mlsanityData to 7 Oct 2026

Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints

arXiv 2102.12827 ↗First posted 25 Feb 2021cs.LG cs.CVcited by 50

Not on the map. Why?

Abstract (arXiv)

Evaluating adversarial robustness amounts to finding the minimum perturbation needed to have an input sample misclassified. The inherent complexity of the underlying optimization requires current gradient-based attacks to be carefully tuned, initialized, and possibly executed for many computationally-demanding iterations, even if specialized to a given perturbation model. In this work, we overcome these limitations by proposing a fast minimum-norm (FMN) attack that works with different ℓp-norm perturbation models (p=0, 1, 2, ∞), is robust to hyperparameter choices, does not require adversarial starting points, and converges within few lightweight steps. It works by iteratively finding the sample misclassified with maximum confidence within an ℓp-norm constraint of size ε, while adapting ε to minimize the distance of the current sample to the decision boundary. Extensive experiments show that FMN significantly outperforms existing attacks in terms of convergence speed and computation time, while reporting comparable or even smaller perturbation sizes.

Key facts. Cited by 50 papers in the map (data through 7 Oct 2026). Builds on 23 of its 27 references that are in the map. First posted on arXiv 25 Feb 2021.

Builds on

23 of 27 references.

References · 23

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  10. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  11. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  12. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
11 more
  1. 2019On Evaluating Adversarial Robustnesscited by 442
  2. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  3. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  4. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  5. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  6. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  7. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  8. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  9. 2018SparseFool: a few pixels make a big differencecited by 94
  10. 2019advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchcited by 69
  11. 2019Accurate, reliable and fast robustness evaluationcited by 43

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 10; 2023: 13; 2024: 11; 2025: 6; 2026: 4.

50 papers.

Sort:

By area:

  1. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  2. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 81
  3. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  4. 2021Exploring Misclassifications of Robust Neural Networks to Enhance Adversarial Attackscited by 33
  5. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  6. 2022Proximal Splitting Adversarial Attacks for Semantic Segmentationcited by 23
  7. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  8. 2022Improving Robustness against Real-World and Worst-Case Distribution Shifts through Decision Region Quantificationcited by 16
  9. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  10. 2024Adversarial Pruning: A Survey and Benchmark of Pruning Methods for Adversarial Robustnesscited by 10
  11. 2022NCVX: A General-Purpose Optimization Solver for Constrained Machine and Deep Learningcited by 7
  12. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
38 more
  1. 2022On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Errorcited by 6
  2. 2023Optimization and Optimizers for Adversarial Robustnesscited by 6
  3. 2024Minimum Topology Attacks for Graph Neural Networkscited by 6
  4. 2024Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Surveycited by 6
  5. 2023A Review of Adversarial Attacks in Computer Visioncited by 5
  6. 2024Segment-Anything Models Achieve Zero-shot Robustness in Autonomous Drivingcited by 5
  7. 2022Robust-by-Design Classification via Unitary-Gradient Neural Networkscited by 4
  8. 2023Improving Fast Minimum-Norm Attacks with Hyperparameter Optimizationcited by 4
  9. 2024Robustness-Congruent Adversarial Training for Secure Machine Learning Model Updatescited by 4
  10. 2024A mean curvature flow arising in adversarial trainingcited by 4
  11. 2024Towards Robust Vision Transformer via Masked Adaptive Ensemblecited by 4
  12. 2021EG-Booster: Explanation-Guided Booster of ML Evasion Attackscited by 3
  13. 2022Optimization for Robustness Evaluation beyond ℓp Metricscited by 3
  14. 2023Decentralized Adversarial Training over Graphscited by 3
  15. 2022Neuro-Inspired Deep Neural Networks with Sparse, Strong Activationscited by 2
  16. 2022On Trace of PGD-Like Adversarial Attackscited by 2
  17. 2022Alternating Objectives Generates Stronger PGD-Based Adversarial Attackscited by 2
  18. 2023Vulnerability-Aware Instance Reweighting For Adversarial Trainingcited by 2
  19. 2025Stop Walking in Circles! Bailing Out Early in Projected Gradient Descentcited by 2
  20. 2025Evaluating the Evaluators: Trust in Adversarial Robustness Testscited by 2
  21. 2021Internal Wasserstein Distance for Adversarial Attack and Defensecited by 1
  22. 2021Where to Look: A Unified Attention Model for Visual Recognition with Reinforcement Learningcited by 1
  23. 2023ExploreADV: Towards exploratory attack for Neural Networkscited by 1
  24. 2023Revisiting DeepFool: generalization and improvementcited by 1
  25. 2023How to choose your best allies for a transferable attack?cited by 1
  26. 2023Samples on Thin Ice: Re-Evaluating Adversarial Pruning of Neural Networkscited by 1
  27. 2025Task-Agnostic Attacks Against Vision Foundation Modelscited by 1
  28. 2025Adversarial Robustness of Discriminative Self-Supervised Learning in Visioncited by 1
  29. 2025Rethinking Robustness in Machine Learning: A Posterior Agreement Approachcited by 1
  30. 2025Towards Interpretable Adversarial Examples via Sparse Adversarial Attackcited by 1
  31. 2021A Perceptual Distortion Reduction Framework: Towards Generating Adversarial Examples with High Perceptual Quality and Attack Success Ratecited by 0
  32. 2023Measuring Equality in Machine Learning Security Defenses: A Case Study in Speech Recognitioncited by 0
  33. 2023Frequency maps reveal the correlation between Adversarial Attacks and Implicit Biascited by 0
  34. 2024HO-FMN: Hyperparameter Optimization for Fast Minimum-Norm Attackscited by 0
  35. 2026Adversarial Samples Are Not Created Equalcited by 0
  36. 2026Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluationcited by 0
  37. 2026EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usabilitycited by 0
  38. 2026Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraintscited by 0