points or Pareto front.
Again, the proof requires strongly convex functions together with
another unrealistic Assumption 1 in the general context of deep
learning.

For \[6\] (the paper you mentioned), this work aims to find the solution
of MOO satisfying a given user reference vector $u$ and has no theory
guaranty about the convergence Pareto stationary points or Pareto front.

\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021.

\[3\] Navon, A., Shamsian, A., Achituve, I., Maron, H., Kawaguchi, K.,
Chechik, G. and Fetaya, E., 2022. Multi-task learning as a bargaining
game. ICML 2022.

\[4\] Xin et al. \"Do Current Multi-Task Optimization Methods in Deep
Learning Even Help?", 2022.

\[5\] Lin et al. "Reasonable Effectiveness of Random Weighting: A Litmus
Test for Multi-Task Learning", 2022.

\[6\] Lin et al. \"Pareto multi-task learning\", ICML 2019.

**Practical perspective.** Among all of aforementioned works, some of
them experimented the convergence behavior only on synthetic functions
with a few variables. None of aforementioned works demonstrated the
evidence of convergence to Pareto front for real deep learning models.

In multi-task learning, the gradient of each task is calculated with
respect to the (shared) model parameter (e.g.,
$\nabla_\theta f(\theta, \delta)$). Therefore, to quantify the
convergence of a multi-task learning method, we can measure the gradient
norm of the comment gradient direction to quantify the convergence of
the model. The gradient norm is expected to be a very small value when
the model reaches to the Pareto optimality points. However, in
adversarial generation problem, the gradient of each task is calculated
with respect to the input (e.g., $\nabla_\delta f(\theta, \delta)$).
Therefore, unlike in the multi-task learning, there is a different
behavior of gradient in the adversarial generation task. To verify our
hypothesis, we measure the gradient norm of the gradient over all attack
iterations and visualize in Figure 6 in the Appendix. It can be seen
that the gradient norm of all attacks tends to converge to a large
value. It is a worth noting that we use projected gradient descent with
$l_\infty$ in all attacks. Therefore, in each attack iteration, the
amount to update is not the gradient $\nabla_\delta f(\theta, \delta)$
but the sign of it scaling with a step size $\eta_\delta$. However,
there is still an interesting observation such that our MOO and TA-MOO
attack have a much lower gradient norm than other attacks.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer g196 (part 1/n) 
comment: We thank the Reviewer for the insightful comments. Please find our
response to your concerns below. For the detail discussions, please
refer to the additional Appendix E.5 (additional experiments with SOTA
multi-task learning method), Appendix E.6 (discussion on the conflicting
between gradients), Appendix E.7 (discussion on the convergence of our
method) and Appendix E.8 (additional experiments with different
initializations). We really appreciate your time and effort for
reviewing our work.

**Lack of motivation for the contribution: one of the main claims of this
work is "multi-objective optimization is a natural tool for adversarial
example generation", however, other than the fact that there are
multiple objectives to be simultaneously satisfied, I am not able see
why this is the case since there is no clear evidence that there is a
tradeoff between the objectives when generating adversarial
examples;**

We believe that there exists a tradeoff in generating adversarial
examples with multiple objectives and a better tradeoff is critical to
make sure all objectives are satisfied. Motivated by this, our paper
proposes a new framework for finding better tradeoffs.

Specifically, let us consider the case of generating adversarial
examples for ensemble of models. Because we do not assume the diversity
of members and their robustness in an ensemble, therefore, an ensemble
can include either robust pre-trained or non-robust pre-trained models.
Therefore, if an attacker considers all members equally, the adversarial
examples crafted from a non-robust member are not assured to be
transferable to the robust member. An adaptive weighting strategy should
be required to assign a more critical factor to attacking the robust
member.

In addition to the above analysis, in Appendix D.1., we have provided
the empirical evidence to show the motivation of using multi-objective
optimization in our adversarial generation setting. More specifically,
we evaluated the transferability of adversarial examples when attacking
different models. We showed that the standard adversarial attack which
do not consider tradeoff between ensemble members achieves the lowest
transferability. In contrast, our TA-MOO can achieve the highest
transferability on a diverse set of ensembles. The experimental results
show that adversarial examples generated by our method can reach the
intersection of adversarial regions of ensemble members, therefore, can
be transferred better. More importantly, as discussed in Appendix D.2.
we showed that adversarial examples produced by our attack can benefit
adversarial training and really improve the adversarial robustness of
ensemble model.

**multi-objective optimization is a natural tool for adversarial example
generation**

The above conclusion should not be understand out of the context such
that in some scenarios, there should be multi objectives to be
considered, therefore, multi-objective optimization is the natural tool
for that. The standard adversarial examples of course, should not be
considered as MOO. We have revised the abstract to make it more clear.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer H7Re
comment: We thank the Reviewer for the insightful comments and really appreciate
your time and effort for reviewing our work. Thanks a lot for the high
rating to our paper. Please find our response to your remain concern
below.

**The paper did not fully explained the evaluation metrics. Why does the
A-All is the most important metric for this task?**

In the paper, we investigate attacking performance of our proposed MOO
and TA-MOO attack on the three adversarial generation tasks (adversarial
attack) and also study how our adversarial examples can benefit
adversarial robustness of an ensemble model (adversarial defense). For
experiments on adversarial defense, we use the robust accuracy as the
most important metric to verify the robustness of an ensemble model
against adversarial attacks. For experiments on adversarial attack, we
use three metrics to evaluate the attack performance including A-All:
the Attack Success Rate when an adversarial example can achieve goals in
all tasks, A-Avg: the average Attack Success Rate over all tasks and
$\\{A_i\\}_{i=1}^m$: Attack Success Rate in each individual task. The key
problem studied in this paper is generating adversarial examples can be
successful in each and every task. Therefore, A-All is considered as the
most important metric when evaluating attackers' performances.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer Fq8c (part 3/n, n=3) 
comment: 
**I am not quite sure if the novelty is strong or not since the proposed
method just applies multi-objective optimization. Also, I am not sure
whether the proposed regularizer is already proposed in the
multi-objective optimization before or not**

We believe that ours is the first work that tailors multi-objective
optimization (MOO) to adversarial generation for classification problem.
Moreover, we carefully investigate the behaviors of MOO when applied to
our problem in Section 4.1 and Appendix E.1 and observe that a naive
application of the MOO framework suffers from the gradient domination
problem, hence leading to a few adversarial generation tasks progress
really well, while others do not. We then propose Task Oriented
Multi-Objective Optimization (TA-MOO) to balance the progress of the
adversarial generation tasks.

Our proposed geometric-based regularization term is intuitive, simple
and efficient as proved by our comprehensive experiments. We believe
that the simplicity of this technique should be considered as an
advantage given the fact that it performs well in our comprehensive
experiments.

To show that a simple adaption of an arbitrary MOO method to the
adversarial generation problem studied in our paper does not work well,
we further compare with to recent SOTA methods in MOO-based multi-task
learning PCGrad \[1\] and CAGrad \[2\] with implementation from their
project repositories on attacking ensemble of models setting. For PCGrad
we use the *sum* as the reduction mode. For CAGrad we use parameter
$\alpha=0.5$ and $\text{rescale}=1$ as in their default setting. We use
two ensemble settings, diverse set with 4 different architectures
including R-ResNet18, V-VGG16, G-GoogLeNet, E-EfficientNet and
non-diverse set with 4 ResNet18 models.

It can be seen from the Table below that in the diverse ensemble
setting, the two additional methods significantly outperform the
standard MOO method with the improvement gaps of SAR-All around 3% and
5%, respectively. In the non-diverse ensemble setting, while PCGrad
achieves a lower performance than the standard MOO method, CAGrad can
outperform the MOO method with a 2.7% improvement. The improvement on
the diverse set of PCGrad and CAGrad over the standard MOO method is
more noticeable than on the non-diverse set. It can be explained by the
fact that on the diverse set of model architectures, there is a huge
difference in gradients among architectures, therefore, requires a
better multi-task learning method to handle the constraint between
tasks. On the other hand, on both ensemble settings, our TA-MOO still
achieves the best performance, with a huge gap of (5.8%) 7.8% compared
to the second best method on the (non) diverse setting. It is because
our method can leverage a supervised signal from knowing whether a task
is achieved or not to focus on improving unsuccessful tasks. It is a
huge advantage compared to unsupervised multi-task learning methods as
MOO, PCGrad, and CAGrad.

*Please see the complete discussion in Appendix E.5*

|    |         | A-All | A-Avg | R/R1  | V/R2  | G/R3  | E/R4  |
|----|---------|-------|-------|-------|-------|-------|-------|
| D  | Uniform | 28.21 | 48.34 | 48.89 | 49.08 | 48.38 | 47.03 |
|    | PCGrad  | 28.25 | 48.28 | 48.81 | 49.03 | 48.13 | 47.14 |
|    | CAGrad  | 30.23 | 48.34 | 47.03 | 48.22 | 45.92 | 52.20 |
|    | MOO     | 25.16 | 44.76 | 39.06 | 46.83 | 37.05 | 56.11 |
|    | TA-MOO  | 38.01 | 51.10 | 49.55 | 52.15 | 49.29 | 53.40 |
| ND | Uniform | 28.17 | 48.75 | 51.94 | 45.55 | 54.15 | 43.34 |
|    | PCGrad  | 28.30 | 48.75 | 52.02 | 45.42 | 54.35 | 43.21 |
|    | CAGrad  | 35.22 | 51.07 | 54.22 | 47.84 | 55.24 | 46.97 |
|    | MOO     | 32.50 | 52.21 | 53.25 | 49.05 | 56.80 | 49.76 |
|    | TA-MOO  | 41.01 | 57.33 | 58.88 | 55.32 | 60.81 | 54.29 |

\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer Fq8c (part 2/n) 
comment: **The proposed settings are kind of similar to each other. A better
setting will be generating adversarial examples with the different norms
and proposing a defense to defend against several norms attacking at the
same time.**

We would like to discuss about the attacking with multiple norms setting
as in \[1\] to show that applying our methods to this setting is not
straightforward.

Firstly, our methods works on a set of gradients of each task w.r.t. the
input to calculate the weights, i.e.,
$\{\nabla_\delta f_i(\delta)\}_{i=1}^m$ where $\delta$ is the input
and $f_i$ is the objective of the $i$th task. While these gradients are
available for almost of adversarial generation settings, it is not
really ready in the setting of attacking with multiple norms.

More specifically, let us recall the updating step to find adversarial
examples using projected steepest descent as in Section 3 in \[1\] below:

$\delta^{t+1}=\mathcal{P}_{p,\epsilon}(\delta^t + v_p(\delta))$

where $\mathcal{P}_{p,\epsilon}$ is the projection operation to project
back the ball $\epsilon$ with distance norm $p$ and $v_p(\delta)$ is the
direction of steepest descent.

$v_p(\delta) = \underset{\| v \|_p \leq \eta}{ \text{argmax} } \; v^T \nabla_\delta f(\delta)$

where $\eta$ is step size.

Therefore, in each updating step, the gradient is the same across
multiple norms. Each solution $\delta_p^{t+1}$ is different in the way
of doing projection. For example, if using norm $\infty$ the updated
version as below:

$\delta^{t+1}= \text{clip}_{[-\epsilon, \epsilon]} (\delta^t + \eta \; \text{sign} (\nabla_\delta f(\delta)))$

which means that every pixels in an image will be updated. However, if
using norm 1, as the common optimization solver, only some of pixels of
an image will be updated. Secondly, the step size $\eta$ and
perturbation bound $\epsilon$ are very different across norms, i.e.,
$\epsilon=0.03, \eta=0.003$ with $p=\infty$, $\epsilon=0.5, \eta=0.05$
with $p=1$ and $\epsilon=12, \eta=0.05$ with $p=1$ all for the same
CIFAR10 dataset. Therefore, it is ambiguous to consider gradients of all
norms together.

On the other hand, please note that our experiments are comprehensive
with 3 different attack settings and 1 adversarial training setting
across 6 architectures including ResNet, VGG, GoogLeNet, EfficientNet,
MobileNet and WideResNet and 3 datasets including CIFAR10/100 and
ImageNet. We conduct experiments to not only show that our MOO and
TA-MOO methods works but also study in very detail multiple aspects of
our methods which we believe that support our claim. Please refer to our
Appendix for detail.

\[1\] Maini, Pratyush, Eric Wong, and Zico Kolter. \"Adversarial
robustness against the union of multiple perturbation models.\" ICML
2020.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer Fq8c (part 1/n) 
comment: 
We thank the Reviewer for the insightful comments. Please find our
response to your concerns below. For the detail discussions, please
refer to the additional Appendix E.5 (additional experiments with SOTA
multi-task learning method). We really appreciate your time and effort
for reviewing our work.

**To my understanding, the proposed framework could only be applied into
the ensemble that uses the max, min, and majority vote as its
aggregation rule. It is not clear if the proposed method still works if
the ensemble is taking the average of every model's
output.**

Thanks for this question. To simplify the context, we consider three
models $f^1_\theta(x), f^2_\theta(x)$, and $f^3_\theta(x)$. The average
ensemble model is hence
$f_\theta(x) = \frac{1}{3}f^1_\theta(x) + \frac{1}{3}f^2_\theta(x) + \frac{1}{3}f^3_\theta(x)$.
To attack this single average ensemble model, we just need to run a
normal PGD attack. However, the adversarial example $x^a$ can only
attack the ensemble model $f_\theta$ successfully. But in our case, we
desire all three component models can be attacked successfully, which
cannot be guaranteed by the above simple method.

Additionally, finding those adversarial examples that can jointly attack
several models is a challenging problem, especially when the
architectures of component models are diverge \[3, 4, 5\]. The reason is
that given a benign example $x$, the joint adversarial space of all
models (i.e., the intersection of adversarial spaces for component
models) is a small sub-space of individual adversarial spaces, hence
making the search for adversarial examples on the joint sub-space
harder. In the context of ensemble learning, previous works \[1,2\]
emphasized the importance of finding joint adversarial examples in
improving the robustness of ensemble models. In Table 4 in Section 4.2,
we demonstrate that adversarial examples from our method when used in
adversarial training help to improve the adversarial robustness the
most.

\[1\] Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. ICML 2019

\[2\] Bui, et al. \"Improving ensemble robustness by collaboratively
promoting and demoting adversarial robustness.\" AAAI. 2021.

\[3\] Lin, J., Song, C., He, K., Wang, L., and Hopcroft, J. E. Nesterov
accelerated gradient and scale invariance for adversarial attacks. ICLR
2020.

\[4\] Wang, X. and He, K. Enhancing the transferability of adversarial
attacks through variance tuning.CVPR 2021.

\[5\] Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., and Ren, K.
Feature importance-aware transferable adversarial attacks. CVPR 2021.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer aC9i (part 4/n, n=4) 
comment: 
**Alternative approach to analyze the convergence.** We would like to
propose a simple alternative approach to quantify the convergence of our
method in the adversarial generation setting. More specifically, we
leverage the advantage of the adversarial generation task such that we
can access to the label to audit whether the task is successful or not.
Therefore, we simply measure the loss and the success attack rate over
all attack iterations as shown in Figure 7 in the Appendix.

First, we would like to recall the definition of the Pareto optimality.
Given $m$ objective function
$f(\delta) \triangleq [f_1(\delta), ..., f_m(\delta)]$, the Pareto
optimality $\delta^*$ of the multi-objective optimization
$\delta^* = \underset{\delta}{\text{argmax}} f(\delta)$ if there is no
feasible solution $\delta'$ such that is strictly better than $\delta^*$
in some tasks (i.e., $f_i(\delta') > f_i(\delta^*)$ for some $i$) while
equally good as $\delta^*$ in all other tasks (i.e.,
$f_j(\delta') = f_j(\delta^*), j \neq i$). Bear this definition in mind,
it can be seen from the loss progress of our MOO attack in Figure 7a
that (i) from iteration 1st to around iteration 10th all the losses are
increased quickly showing that the method optimize efficiently; (ii)
after iteration 10th, the loss w.r.t. the EfficientNet model (i.e.,
model3 in the legend) continually increases while other losses
continually decrease. Therefore, any solution after iteration 10th do
not dominate each other indicating that the method reaches the Pareto
front.

Second, it can be seen from Figure 7b that the loss progress of our
TA-MOO is more stable. TA-MOO also can optimize to the optimal point
efficiently as MOO does, however, after reaching the peak, the losses in
all tasks are more stable than those in MOO. This observation indicates
that the solutions after the peak point are also in the Pareto front but
are more concentrated than those in MOO. It can explain the stability of
the success attack rate in TA-MOO in Figure 7b.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer aC9i (part 3/n) 
comment: **From the perspective of multi-objective optimisation theory, any
analysis in terms of convergence and Pareto-optimal frontier is
essential**

(Please see the complete discussion with additional Tables and Figures
in Appendix E.7)

We would like to answer the question by analyzing the convergence to
Pareto stationary points of our method from theoretical and practical
perspectives.

**Theoretical perspective.** Let us consider some recent SOTA works
using MOO in multi-task learning.

For \[1\], there is no theoretical analysis about the convergence to
Pareto front. Theorem 2 in that paper is not about the convergence to
Pareto front. Additionally, it requires the loss $L$ is differentiable
and the gradient of $L$ is Lipschitz continuous with constant $L > 0$
(i.e., strongly convex). Given this constraint, it is questionable
whether the method is realistic for the loss function of deep learning
models.

For \[2\], Theorem 3.2 in this paper states that the fixed points of
this approach converge to the Pareto stationary points of
${L_0, L_1,...,L_K}$ ($L_0$ is the average of $L_1,...,L_K$). Here we
note that this theorem requires the losses ${L_0, L_1,...,L_K}$ are all
**strongly convex**. Also, Pareto stationary points are much weaker than
Pareto optimality.

For \[3\], there is no theoretical analysis about the convergence to
Pareto stationary points or Pareto front.

For \[4\], this work provides largescale empirical study of the
algorithms presented in the literature and has no theory about the
convergence to Pareto stationary points or Pareto front.

For \[5\], Theorem 1 in that paper proves the convergence to the average
of the task losses with the weight $\lambda$, hence not the convergence
to Pareto stationary points or Pareto front. Again, the proof requires
strongly convex functions together with another unrealistic Assumption 1
in the general context of deep learning.

For \[6\], this work aims to find the solution of MOO satisfying a given
user reference vector $u$ and has no theory guaranty about the
convergence Pareto stationary points or Pareto front.

\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021.

\[3\] Navon, A., Shamsian, A., Achituve, I., Maron, H., Kawaguchi, K.,
Chechik, G. and Fetaya, E., 2022. Multi-task learning as a bargaining
game. ICML 2022.

\[4\] Xin et al. \"Do Current Multi-Task Optimization Methods in Deep
Learning Even Help?", 2022.

\[5\] Lin et al. "Reasonable Effectiveness of Random Weighting: A Litmus
Test for Multi-Task Learning", 2022.

\[6\] Lin et al. \"Pareto multi-task learning\", ICML 2019.

**Practical perspective.** In multi-task learning, the gradient of each
task is calculated with respect to the (shared) model parameter (e.g.,
$\nabla_\theta f(\theta, \delta)$). Therefore, to quantify the
convergence of a multi-task learning method, we can measure the gradient
norm of the comment gradient direction to quantify the convergence of
the model. The gradient norm is expected to be a very small value when
the model reaches to the Pareto optimality points. However, in
adversarial generation problem, the gradient of each task is calculated
with respect to the input (e.g., $\nabla_\delta f(\theta, \delta)$).
Therefore, unlike in the multi-task learning, there is a different
behavior of gradient in the adversarial generation task. To verify our
hypothesis, we measure the gradient norm of the gradient over all attack
iterations and visualize in Figure 6 in the Appendix. It can be seen
that the gradient norm of all attacks tends to converge to a large
value. It is a worth noting that we use projected gradient descent with
$l_\infty$ in all attacks. Therefore, in each attack iteration, the
amount to update is not the gradient $\nabla_\delta f(\theta, \delta)$
but the sign of it scaling with a step size $\eta_\delta$. However,
there is still an interesting observation such that our MOO and TA-MOO
attack have a much lower gradient norm than other attacks.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer aC9i (part 2/n)
comment: **This problem and considered scenarios are similar in spirit to \[2\].
The proposed regularizer added to the optimisation objective function is
a fairly basic and straightforward trick to weigh different domain
losses. It cannot be considered a sufficient contribution for an ICLR
paper**

We believe that the spirit of our formulation and \[2\] is different.
The formulation of \[2\] does not have the nature of multi-objective
optimization (MOO) because as shown in (1) in the paper, it aims to find
the worst-case weights and optimize the adversarial generation task
losses w.r.t. the worse-case weights. From the MOO perspective, this
formulation cannot guarantee all adversarial generation task losses to
increase simultaneously.

Different from \[2\], our formulation using MOO framework is different
from the one in \[2\] and can guarantee and control better the
adversarial generation task losses. Moreover, we carefully investigate
the behaviors of MOO when applied to our problem in Section 4.1 and
Appendix E.1 and observe that a naive application of the MOO framework
suffers from the gradient domination problem, hence leading to a few
adversarial generation tasks progress really well, while others do not.
We then propose Task Oriented Multi-Objective Optimization (TA-MOO) to
balance the progress of the adversarial generation tasks.

Our proposed geometric-based regularization term is intuitive, simple
and efficient as proved by our comprehensive experiments. We believe
that the simplicity of this technique should be considered as an
advantage given the fact that it performs well in our comprehensive
experiments.

To show that a simple adaption of an arbitrary MOO method to the
adversarial generation problem studied in our paper does not work well,
we further compare with to recent SOTA methods in MOO-based multi-task
learning CGrad \[1\] and CAGrad \[2\] with implementation from their
project repositories on attacking ensemble of models setting. For PCGrad
we use the *sum* as the reduction mode. For CAGrad we use parameter
$\alpha=0.5$ and $\text{rescale}=1$ as in their default setting. We use
two ensemble settings, diverse set with 4 different architectures
including R-ResNet18, V-VGG16, G-GoogLeNet, E-EfficientNet and
non-diverse set with 4 ResNet18 models.

It can be seen from the Table below that in the diverse ensemble
setting, the two additional methods significantly outperform the
standard MOO method with the improvement gaps of SAR-All around 3% and
5%, respectively. In the non-diverse ensemble setting, while PCGrad
achieves a lower performance than the standard MOO method, CAGrad can
outperform the MOO method with a 2.7% improvement. The improvement on
the diverse set of PCGrad and CAGrad over the standard MOO method is
more noticeable than on the non-diverse set. It can be explained by the
fact that on the diverse set of model architectures, there is a huge
difference in gradients among architectures, therefore, requires a
better multi-task learning method to handle the constraint between
tasks. On the other hand, on both ensemble settings, our TA-MOO still
achieves the best performance, with a huge gap of (5.8%) 7.8% compared
to the second best method on the (non) diverse setting. It is because
our method can leverage a supervised signal from knowing whether a task
is achieved or not to focus on improving unsuccessful tasks. It is a
huge advantage compared to unsupervised multi-task learning methods as
MOO, PCGrad, and CAGrad.

|    |         | A-All | A-Avg | R/R1  | V/R2  | G/R3  | E/R4  |
|----|---------|-------|-------|-------|-------|-------|-------|
| D  | Uniform | 28.21 | 48.34 | 48.89 | 49.08 | 48.38 | 47.03 |
|    | PCGrad  | 28.25 | 48.28 | 48.81 | 49.03 | 48.13 | 47.14 |
|    | CAGrad  | 30.23 | 48.34 | 47.03 | 48.22 | 45.92 | 52.20 |
|    | MOO     | 25.16 | 44.76 | 39.06 | 46.83 | 37.05 | 56.11 |
|    | TA-MOO  | 38.01 | 51.10 | 49.55 | 52.15 | 49.29 | 53.40 |
| ND | Uniform | 28.17 | 48.75 | 51.94 | 45.55 | 54.15 | 43.34 |
|    | PCGrad  | 28.30 | 48.75 | 52.02 | 45.42 | 54.35 | 43.21 |
|    | CAGrad  | 35.22 | 51.07 | 54.22 | 47.84 | 55.24 | 46.97 |
|    | MOO     | 32.50 | 52.21 | 53.25 | 49.05 | 56.80 | 49.76 |
|    | TA-MOO  | 41.01 | 57.33 | 58.88 | 55.32 | 60.81 | 54.29 |

*Please see the complete discussion in Appendix E.5*

\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021.

From: ICLR.cc/2023/Conference/Paper2011/Authors
title: Response to Reviewer aC9i (part 1/n)
comment: 
We thank the Reviewer for the insightful comments. Please find our
response to your concerns below. For the detail discussions, please
refer to the additional Appendix E.5 (additional experiments with SOTA
multi-task learning method), Appendix E.7 (discussion on the convergence
of our method). We really appreciate your time and effort for reviewing
our work.

**The novelty of such formulations is not clear to the reviewer. The main
contribution claimed by the authors is that this is the first work that
regards adversarial attacks as a multi-objective optimisation problem.
But, there are some works in the literature which takes this formulation
into consideration in adversarial example generation scenario
(especially, e.g., \[1\], \[2\])**

**Comparing to \[2\].** Most similar to ours is \[2\], however, our work
is substantially different from that work in terms of both concept and
performance gain. First, \[2\] considers the worst-case performance
across all tasks, which, in principle, is hard to generalize to other
tasks, therefore, cannot guarantee to optimize all objectives
simultaneously as ours. Second, as pointed out in Appendix E.4, there is
no clear correlation observed between the loss value and the attack
success rate (ASR), i.e., the higher the loss, the higher the ASR.
Therefore, the higher weighted loss does not directly imply a higher
success rate. The MinMax method \[2\] which solely weighs the tasks'
losses, therefore, does not always achieve a good performance in all the
tasks.

**Comparing to \[1\].** We thank the reviewer for introducing an
interesting paper that we will discuss in the related work section.
\[1\] proposed a framework to attack a generative Deepfake model using
the multi-gradient descent algorithm in their backpropagation step.
While their work also uses the multi-objective optimization for
generating adversarial examples, there are several major differences to
ours. Firstly, their work is for a generative Deepfake model while our
work is for the standard classification problem which is the most common
and important setting in AML. Secondly, we conduct comprehensive
experiments to show that a direct and naive application of MOO to
adversarial generation tasks does not work satisfactorily because of the
gradient dominating problem. Most importantly, we propose the TA-MOO
method which employs a geometry-based regularization term to favor the
unsuccessful tasks, while trying to maintain the performance of the
already successful tasks. We have conducted extensive experiments to
show that our TA-MOO consistently achieves the best attacking
performance across different settings. We also conducted additional
experiments with SOTA multi-task learning methods which are PCGrad \[1\]
and CAGrad \[2\] in Appendix E.5. Compared to these methods, our TA-MOO
still achieves the best attack performance thanks to the Task Oriented
regularization.

Finally, despite our best effort, we were not aware of the work \[1\]
when developing our method. Therefore, we highly appreciate the reviewer
for introducing this work, and to acknowledge this work we have
re-claimed the first contribution in our paper (Section 1) to that
*\"Ours is among the first works that views an adversarial generation
for classification problem as a multi-objective optimization problem and
comprehensively studies the issues when applying multi-objective
optimization to tackle this adversarial generation task\".* As discussed
in our paper, applying directly MOO does not work, therefore we believe
that the most important contribution of our work is introducing TA-MOO
which is novel. We also conduct comprehensive experiments to not only
showcase the merit of our approach but also extensively study different
aspects of the problem that can bring more understanding about MOO.

\[1\] Yu, Tianhe, et al. \"Gradient surgery for multi-task learning.\"
NeurIPS 2020.

\[2\] Liu, Bo, et al. \"Conflict-averse gradient descent for multi-task
learning.\" NeurIPS 2021

From: ICLR.cc/2023/Conference/Paper2011/Reviewer_aC9i
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: The authors propose a method for generating adversarial examples for satisfying multiple goals based on multi-objective optimisation (MOO). The paper can be classified into the family of adversarial attack algorithms. A multi-gradient decent algorithm is utilised to solve the optimisation problem by integrating all gradients w.r.t. different objectives into a single gradient direction, but the optimisation process of MOO always tends to treat all tasks equally. Therefore, a regularisation term is proposed to emphasise unachieved tasks while putting less weight on already satisfying tasks. The paper then gives four experiments, including adversarial attack and training over multiple models, universal perturbation, and adversarial attack over data transformations, to validate the utility of the proposed approach.
strength_and_weaknesses: Strength:

1. The proposed method is basically considering a generating attacks scenario where multiple domain losses are needed to be optimised together simultaneously. The insight behind the technique is to balance the weights of all tasks, and a regularizer is added to push greater weights on unsatisfied tasks.

2. The paper is well-written, and the main idea is easy to follow.

3. Comprehensive experiments show that the proposed method is better than the uniform case and minimax case.


Main concerns:

1. The novelty of such formulations is not clear to the reviewer. The main contribution claimed by the authors is that this is the first work that regards adversarial attacks as a multi-objective optimisation problem. But, there are some works in the literature which takes this formulation into consideration in adversarial example generation scenario (especially, e.g., [1], [2]).

2. This problem and considered scenarios are similar in spirit to [2]. The proposed regularizer added to the optimisation objective function is a fairly basic and straightforward trick to weigh different domain losses. It cannot be considered a sufficient contribution for an ICLR paper.

3. From the perspective of multi-objective optimisation theory, any analysis in terms of convergence and Pareto-optimal frontier is essential.
Reference 

[1] Qiu, H., Du, Y. and Lu, T., 2022. The Framework of Cross-Domain and Model Adversarial Attack against Deepfake. Future Internet, 14(2), p.46.

[2] Wang, J., Zhang, T., Liu, S., Chen, P.Y., Xu, J., Fardad, M. and Li, B., 2021. Adversarial attack generation empowered by min-max optimization. Advances in Neural Information Processing Systems, 34, pp.16020-16033.

clarity,_quality,_novelty_and_reproducibility: See Section Strength And Weaknesses

summary_of_the_review: See Section Strength And Weaknesses

correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 6: marginally above the acceptance threshold

From: ICLR.cc/2023/Conference/Paper2011/Reviewer_Fq8c
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: The paper proposes to use multi-objective optimization to generate adversarial examples for model ensembles, adversarial examples against several transformations, and universal adversarial perturbation. Specifically, by setting the different models in the ensemble as different objectives, it turns the problem into multi-objective optimization. To further improve the performance, a regularizer is then proposed to suppress the successful attack and encourage the unsuccessful attack. Extensive experiments have been done in several cases including generating adversarial examples for model ensembles, adversarial examples against several transformations, and universal adversarial perturbation to show the effectiveness of the proposed method. The experiment results show the proposed method could achieve a better performance compared to several baselines.
strength_and_weaknesses: Pros:
1. The paper is well-written and easy to follow.
2. The experiment results show that the proposed method could achieve a good result in generating adversarial examples in several settings.


Cons:
1. To my understanding, the proposed framework could only be applied into the ensemble that uses the max, min, and majority vote as its aggregation rule. It is not clear if the proposed method still works if the ensemble is taking the average of every model's output.
2. The proposed settings are kind of similar to each other. A better setting will be generating adversarial examples with the different norms and proposing a defense to defend against several norms attacking at the same time. 
3. I am not quite sure if the novelty is strong or not since the proposed method just applies multi-objective optimization. Also, I am not sure whether the proposed regularizer is already proposed in the multi-objective optimization before or not.
clarity,_quality,_novelty_and_reproducibility: Clarity: The paper is well-written and easy to follow.

Quality: The experiment is extensive and detailed. 

Novelty: The novelty is limited if the proposed regularizer is already proposed in the multi-objective optimization before because the proposed method just applies multi-objective optimization to generating adversarial examples.

Reproducibility: Although the code is not provided, all hyperparameters are listed and I believe the proposed method should be reproducible.
summary_of_the_review: The paper proposes to use multi-objective optimization to generate adversarial examples in several settings including model ensemble, universal perturbation, etc.  The experiment shows the proposed method could achieve good results in several settings. However,  as all the settings use the max as its ensemble, it is not clear whether the proposed method could be used in other ensemble cases.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper2011/Reviewer_H7Re
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: The other suggest to extend the multi-objective optimization (MOO) method. Their new proposed method is called Task Oriented MOO. They claim that naive MOO invest useless effort in trying to maximize already achieved goals, their method let the optimizer spend more effort on improving the goal-unachieved tasks. They formalize the adversarial generation task as a multi-objective optimization problem and apply their TA-MOO approach to the problem. The authors show comprehensive experiments in which their method is better than the current baseline.
strength_and_weaknesses: ### Strength  
The paper is written in a clear and easy to follow fashion. The results seems to improve the baseline and the MOO method by a nice margin most of the time. The method and formulation, therefore, make sense to the adversarial generation task. The authors are the first to view the adversarial generation task as a MOO problem. The discussions and comprehensive experiment are clear and supporting the understanding of the method.

### Weaknesses
The paper did not fully explained the evaluation metrics. Why does the A-All is the most important metric for this task?
clarity,_quality,_novelty_and_reproducibility: The paper is well written and very informative to the reader and community. The paper show originality by casting the adversarial generation task as a MOO problem and applying MOO algorithms to the problem. The paper present promising results improving the baseline with a large margin most of the time.
summary_of_the_review: The paper is original and improves the baselines. The paper is written in high quality fashion.
correctness: 4: All of the claims and statements are well-supported and correct.
technical_novelty_and_significance: 4: The contributions are significant, and do not exist in prior works.
empirical_novelty_and_significance: 4: The contributions are significant, and do not exist in prior works.
flag_for_ethics_review: NO.
details_of_ethics_concerns: no ethic conerncs
recommendation: 8: accept, good paper

From: ICLR.cc/2023/Conference/Paper2011/Reviewer_g196
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: This work proposes a multi-objective optimization approach capable of dealing with objectives that converge at different rates. The authors then claim that three problems within the realm of generating adversarial examples can be cast as multi-objective optimization and apply the proposed Task Aware Multi-objective optimization (TA-MOO) algorithm for these problems. The main rationale behind TA-MOO is to augment the optimization problem to find a common descent direction within the standard multi gradient descent (MGD) with a regularization term that enforces the weights of the common descent direction to be larger for objectives with smaller losses (in the case of a problem of maximization of objectives). Experiments on two datasets, namely CIFAR-10 and CIFAR-100, considering the tasks of generating i- adversarial examples for an ensemble model, ii- universal perturbations, and iii- adversarial examples against transformations showed that TA-MOO outperformed the compared approaches in most of the cases.   
strength_and_weaknesses: Strengths:
- The authors proposed a general multi-objective approach that showed promising results on three different (but related) problems related to adversarial examples generation;

- The proposed algorithm, TA-MOO, has a mechanism to enforce the solutions of the multi-objective problem to focus on the central regions of the Pareto front, which is a desired feature in the case of the studied applications;

- The experiments on generation of adversarial perturbations are broad in the sense that they account for different aspects of the considered problems. 


Weaknesses:

- Lack of motivation for the contribution: one of the main claims of this work is “multi-objective optimization is a natural tool for adversarial example generation”, however, other than the fact that there are multiple objectives to be simultaneously satisfied, I am not able see why this is the case since there is no clear evidence that there is a tradeoff between the objectives when generating adversarial examples;

- Limited evaluation: the main contribution of this work is proposing a variation of a gradient-based multi-objective optimization algorithm capable of dealing with objectives that converge at different rates. However, it is not clear to me whether the choice of problems for evaluation is in fact suffering from the issue TA-MOO is proposed to solve. Moreover, the experiments in the main paper do not analyze important aspects of the proposed algorithm, such as if it is able to reach Pareto stationary solutions in practical applications;  
 
- Lack of strong baselines: I believe using unconstrained MGD (referred to in the manuscript as MOO) is not a fair choice of baseline in a case where it is known a priori that the desired solutions are in the central region of the Pareto front since MGD has no mechanism whatsoever to incorporate user preferences to guide the optimization. In the following section of the review I suggest stronger baselines to be considered. 

clarity,_quality,_novelty_and_reproducibility: - The authors claim that in some cases multi-objective optimization does not work. However, it is not clear to me if this is indeed the case. In more details, the purpose of (unconstrained) multi-objective optimization is to find a point within the Pareto front, and, perhaps in the case of the reported results MOO was able to find point in a region of the Pareto front that does not yield equally good performance across all objectives, which means it is actually “working”. I would like to learn more about the authors’ opinion on this aspect and suggest a more detailed discussion is added to the manuscript.

- Importantly, it is still unclear to me whether there are indeed conflicts between the objectives in the considered test cases within the paper. Notably, previous work showed evidence that adversarial attacks are transferable across different models and architectures [1, 2]. Therefore, I believe that in such cases the conflict between gradients should be negligible. Moreover, since there are no theoretical guarantees that TA-MOO finds Pareto stationary solutions, empirical evidence needs to be provided to illustrate why the proposed algorithm works. As an example, the authors can report quantities such as the norm of the common descent direction, since for Pareto stationary points this quantity should be close to zero. Finally, as I mentioned in my review, I strongly believe the authors should include in the empirical evaluation further gradient-based multi-objective approaches that aim at finding solutions in the central region of the Pareto front.

- Since in the case of MOO / MGD there is no constraint to enforce the solutions to reach the desired preferred region of the Pareto front, could it be the case that a particular initialization of MOO would suffice to make it find the desired solutions? Also, could a previously proposed constrained version of MGD such as [3] be able to do so and potentially achieve a performance as good as TA-MOO?

- Recent work [4, 5, 6] on multi-task learning has shown that well-tuned, simple baselines such as scalarizing the objectives with fixed weights equal to 1 random weights, yields solutions as good as the ones found by some multi-objective approaches, including MGDA, the base method for TA-MOO. Given that, and the fact that it seems that the tasks considered in this submission are similar to the considered multi-task settings mentioned in [4, 5, 6], I wonder if similar conclusions would be drawn in case extensive tuning of baselines were to be performed.

- As mentioned in the previous section of the review, the manuscript lacks in the choice of multi-objective optimization baselines. For example, I believe multi-objective approaches that aim at finding solutions lying in the central region of the Pareto front [7, 8] should be included, as well as methods that have been shown to prevent the bias issue in MGD [9].

[1] Liu et al. "Delving into Transferable Adversarial Examples and Black-box Attacks", 2016. \
[2] Che et al. "A New Ensemble Adversarial Attack Powered by Long-term Gradient Memories", 2019. \
[3] Lin et al. "Pareto multi-task learning", 2019. \
[4] Kurin et al. “In defense of the unitary scalarization for deep multi-task learning”, 2022. \
[5] Xin et al. "Do Current Multi-Task Optimization Methods in Deep Learning Even Help?”, 2022. \
[6] Lin et al. “Reasonable Effectiveness of Random Weighting: A Litmus Test for Multi-Task Learning”, 2022. \
[7] Albuquerque et al. "Multi-objective training of generative adversarial networks with multiple discriminators", 2019. \
[8] Miranda et al. ”Single-solution hypervolume maximization and its use for improving generalization of neural networks”, 2016. \
[9] Navon et al. “Multi-Task Learning as a Bargaining Game”, 2022.

summary_of_the_review: The main contributions of this work are casting problems related to generating adversarial perturbations as multi-objective optimization and proposing a gradient-based multi-objective algorithm to solve the aforementioned problems. In the current version of the manuscript, the the major limitations of the work are lack of motivation for the use of multi-objective optimization (i.e. why using multi-objective optimization for this problem?), and limited scope of experiments both in terms of baselines and aspects considered in the analysis. In my review, I raised questions and provided suggestions that could address some of the limitations. At this point, I believe this contribution is not yet ready to be considered for publication.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold