# An Alternative Surrogate Loss for PGD-based Adversarial Testing

arXiv: https://arxiv.org/abs/1910.09338 · HTML: https://mlsanity.com/paper/1910.09338/

## Key facts

- Cited by 45 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Oct 2019.

## Built on by (most cited first, 30 of 45)

- [Improving Robustness using Generated Data](https://mlsanity.com/paper/2110.09468/) (2021)
- [Fixing Data Augmentation to Improve Adversarial Robustness](https://mlsanity.com/paper/2103.01946/) (2021)
- [Data Augmentation Can Improve Robustness](https://mlsanity.com/paper/2111.05328/) (2021)
- [Adversarial Examples Make Strong Poisons](https://mlsanity.com/paper/2106.10807/) (2021)
- [Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack](https://mlsanity.com/paper/2203.05154/) (2022)
- [Attacking Adversarial Attacks as A Defense](https://mlsanity.com/paper/2106.04938/) (2021)
- [Defending Against Image Corruptions Through Adversarial Augmentations](https://mlsanity.com/paper/2104.01086/) (2021)
- [Investigating Top-k White-Box and Transferable Black-box Attack](https://mlsanity.com/paper/2204.00089/) (2022)
- [LAFEAT: Piercing Through Adversarial Defenses with Latent Features](https://mlsanity.com/paper/2104.09284/) (2021)
- [Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifiers](https://mlsanity.com/paper/2105.12508/) (2021)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Revisiting adapters with adversarial training](https://mlsanity.com/paper/2210.04886/) (2022)
- [Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing](https://mlsanity.com/paper/2301.12554/) (2023)
- [MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifiers](https://mlsanity.com/paper/2402.02263/) (2024)
- [Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart](https://mlsanity.com/paper/2105.14785/) (2021)
- [Fast and Reliable Evaluation of Adversarial Robustness with Minimum-Margin Attack](https://mlsanity.com/paper/2206.07314/) (2022)
- [Adversarial Training Should Be Cast as a Non-Zero-Sum Game](https://mlsanity.com/paper/2306.11035/) (2023)
- [Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data](https://mlsanity.com/paper/2410.08503/) (2024)
- [Diversified Adversarial Attacks based on Conjugate Gradient Method](https://mlsanity.com/paper/2206.09628/) (2022)
- [MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attack](https://mlsanity.com/paper/2211.08008/) (2022)
- [Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisions](https://mlsanity.com/paper/2306.05873/) (2023)
- [A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness](https://mlsanity.com/paper/2103.01276/) (2021)
- [Reliable Robustness Evaluation via Automatically Constructed Attack Ensembles](https://mlsanity.com/paper/2211.12713/) (2022)
- [Improving Hierarchical Adversarial Robustness of Deep Neural Networks](https://mlsanity.com/paper/2102.09012/) (2021)
- [A Closer Look at the Adversarial Robustness of Information Bottleneck Models](https://mlsanity.com/paper/2107.05712/) (2021)
- [Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networks](https://mlsanity.com/paper/2112.14232/) (2021)
- [Adversarial Attacks on ML Defense Models Competition](https://mlsanity.com/paper/2110.08042/) (2021)
- [Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness](https://mlsanity.com/paper/2110.08256/) (2021)
- [Hindering Adversarial Attacks with Implicit Neural Representations](https://mlsanity.com/paper/2210.13982/) (2022)
- [Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks](https://mlsanity.com/paper/2411.15210/) (2024)

## Abstract (arXiv)

Adversarial testing methods based on Projected Gradient Descent (PGD) are widely used for searching norm-bounded perturbations that cause the inputs of neural networks to be misclassified. This paper takes a deeper look at these methods and explains the effect of different hyperparameters (i.e., optimizer, step size and surrogate loss). We introduce the concept of MultiTargeted testing, which makes clever use of alternative surrogate losses, and explain when and how MultiTargeted is guaranteed to find optimal perturbations. Finally, we demonstrate that MultiTargeted outperforms more sophisticated methods and often requires less iterative steps than other variants of PGD found in the literature. Notably, MultiTargeted ranks first on MadryLab's white-box MNIST and CIFAR-10 leaderboards, reducing the accuracy of their MNIST model to 88.36% (with ℓ_∞ perturbations of ε = 0.3) and the accuracy of their CIFAR-10 model to 44.03% (at ε = 8/255). MultiTargeted also ranks first on the TRADES leaderboard reducing the accuracy of their CIFAR-10 model to 53.07% (with ℓ_∞ perturbations of ε = 0.031).