mlsanityData to 7 Oct 2026

Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

arXiv 1811.09600 ↗First posted 23 Nov 2018cs.CV cs.CR cs.LGcited by 109

Not on the map. Why?

Abstract (arXiv)

Research on adversarial examples in computer vision tasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering L2 norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low L2 norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of L2 norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against white-box gradient-based L2 attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm.

Key facts. Cited by 109 papers in the map (data through 7 Oct 2026). First posted on arXiv 23 Nov 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 32; 2022: 26; 2023: 22; 2024: 16; 2025: 11; 2026: 2.

109 papers.

Sort:

By area:

  1. 2022Diffusion Models for Adversarial Purificationcited by 469
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  4. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  5. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  6. 2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
  7. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  8. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  9. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  10. 2022NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Modelscited by 47
  11. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  12. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
38 more
  1. 2022FrequencyLowCut Pooling -- Plug & Play against Catastrophic Overfittingcited by 28
  2. 2023CosPGD: an efficient white-box adversarial attack for pixel-wise prediction taskscited by 27
  3. 2021Towards Defending against Adversarial Examples via Attack-Invariant Featurescited by 25
  4. 2022Robust Models are less Over-Confidentcited by 25
  5. 2021Exploring Adversarial Fake Images on Face Manifoldcited by 24
  6. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  7. 2022Proximal Splitting Adversarial Attacks for Semantic Segmentationcited by 23
  8. 2022CNN Filter DB: An Empirical Investigation of Trained Convolutional Filterscited by 20
  9. 2021Robustness of on-device Models: Adversarial Attack to Deep Learning Models on Android Appscited by 19
  10. 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 19
  11. 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
  12. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  13. 2021Removing Adversarial Noise in Class Activation Feature Spacecited by 18
  14. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
  15. 2021Attack to Fool and Explain Deep Networkscited by 17
  16. 2021Mutual Adversarial Training: Learning together is better than going alonecited by 17
  17. 2021Shift Invariance Can Reduce Adversarial Robustnesscited by 16
  18. 2021Universal Spectral Adversarial Attacks for Deformable Shapescited by 14
  19. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  20. 2022Improving Adversarial Robustness via Mutual Information Estimationcited by 13
  21. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomnesscited by 13
  22. 2022Robust and Accurate -- Compositional Architectures for Randomized Smoothingcited by 12
  23. 2023Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Modelscited by 12
  24. 2023Vulnerabilities in Video Quality Assessment Models: The Challenge of Adversarial Attackscited by 12
  25. 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
  26. 2021PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attackcited by 8
  27. 2021Modeling Adversarial Noise for Adversarial Trainingcited by 8
  28. 2023Simple and Efficient Partial Graph Adversarial Attack: A New Perspectivecited by 8
  29. 2023Exploring adversarial attacks in federated learning for medical imagingcited by 8
  30. 2021Perceptually Constrained Adversarial Attackscited by 7
  31. 2021Domain Invariant Adversarial Learningcited by 7
  32. 2021Performance Evaluation of Adversarial Attacks: Discrepancies and Solutionscited by 7
  33. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  34. 2022NCVX: A General-Purpose Optimization Solver for Constrained Machine and Deep Learningcited by 7
  35. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  36. 2021Optimal Transport as a Defense Against Adversarial Attackscited by 6
  37. 2022On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Errorcited by 6
  38. 2022Self-recoverable Adversarial Examples: A New Effective Protection Mechanism in Social Networkscited by 6

50 most cited of 109 All 109 (JSON)