Adversarial Machine Learning at Scale
Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model*s parameters. Adversarial training is the process of explicitly training a model on adversarial examples, in order to make it more robust to attack or to reduce its test error on clean inputs. So far, adversarial training has primarily been applied to small problems. In this research, we apply adversarial training to ImageNet. Our contributions include: (1) recommendations for how to succesfully scale adversarial training to large models and datasets, (2) the observation that adversarial training confers robustness to single-step attack methods, (3) the finding that multi-step attack methods are somewhat less transferable than single-step attack methods, so single-step attacks are the best for mounting black-box attacks, and (4) resolution of a ``label leaking** effect that causes adversarially trained models to perform better on adversarial examples than on clean examples, because the adversarial example construction process uses the true label and the model can learn to exploit regularities in the construction process.
This paper investigate the phenomenon of the adversarial examples and the adversarial training on the dataset of ImageNet. While the final conclusions are still vague, this paper raises several noteworthy finding from its experiments. The paper is well written and easy to follow. Although I still have some concerns about the paper (see the comments below), this paper has good contributions and worth to publish. Pros: For the first time in the literature, this paper proposed the concept of ‘label leaking’. Although its effect only becomes significant when the dataset is large, it should be carefully handled in the future research works along this line. Using the ratio of *clean accuracy* over ‘adversarial accuracy’ as the measure of robust is more reasonable compared to the existing works in the literature. Cons: Although the conclusions of the paper are based on the experiments on ImageNet, the title of the paper seems a little misleading. I consider Section 4 as the main contribution of the paper. Note that Section 4.3 and Section 4.4 are not specific to large-scale dataset, thus emphasizing the ‘large-scale’ in the title and in the introduction seems improper. Basically all the conclusions of the paper are made based on observing the experimental results. Further tests should have been performed to verify these hypotheses. Without that, the conclusions of the paper seems rushy. For example, one dataset of imageNet can not infer the conclusions for all large-scale datasets.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Adversarial Machine Learning at Scale
Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model*s parameters. Adversarial training is the process of explicitly training a model on adversarial examples, in order to make it more robust to attack or to reduce its test error on clean inputs. So far, adversarial training has primarily been applied to small problems. In this research, we apply adversarial training to ImageNet. Our contributions include: (1) recommendations for how to succesfully scale adversarial training to large models and datasets, (2) the observation that adversarial training confers robustness to single-step attack methods, (3) the finding that multi-step attack methods are somewhat less transferable than single-step attack methods, so single-step attacks are the best for mounting black-box attacks, and (4) resolution of a ``label leaking** effect that causes adversarially trained models to perform better on adversarial examples than on clean examples, because the adversarial example construction process uses the true label and the model can learn to exploit regularities in the construction process.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper investigate the phenomenon of the adversarial examples and the adversarial training on the dataset of ImageNet. While the final conclusions are still vague, this paper raises several noteworthy finding from its experiments. The paper is well written and easy to follow. Although I still have some concerns about the paper (see the comments below), this paper has good contributions and worth to publish. Pros: For the first time in the literature, this paper proposed the concept of ‘label leaking’. Although its effect only becomes significant when the dataset is large, it should be carefully handled in the future research works along this line. Using the ratio of *clean accuracy* over ‘adversarial accuracy’ as the measure of robust is more reasonable compared to the existing works in the literature. Cons: Although the conclusions of the paper are based on the experiments on ImageNet, the title of the paper seems a little misleading. I consider Section 4 as the main contribution of the paper. Note that Section 4.3 and Section 4.4 are not specific to large-scale dataset, thus emphasizing the ‘large-scale’ in the title and in the introduction seems improper. Basically all the conclusions of the paper are made based on observing the experimental results. Further tests should have been performed to verify these hypotheses. Without that, the conclusions of the paper seems rushy. For example, one dataset of imageNet can not infer the conclusions for all large-scale datasets.
assistant
This paper investigate the phenomenon of the adversarial examples and the adversarial training on the dataset of ImageNet. While the final conclusions are still vague, this paper raises several noteworthy finding from its experiments. The paper is well written and easy to follow. Although I still have some concerns about the paper (see the comments below), this paper has good contributions and worth to publish. Pros: For the first time in the literature, this paper proposed the concept of ‘label leaking’. Although its effect only becomes significant when the dataset is large, it should be carefully handled in the future research works along this line. Using the ratio of *clean accuracy* over ‘adversarial accuracy’ as the measure of robust is more reasonable compared to the existing works in the literature. Cons: Although the conclusions of the paper are based on the experiments on ImageNet, the title of the paper seems a little misleading. I consider Section 4 as the main contribution of the paper. Note that Section 4.3 and Section 4.4 are not specific to large-scale dataset, thus emphasizing the ‘large-scale’ in the title and in the introduction seems improper. Basically all the conclusions of the paper are made based on observing the experimental results. Further tests should have been performed to verify these hypotheses. Without that, the conclusions of the paper seems rushy. For example, one dataset of imageNet can not infer the conclusions for all large-scale datasets.