A Perturbation Analysis of Input Transformations for Adversarial Attacks
The existence of adversarial examples, or intentional mis-predictions constructed from small changes to correctly predicted examples, is one of the most significant challenges in neural network research today. Ironically, many new defenses are based on a simple observation - the adversarial inputs themselves are not robust and small perturbations to the attacking input often recover the desired prediction. While the intuition is somewhat clear, a detailed understanding of this phenomenon is missing from the research literature. This paper presents a comprehensive experimental analysis of when and why perturbation defenses work and potential mechanisms that could explain their effectiveness (or ineffectiveness) in different settings.
The work is concerned with a very interesting question: *robustness of the adversarial attacks* and discusses the following: First, what are different ways of destabilizing a given adversarial attack (different perturbations) and how much each of them are effective. Secondly, what makes adversarial images particularly non-robust compared to natural images and is there empirical evidence for it? Thirdly, is it possible for an attacker to use this knowledge and use a rather universal model of perturbations to make its adversarial examples robust against such (deterministic or stochastic) perturbations? The paper is quite well-justified and addresses a very interesting question by unifying the existing results of the literature in one place. First of all, comparing the accuracy-robustness trade-off of different methods are useful. The idea of modeling perturbations as a general distorted communication channel to have a unification of these methods is very useful. The perturbation analyses along with the results in Figures 2, 3 are novel and can be useful for further theoretical investigation of the source of instability of adversarial images. To the best of my knowledge, the transferability of adaptive attacks against noisy channel defense methods has not been discussed in the literature. The paper is well-organized and well written (except for Section 5 both in sense of the writing and where it appears in the paper). A few questions and suggestions: * The discussion of results in Figure2 should be more extensive and more clear. * Why do you think the L2 of the gradient for adv images has such high variance for both orig and adv class? Is there a relationship between the magnitude and how effective is a perturbation-based defense? * It should be made clear in the text that methods like randomized smoothing are designed for the purpose of *certified* accuracy and being robust against attack sizes more than the certification threshold was not part of the method*s contributions. * The use of the term *compression* in Section 3 is not entirely correct as it is not *technically* correct to say that compression is what is necessarily happening in a general case of a deterministic C(x). * Fig 1 should be larger.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
A Perturbation Analysis of Input Transformations for Adversarial Attacks
The existence of adversarial examples, or intentional mis-predictions constructed from small changes to correctly predicted examples, is one of the most significant challenges in neural network research today. Ironically, many new defenses are based on a simple observation - the adversarial inputs themselves are not robust and small perturbations to the attacking input often recover the desired prediction. While the intuition is somewhat clear, a detailed understanding of this phenomenon is missing from the research literature. This paper presents a comprehensive experimental analysis of when and why perturbation defenses work and potential mechanisms that could explain their effectiveness (or ineffectiveness) in different settings.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



The work is concerned with a very interesting question: *robustness of the adversarial attacks* and discusses the following: First, what are different ways of destabilizing a given adversarial attack (different perturbations) and how much each of them are effective. Secondly, what makes adversarial images particularly non-robust compared to natural images and is there empirical evidence for it? Thirdly, is it possible for an attacker to use this knowledge and use a rather universal model of perturbations to make its adversarial examples robust against such (deterministic or stochastic) perturbations? The paper is quite well-justified and addresses a very interesting question by unifying the existing results of the literature in one place. First of all, comparing the accuracy-robustness trade-off of different methods are useful. The idea of modeling perturbations as a general distorted communication channel to have a unification of these methods is very useful. The perturbation analyses along with the results in Figures 2, 3 are novel and can be useful for further theoretical investigation of the source of instability of adversarial images. To the best of my knowledge, the transferability of adaptive attacks against noisy channel defense methods has not been discussed in the literature. The paper is well-organized and well written (except for Section 5 both in sense of the writing and where it appears in the paper). A few questions and suggestions: * The discussion of results in Figure2 should be more extensive and more clear. * Why do you think the L2 of the gradient for adv images has such high variance for both orig and adv class? Is there a relationship between the magnitude and how effective is a perturbation-based defense? * It should be made clear in the text that methods like randomized smoothing are designed for the purpose of *certified* accuracy and being robust against attack sizes more than the certification threshold was not part of the method*s contributions. * The use of the term *compression* in Section 3 is not entirely correct as it is not *technically* correct to say that compression is what is necessarily happening in a general case of a deterministic C(x). * Fig 1 should be larger.
assistant
The work is concerned with a very interesting question: *robustness of the adversarial attacks* and discusses the following: First, what are different ways of destabilizing a given adversarial attack (different perturbations) and how much each of them are effective. Secondly, what makes adversarial images particularly non-robust compared to natural images and is there empirical evidence for it? Thirdly, is it possible for an attacker to use this knowledge and use a rather universal model of perturbations to make its adversarial examples robust against such (deterministic or stochastic) perturbations? The paper is quite well-justified and addresses a very interesting question by unifying the existing results of the literature in one place. First of all, comparing the accuracy-robustness trade-off of different methods are useful. The idea of modeling perturbations as a general distorted communication channel to have a unification of these methods is very useful. The perturbation analyses along with the results in Figures 2, 3 are novel and can be useful for further theoretical investigation of the source of instability of adversarial images. To the best of my knowledge, the transferability of adaptive attacks against noisy channel defense methods has not been discussed in the literature. The paper is well-organized and well written (except for Section 5 both in sense of the writing and where it appears in the paper). A few questions and suggestions: * The discussion of results in Figure2 should be more extensive and more clear. * Why do you think the L2 of the gradient for adv images has such high variance for both orig and adv class? Is there a relationship between the magnitude and how effective is a perturbation-based defense? * It should be made clear in the text that methods like randomized smoothing are designed for the purpose of *certified* accuracy and being robust against attack sizes more than the certification threshold was not part of the method*s contributions. * The use of the term *compression* in Section 3 is not entirely correct as it is not *technically* correct to say that compression is what is necessarily happening in a general case of a deterministic C(x). * Fig 1 should be larger.