SceneLock: Reversible Adversarial Learning for Camera-Based Autonomous Driving Protection

Although there is some innovation in this work, the overall organizational structure and writing logic of the article are very poor. It is suggested to re-examine the problem and think about the writing Angle.

• Unclear connection with steganography. There is a lack of clarity regarding the connection between the approached adopted in this work and steganography. The authors should revise the manuscript to clarify this point. Specifically, it is unclear if steganography is the appropriate term, as the goal appears to be limiting image processing by sharing the decoder only with authorized users, without concealing the image from human view.

• Unclear threat model. The authors should further clarify the rationale for using adversarial perturbations for data protection. The introduction lacks citations and clear motivation for this approach. For example, one might question the necessity of this method: why not use traditional encryption instead?

• Limited discussion of related literature. Firstly, the extensive discussion of camera-based 3D perception paragraph in the related works appears to be unrelated. Secondly, while adversarial perturbations and vision models in driving are mentioned, other relevant works that could support this strategy and emphasize the importance of efficiency in this context are missing, along with a clear threat model.

• Absence of analysis against potential image extraction attacks. Given the need for a clear threat model, if the goal is to make the dataset publicly available but unusable by unauthorized users, the methodology should consider potential denoising strategies that attackers might use to remove the noise. This critical aspect has not been discussed, yet it is essential for assessing the work’s quality. Since this approach is proposed as a potential defense mechanism, the authors should explore and test it against possible attacks, as the lack of such evaluations raises doubts about the pipeline’s quality and robustness. For example, a straightforward test could involve attackers applying denoising or image-reconstruction strategies to the perturbed images, using possible unsupervised and supervised techniques.

• [minor issues] In section 3, "RDE" is used both for Reversible Data Embedding and Reversible Data Encoding.

1. The threat model is not convincing. Can malicious actors gain unauthorized access to the autonomous driving data? Existing techniques such as access control could be directly implemented to address unauthorized access issues, which might be simpler and more effective.
2. While the authors aim to protect intellectual property, remote deployment, and privacy, the proposed method does not directly tackle IP protection. The approach might offer some level of privacy protection, but this assertion feels subjective due to the absence of quantitative privacy assessments.
3. The data hiding approach for embedding and extracting restoration messages seems unnecessary if only authorized users can access the data. In practical scenarios, encryption with secure transmission and secret key channels could achieve similar outcomes more efficiently.
4. The adversarial learning approach with data hiding has similarities to other works in unlearnable examples with data hiding. However, I cannot find the advantage of this paper. And there is a lack of comparative evaluation against these existing methods.

1. The motivation or threat model of the paper is not convincing. If the dataset to be protected is not suitable for public usage, the dataset owner can encrypt the whole dataset and only share password to authorized users. The motivation to poison the dataset before publishing is not clear.
2. The adversarial noise on the image seems easy to be mitigated by smoothing or other preprocessing techniques. Authors could evaluate the resistance of the perturbations under defensive techniques.
3. Authors evaluated the attack performance of the generated perturbations on various models. A question is that whether those models trained on original clean dataset or the encoded dataset? If those models are trained on original dataset, how would those models perform if they are trained on the encoded dataset?

1. Limited novelty. This paper introduces adversarial perturbations into images to thwart malicious data users, then uses image steganography techniques to remove the perturbations. Both adversarial examples and image steganography are well-established techniques, so the novelty and contribution of this work are limited.
2. Experiments. The final step of NSE uses Reversible Data Encoding (RDE) technology to embed perturbation information into superpixel blocks. It is unclear whether RDE affects the performance of the adversarial perturbations.
3. Discussion. Image steganography techniques are easily affected by image editing. If this proposed solution undergoes image editing, such as JPEG compression, it might prevent the extraction of perturbation information from adversarial images, making image restoration impossible. This point lacks discussion.
4. Discussion. How robust are the protected images generated by NSE against image denoising algorithms? Would adding suitable denoising algorithms negate the perturbations?
5. Experiments. This paper claims that the degraded image quality hinders manual annotation efforts by unauthorized parties, but there is no experimental evidence to support this claim.