ADVERSARIAL REPROGRAMMING OF NEURAL NETWORKS
Deep neural networks are susceptible to adversarial attacks. In computer vision, well-crafted perturbations to images can cause neural networks to make mistakes such as confusing a cat with a computer. Previous adversarial attacks have been designed to degrade performance of models or cause machine learning models to produce specific outputs chosen ahead of time by the attacker. We introduce attacks that instead reprogram the target model to perform a task chosen by the attacker-without the attacker needing to specify or compute the desired output for each test-time input. This attack finds a single adversarial perturbation, that can be added to all test-time inputs to a machine learning model in order to cause the model to perform a task chosen by the adversary-even if the model was not trained to do this task. These perturbations can thus be considered a program for the new task. We demonstrate adversarial reprogramming on six ImageNet classification models, repurposing these models to perform a counting task, as well as classification tasks: classification of MNIST and CIFAR-10 examples presented as inputs to the ImageNet model.
This paper proposed "adversarial reprogramming" of well-trained and fixed neural networks, which can be viewed as learning a trainable input perturbation on a fixed network for multi-tasking by using a different dataset (e.g., MNIST) from the original dataset (ImageNet) as input. Domain mapping functions (h_g and h_f) are required if the data have different dimensions. The key factor to enable adversarial reprogramming of a fixed network to perform a different task is by training the additive adversarial program as defined in (1). Experimental results show that 7 different ImageNet models (adversarially trained or not) can be reprogrammed for performing counting tasks, and MNIST and CIFAR-10 classifications. The authors also show that adversarial reprogramming is less effective on untrained networks. 
Although the idea of this paper is interesting,  the contribution is unclear and the "adversarial" setting is not well motivated. The detailed comments are as follows.
1. Unclear contribution - As mentioned in this paper, the main difference between "adversarial reprogramming" and transfer learning or multi-task learning is the fact that the network to be reprogrammed is fixed during reprogramming and was trained on a single task that is independent of the targeted task. However, the reprogramming results are not surprising given the fact that multi-task learning can be achieved on the same network. Given the fact that the perturbed input data (e.g., MNIST) is different from the original input data (ImageNet), what adversarial reprogramming demonstrates is actually a simple way of learning a new task via input perturbation to an unseen dataset at training time. However, transfer learning can be done in a similar way by simply fine-tuning the last (few) layers of a well-trained network. So the number of parameters required to be modified in order to "reprogram" a network is already known to be quite small via fine-tuning, which may even be less than the dimension of the adversarial program. In addition, given that the input of ImageNet model is high-dimensional and ImageNet images are likely to lie on a low dimensional manifold (but they are very different from hand-written digits or CIFAR images), the capability of reprogramming using deep models under this setting is expected and thus the contribution is unclear.
2. The "adversarial" setting is vague - I am very confused about why the experimental settings should be considered "adversarial", given the fact that ImageNet images and the three sets of adversarially perturbed images are quite different. What the experiments show is that a well-trained classifier has a large enough capacity to perform other tasks by simply training a perturbation on a different (out-of-distribution) dataset as inputs. It would make more sense to call this method "adversarial" if it can be used on ImageNet images to secretly implement some programmed tasks, while on the surface they are seemingly simply performing a typical classification task.
3. Limited novelty - How is adversarial program different from additional perturbation? Let alone the mapping function M in eqn (3), the adversarial program is nothing but a constrained perturbation (ranging from [-1,1] in each dimension). The optimization formulation in (3) can be seen as a  Carlini-Wager L2 attack with a simplified attack loss + L2 distortion regularization. Therefore, the proposed method has limited technical contribution and novelty.
In summary, this paper has some interesting ideas, but the current presentation lacks clear motivation, and its technical contribution and implications need to be better highlighted.  The authors are suggested to better motivate this paper from the angle of studying the learning capacity of input perturbation induced multi-tasking learning of a well-trained and fixed neural network model, and compare the pros and cons with transfer learning based on fine-tuning and joint multi-task learning / meta-learning on the same network architecture. Based on my own reading, I truly feel that advocating  "adversarial" reprogramming does not add any value to this work, as its use for an adversary is not properly motivated (e.g., visual imperceptibility) and its training has no adversarial nature (e.g., GAN training). Titles like "(Out-of-domain) Input perturbation induced reprogramming of neural networks" should better justify the contents and experiments presented in this work. Lastly, the authors need to specify how equation (3) is different from the formulation of finding adversarial perturbations in existing literature. Otherwise,  the novelty of "adversarial program" is quite limited.
----
Post-rebuttal review:
I appreciate the authors' efforts in including the new experiments in Sections 4.4 and 4.5. In my opinion, these new results and the discussion in Section 5.2 add great values to this work and make the contributions of this paper substantially clear. I've increased my rating to 6.