Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack

By Francesco Croce, Matthias Hein. 2019

615 citations recorded by the source corpus.

The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the $l_p$-norms for $p \in \{1,2,\infty\}$ aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one $l_p$-norm, and is robust to the phenomenon of gradient masking.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “For example, in the popular whitebox threat model, the attacker is assumed to have full access to the model f ’s parameters and outputs [62, 30, 51, 53, 11, 16, 17].”
Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “In addition, we test AWP against Auto Attack (AA) [9], which is a strong and reliable attack to verify the robustness via an ensemble of diverse parameter-free attacks including three white-box attacks (APGD-CE [9], APGD-DLR [9], and FAB [8]) and a black-box attack (Square Attack [1]).”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, methodology): “…step on the cross-entropy loss (Croce & Hein, 2020b), • AUTOPGD-T, a targeted attack using PGD with an adaptive step on the difference of logits ratio (Croce & Hein, 2020b), • FAB-T, a targeted attack which minimizes the norm of adversarial perturbations (Croce & Hein, 2020a), • SQUARE, a…”
Boosting Adversarial Training with Hypersphere Embedding (2020, methodology): “1 Performance under white-box attacks On the CIFAR-10 dataset, we test the defenses under different attacks including FGSM [24], PGD [44], MIM [17], Deepfool [46], C&W (l∞ version) [7], feature attack [39], and FAB [14].”
Bag of Tricks for Adversarial Training (2020, methodology): “Croce & Hein (2020b) propose AutoAttack, which is an ensemble of four selected attacks.”
RobustBench: a standardized adversarial robustness benchmark (2020, methodology): “It is an ensemble of four attacks that are run sequentially: a variation of PGD attack with automatically adjusted step sizes, with (1) the cross entropy loss and (2) the difference of logits ratio loss, which is a rescaling-invariant margin-based loss function, (3) the targeted version of the FAB a”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, methodology): “For completeness, we also report the results under four different attack methods and settings, including PGD [41], C&W [9], FAB [16], and Square [4].”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, background): “58% robust accuracy outperforming the white-box attack of [20].”
Are Transformers More Robust Than CNNs? (2021, methodology): “…evaluation suite also contains: A) AutoAttack [8], which is an ensemble of diverse attacks ( i.e ., two variants of PGD attack, FAB attack [7] and Square Attack [1]) and is parameter-free; and B) Texture Patch Attack (TPA) [50], which uses a predeﬁned texture dictionary of patches to fool…”