Mitigating Adversarial Effects Through Randomization
Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.
 This paper proposes an extremely simple methodology to improve the network*s performance by adding extra random perturbations (resizing/padding) at evaluation time. Although the paper is very basic, it creates a good baseline for defending about various types of attacks and got good results in kaggle competition. The main merit of the paper is to study this simple but efficient baseline method extensively and shows how adversarial attacks can be mitigated by some extent. Cons of the paper: there is not much novel insight or really exciting new ideas presented. Pros: It gives a convincing very simple baseline and the evaluation of all subsequent results on defending against adversaries will need to incorporate this simple defense method in addition to any future proposed defenses, since it is very easy to implement and evaluate and seems to improve the defense capabilities of the network to a significant degree. So I assume that this paper will be influential in the future just by the virtue of its easy applicability and effectiveness.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Mitigating Adversarial Effects Through Randomization
Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at https://github.com/cihangxie/NIPS2017_adv_challenge_defense.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper proposes an extremely simple methodology to improve the network*s performance by adding extra random perturbations (resizing/padding) at evaluation time. Although the paper is very basic, it creates a good baseline for defending about various types of attacks and got good results in kaggle competition. The main merit of the paper is to study this simple but efficient baseline method extensively and shows how adversarial attacks can be mitigated by some extent. Cons of the paper: there is not much novel insight or really exciting new ideas presented. Pros: It gives a convincing very simple baseline and the evaluation of all subsequent results on defending against adversaries will need to incorporate this simple defense method in addition to any future proposed defenses, since it is very easy to implement and evaluate and seems to improve the defense capabilities of the network to a significant degree. So I assume that this paper will be influential in the future just by the virtue of its easy applicability and effectiveness.
assistant
 This paper proposes an extremely simple methodology to improve the network*s performance by adding extra random perturbations (resizing/padding) at evaluation time. Although the paper is very basic, it creates a good baseline for defending about various types of attacks and got good results in kaggle competition. The main merit of the paper is to study this simple but efficient baseline method extensively and shows how adversarial attacks can be mitigated by some extent. Cons of the paper: there is not much novel insight or really exciting new ideas presented. Pros: It gives a convincing very simple baseline and the evaluation of all subsequent results on defending against adversaries will need to incorporate this simple defense method in addition to any future proposed defenses, since it is very easy to implement and evaluate and seems to improve the defense capabilities of the network to a significant degree. So I assume that this paper will be influential in the future just by the virtue of its easy applicability and effectiveness.