Alternating Objectives Generates Stronger PGD-Based Adversarial Attacks
Not on the map. Why?
Abstract (arXiv)
Designing powerful adversarial attacks is of paramount importance for the evaluation of ℓp-bounded adversarial defenses. Projected Gradient Descent (PGD) is one of the most effective and conceptually simple algorithms to generate such adversaries. The search space of PGD is dictated by the steepest ascent directions of an objective. Despite the plethora of objective function choices, there is no universally superior option and robustness overestimation may arise from ill-suited objective selection. Driven by this observation, we postulate that the combination of different objectives through a simple loss alternating scheme renders PGD more robust towards design choices. We experimentally verify this assertion on a synthetic-data example and by evaluating our proposed method across 25 different ℓ∞-robust models and 3 datasets. The performance improvement is consistent, when compared to the single loss counterparts. In the CIFAR-10 dataset, our strongest adversarial attack outperforms all of the white-box components of AutoAttack (AA) ensemble, as well as the most powerful attacks existing on the literature, achieving state-of-the-art results in the computational budget of our study (T=100, no restarts).
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 44 of its 56 references that are in the map. First posted on arXiv 15 Dec 2022.
Builds on
44 of 56 references.
References · 44
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Wide Residual Networkscited by 3,057
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
32 more
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
- 2019Adversarial Training for Free!cited by 638
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2020Overfitting in adversarially robust deep learningcited by 504
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
- 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2018Adversarially Robust Generalization Requires More Datacited by 318
- 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
- 2021Improving Robustness using Generated Datacited by 233
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2020Understanding and Improving Fast Adversarial Trainingcited by 213
- 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
- 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
- 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
- 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
- 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
- 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
- 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
- 2019Adversarially Robust Generalization Just Requires More Unlabeled Datacited by 75
- 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
- 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 61
- 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
- 2019An Alternative Surrogate Loss for PGD-based Adversarial Testingcited by 45
- 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
- 2020Composite Adversarial Attackscited by 29
- 2021LAFEAT: Piercing Through Adversarial Defenses with Latent Featurescited by 24
- 2021Parameterizing Activation Functions for Adversarial Robustnesscited by 22
- 2020Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustnesscited by 11
- 2022Diversified Adversarial Attacks based on Conjugate Gradient Methodcited by 11
Built on by
Citing papers per year: 2024: 1; 2025: 1.
2 papers.