# Distributionally Adversarial Attack

arXiv: https://arxiv.org/abs/1808.05537 · HTML: https://mlsanity.com/paper/1808.05537/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Aug 2018.

## Built on by (most cited first, 26 of 26)

- [Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection](https://mlsanity.com/paper/2201.08970/) (2022)
- [Enhancing Adversarial Training with Second-Order Statistics of Weights](https://mlsanity.com/paper/2203.06020/) (2022)
- [Randomized Adversarial Training via Taylor Expansion](https://mlsanity.com/paper/2303.10653/) (2023)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Adversarial Visual Robustness by Causal Intervention](https://mlsanity.com/paper/2106.09534/) (2021)
- [Diversified Adversarial Attacks based on Conjugate Gradient Method](https://mlsanity.com/paper/2206.09628/) (2022)
- [Exploring adversarial attacks in federated learning for medical imaging](https://mlsanity.com/paper/2310.06227/) (2023)
- [TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking](https://mlsanity.com/paper/2605.30883/) (2026)
- [DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection](https://mlsanity.com/paper/2607.19829/) (2026)
- [Toward Deep Learning Based Access Control](https://mlsanity.com/paper/2203.15124/) (2022)
- [Noise-NeRF: Hide Information in Neural Radiance Fields using Trainable Noise](https://mlsanity.com/paper/2401.01216/) (2024)
- [Machine Learning in Access Control: A Taxonomy and Survey](https://mlsanity.com/paper/2207.01739/) (2022)
- [Adversarial Attack and Defense for Non-Parametric Two-Sample Tests](https://mlsanity.com/paper/2202.03077/) (2022)
- [LADDER: Latent Boundary-guided Adversarial Training](https://mlsanity.com/paper/2206.03717/) (2022)
- [Robust Universal Adversarial Perturbations](https://mlsanity.com/paper/2206.10858/) (2022)
- [MEAD: A Multi-Armed Approach for Evaluation of Adversarial Examples Detectors](https://mlsanity.com/paper/2206.15415/) (2022)
- [Towards Identification and Intervention of Safety-Critical Parameters in Large Language Models](https://mlsanity.com/paper/2604.08297/) (2026)
- [Adversarial Robustness: What fools you makes you stronger](https://mlsanity.com/paper/2102.05475/) (2021)
- [Dual Head Adversarial Training](https://mlsanity.com/paper/2104.10377/) (2021)
- [Adversarial Interaction Attack: Fooling AI to Misinterpret Human Intentions](https://mlsanity.com/paper/2101.06704/) (2021)
- [A Perceptual Distortion Reduction Framework: Towards Generating Adversarial Examples with High Perceptual Quality and Attack Success Rate](https://mlsanity.com/paper/2105.00278/) (2021)
- [Game Theory for Adversarial Attacks and Defenses](https://mlsanity.com/paper/2110.06166/) (2021)
- [Towards Effective Multi-Label Recognition Attacks via Knowledge Graph Consistency](https://mlsanity.com/paper/2207.05137/) (2022)
- [Adaptive Local Adversarial Attacks on 3D Point Clouds for Augmented Reality](https://mlsanity.com/paper/2303.06641/) (2023)
- [DDSA: Dual-Domain Strategic Attack for Spatial-Temporal Efficiency in Adversarial Robustness Testing](https://mlsanity.com/paper/2601.14302/) (2026)

## Abstract (arXiv)

Recent work on adversarial attack has shown that Projected Gradient Descent (PGD) Adversary is a universal first-order adversary, and the classifier adversarially trained by PGD is robust against a wide range of first-order attacks. It is worth noting that the original objective of an attack/defense model relies on a data distribution p(x), typically in the form of risk maximization/minimization, e.g., max/minmathbbEp(mathbf(x))L(x) with p(x) some unknown data distribution and L(·) a loss function. However, since PGD generates attack samples independently for each data sample based on L(·), the procedure does not necessarily lead to good generalization in terms of risk optimization. In this paper, we achieve the goal by proposing distributionally adversarial attack (DAA), a framework to solve an optimal em adversarial-data distribution, a perturbed distribution that satisfies the L_∞ constraint but deviates from the original data distribution to increase the generalization risk maximally. Algorithmically, DAA performs optimization on the space of potential data distributions, which introduces direct dependency between all data points when generating adversarial samples. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by em MIT MadryLab. Notably, DAA ranks em the first place on MadryLab's white-box leaderboards, reducing the accuracy of their secret MNIST model to 88.79% (with l_∞ perturbations of ε = 0.3) and the accuracy of their secret CIFAR model to 44.71% (with l_∞ perturbations of ε = 8.0). Code for the experiments is released on urlhttps://github.com/tianzheng4/Distributionally-Adversarial-Attack.