# Composite Adversarial Attacks

arXiv: https://arxiv.org/abs/2012.05434 · HTML: https://mlsanity.com/paper/2012.05434/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Dec 2020.

## Built on by (most cited first, 29 of 29)

- [Frequency Domain Model Augmentation for Adversarial Attack](https://mlsanity.com/paper/2207.05382/) (2022)
- [Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack](https://mlsanity.com/paper/2203.05154/) (2022)
- [Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains](https://mlsanity.com/paper/2201.11528/) (2022)
- [Exploring Misclassifications of Robust Neural Networks to Enhance Adversarial Attacks](https://mlsanity.com/paper/2105.10304/) (2021)
- [Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations](https://mlsanity.com/paper/2202.04235/) (2022)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Automated Discovery of Adaptive Attacks on Adversarial Defenses](https://mlsanity.com/paper/2102.11860/) (2021)
- [PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies](https://mlsanity.com/paper/2506.09237/) (2025)
- [MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attack](https://mlsanity.com/paper/2211.08008/) (2022)
- [Reliable Robustness Evaluation via Automatically Constructed Attack Ensembles](https://mlsanity.com/paper/2211.12713/) (2022)
- [CARBEN: Composite Adversarial Robustness Benchmark](https://mlsanity.com/paper/2207.07797/) (2022)
- [Improving Hierarchical Adversarial Robustness of Deep Neural Networks](https://mlsanity.com/paper/2102.09012/) (2021)
- [Enhance transferability of adversarial examples with model architecture](https://mlsanity.com/paper/2202.13625/) (2022)
- [Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume](https://mlsanity.com/paper/2403.05100/) (2024)
- [HogVul: Black-box Adversarial Code Generation Framework Against LM-based Vulnerability Detectors](https://mlsanity.com/paper/2601.05587/) (2026)
- [A Closer Look at Robustness to L-infinity and Spatial Perturbations and their Composition](https://mlsanity.com/paper/2210.02577/) (2022)
- [Alternating Objectives Generates Stronger PGD-Based Adversarial Attacks](https://mlsanity.com/paper/2212.07992/) (2022)
- [Efficient Search of Comprehensively Robust Neural Architectures via Multi-fidelity Evaluation](https://mlsanity.com/paper/2305.07308/) (2023)
- [Evading Data Provenance in Deep Neural Networks](https://mlsanity.com/paper/2508.01074/) (2025)
- [DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples](https://mlsanity.com/paper/2508.13309/) (2025)
- [An Investigation of Visual Foundation Models Robustness](https://mlsanity.com/paper/2508.16225/) (2025)
- [Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss](https://mlsanity.com/paper/2507.22428/) (2025)
- [Calibrating Uncertainty for Zero-Shot Adversarial CLIP](https://mlsanity.com/paper/2512.12997/) (2025)
- [Case-Aware Adversarial Training](https://mlsanity.com/paper/2204.09398/) (2022)
- [A Multi-objective Memetic Algorithm for Auto Adversarial Attack Optimization Design](https://mlsanity.com/paper/2208.06984/) (2022)
- [Unrestricted Adversarial Samples Based on Non-semantic Feature Clusters Substitution](https://mlsanity.com/paper/2209.02406/) (2022)
- [Multi-objective Evolutionary Search of Variable-length Composite Semantic Perturbations](https://mlsanity.com/paper/2307.06548/) (2023)
- [Enhancing Output Diversity Improves Conjugate Gradient-based Adversarial Attacks](https://mlsanity.com/paper/2408.03972/) (2024)
- [Dummy-Aware Weighted Attack (DAWA): Breaking the Safe Sink in Dummy Class Defenses](https://mlsanity.com/paper/2603.29182/) (2026)

## Abstract (arXiv)

Adversarial attack is a technique for deceiving Machine Learning (ML) models, which provides a way to evaluate the adversarial robustness. In practice, attack algorithms are artificially selected and tuned by human experts to break a ML system. However, manual selection of attackers tends to be sub-optimal, leading to a mistakenly assessment of model security. In this paper, a new procedure called Composite Adversarial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms and their hyper-parameters from a candidate pool of 32 base attackers. We design a search space where attack policy is represented as an attacking sequence, i.e., the output of the previous attacker is used as the initialization input for successors. Multi-objective NSGA-II genetic algorithm is adopted for finding the strongest attack policy with minimum complexity. The experimental result shows CAA beats 10 top attackers on 11 diverse defenses with less elapsed time (6 × faster than AutoAttack), and achieves the new state-of-the-art on l∞, l2 and unrestricted adversarial attacks.