mlsanityData to 7 Oct 2026

Guidance Through Surrogate: Towards a Generic Diagnostic Attack

arXiv 2212.14875 ↗First posted 30 Dec 2022cs.LG cs.AI cs.CRcited by 1

Not on the map. Why?

Abstract (arXiv)

Adversarial training is an effective approach to make deep neural networks robust against adversarial attacks. Recently, different adversarial training defenses are proposed that not only maintain a high clean accuracy but also show significant robustness against popular and well studied adversarial attacks such as PGD. High adversarial robustness can also arise if an attack fails to find adversarial gradient directions, a phenomenon known as `gradient masking'. In this work, we analyse the effect of label smoothing on adversarial training as one of the potential causes of gradient masking. We then develop a guided mechanism to avoid local minima during attack optimization, leading to a novel attack dubbed Guided Projected Gradient Attack (G-PGA). Our attack approach is based on a `match and deceive' loss that finds optimal adversarial directions through guidance from a surrogate model. Our modified attack does not require random restarts, large number of attack iterations or search for an optimal step-size. Furthermore, our proposed G-PGA is generic, thus it can be combined with an ensemble attack strategy as we demonstrate for the case of Auto-Attack, leading to efficiency and convergence speed improvements. More than an effective attack, G-PGA can be used as a diagnostic tool to reveal elusive robustness due to gradient masking in adversarial defenses.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 48 of its 58 references that are in the map. First posted on arXiv 30 Dec 2022.

Builds on

48 of 58 references.

References · 48

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2016Adversarial examples in the physical worldcited by 1,762
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  11. 2019When Does Label Smoothing Help?cited by 985
  12. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
36 more
  1. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  2. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  3. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  4. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  5. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  6. 2019Adversarial Training for Free!cited by 638
  7. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  8. 2017One pixel attack for fooling deep neural networkscited by 579
  9. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  10. 2017Countering Adversarial Images using Input Transformationscited by 517
  11. 2017Regularizing Neural Networks by Penalizing Confident Output Distributionscited by 461
  12. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  13. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  14. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  15. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  16. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  17. 2020Bag of Tricks for Adversarial Trainingcited by 199
  18. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  19. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  20. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  21. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  22. 2019Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Trainingcited by 95
  23. 2018SparseFool: a few pixels make a big differencecited by 94
  24. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  25. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  26. 2020Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalizationcited by 73
  27. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  28. 2021On Generating Transferable Targeted Perturbationscited by 65
  29. 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
  30. 2017Defense against Universal Adversarial Perturbationscited by 48
  31. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  32. 2015Exploring the Space of Adversarial Imagescited by 28
  33. 2019Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?cited by 18
  34. 2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
  35. 2020Label Smoothing and Adversarial Robustnesscited by 10
  36. 2020Diversity can be Transferred: Output Diversification for White- and Black-box Attackscited by 4

Built on by

Cited by year

Citing papers per year: 2023: 1.

1 paper.

  1. 2023Boosting Adversarial Transferability using Dynamic Cuescited by 5