mlsanityData to 7 Oct 2026

An Alternative Surrogate Loss for PGD-based Adversarial Testing

arXiv 1910.09338 ↗First posted 21 Oct 2019cs.LG stat.MLcited by 45

Not on the map. Why?

Abstract (arXiv)

Adversarial testing methods based on Projected Gradient Descent (PGD) are widely used for searching norm-bounded perturbations that cause the inputs of neural networks to be misclassified. This paper takes a deeper look at these methods and explains the effect of different hyperparameters (i.e., optimizer, step size and surrogate loss). We introduce the concept of MultiTargeted testing, which makes clever use of alternative surrogate losses, and explain when and how MultiTargeted is guaranteed to find optimal perturbations. Finally, we demonstrate that MultiTargeted outperforms more sophisticated methods and often requires less iterative steps than other variants of PGD found in the literature. Notably, MultiTargeted ranks first on MadryLab's white-box MNIST and CIFAR-10 leaderboards, reducing the accuracy of their MNIST model to 88.36% (with ℓ_∞ perturbations of ε = 0.3) and the accuracy of their CIFAR-10 model to 44.03% (at ε = 8/255). MultiTargeted also ranks first on the TRADES leaderboard reducing the accuracy of their CIFAR-10 model to 53.07% (with ℓ_∞ perturbations of ε = 0.031).

Key facts. Cited by 45 papers in the map (data through 7 Oct 2026). First posted on arXiv 21 Oct 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 13; 2023: 5; 2024: 7; 2025: 2; 2026: 1.

45 papers.

Sort:

By area:

  1. 2021Improving Robustness using Generated Datacited by 233
  2. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  3. 2021Data Augmentation Can Improve Robustnesscited by 193
  4. 2021Adversarial Examples Make Strong Poisonscited by 115
  5. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  6. 2021Attacking Adversarial Attacks as A Defensecited by 31
  7. 2021Defending Against Image Corruptions Through Adversarial Augmentationscited by 28
  8. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  9. 2021LAFEAT: Piercing Through Adversarial Defenses with Latent Featurescited by 24
  10. 2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
  11. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  12. 2022Revisiting adapters with adversarial trainingcited by 18
33 more
  1. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
  2. 2024MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifierscited by 16
  3. 2021Two Coupled Rejection Metrics Can Tell Adversarial Examples Apartcited by 14
  4. 2022Fast and Reliable Evaluation of Adversarial Robustness with Minimum-Margin Attackcited by 13
  5. 2023Adversarial Training Should Be Cast as a Non-Zero-Sum Gamecited by 13
  6. 2024Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Datacited by 12
  7. 2022Diversified Adversarial Attacks based on Conjugate Gradient Methodcited by 11
  8. 2022MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attackcited by 7
  9. 2021A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustnesscited by 6
  10. 2022Reliable Robustness Evaluation via Automatically Constructed Attack Ensemblescited by 6
  11. 2023Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisionscited by 6
  12. 2021Improving Hierarchical Adversarial Robustness of Deep Neural Networkscited by 4
  13. 2021A Closer Look at the Adversarial Robustness of Information Bottleneck Modelscited by 4
  14. 2021Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networkscited by 4
  15. 2021Adversarial Attacks on ML Defense Models Competitioncited by 3
  16. 2021Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustnesscited by 3
  17. 2022Hindering Adversarial Attacks with Implicit Neural Representationscited by 3
  18. 2024Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attackscited by 3
  19. 2022Alternating Objectives Generates Stronger PGD-Based Adversarial Attackscited by 2
  20. 2023Efficient Search of Comprehensively Robust Neural Architectures via Multi-fidelity Evaluationcited by 2
  21. 2023Exploring Geometry of Blind Spots in Vision Modelscited by 2
  22. 2025A Comprehensive Study of Deep Learning Model Fixing Approachescited by 2
  23. 2021Abstract Interpretation of Fixpoint Iterators with Applications to Neural Networkscited by 1
  24. 2022ARIA: Adversarially Robust Image Attribution for Content Provenancecited by 1
  25. 2022Learning Robust Kernel Ensembles with Kernel Average Poolingcited by 1
  26. 2024Position: Towards Resilience Against Adversarial Examplescited by 1
  27. 2025MOS-Attack: A Scalable Multi-objective Adversarial Attack Frameworkcited by 1
  28. 2021Improving Local Effectiveness for Global robust trainingcited by 0
  29. 2022Towards Effective Multi-Label Recognition Attacks via Knowledge Graph Consistencycited by 0
  30. 2022A Multi-objective Memetic Algorithm for Auto Adversarial Attack Optimization Designcited by 0
  31. 2024Resilience and Security of Deep Neural Networks Against Intentional and Unintentional Perturbations: Survey and Research Challengescited by 0
  32. 2024Enhancing Output Diversity Improves Conjugate Gradient-based Adversarial Attackscited by 0
  33. 2026Robust Spiking Neural Networks Against Adversarial Attackscited by 0