mlsanityData to 7 Oct 2026

Optimization and Optimizers for Adversarial Robustness

arXiv 2303.13401 ↗First posted 23 Mar 2023cs.LG cs.CVcited by 6

Not on the map. Why?

Abstract (arXiv)

Empirical robustness evaluation (RE) of deep learning models against adversarial perturbations entails solving nontrivial constrained optimization problems. Existing numerical algorithms that are commonly used to solve them in practice predominantly rely on projected gradient, and mostly handle perturbations modeled by the ℓ1, ℓ2 and ℓ_∞ distances. In this paper, we introduce a novel algorithmic framework that blends a general-purpose constrained-optimization solver PyGRANSO with Constraint Folding (PWCF), which can add more reliability and generality to the state-of-the-art RE packages, e.g., AutoAttack. Regarding reliability, PWCF provides solutions with stationarity measures and feasibility tests to assess the solution quality. For generality, PWCF can handle perturbation models that are typically inaccessible to the existing projected gradient methods; the main requirement is the distance metric to be almost everywhere differentiable. Taking advantage of PWCF and other existing numerical algorithms, we further explore the distinct patterns in the solutions found for solving these optimization problems using various combinations of losses, perturbation models, and optimization algorithms. We then discuss the implications of these patterns on the current robustness evaluation and adversarial training.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 52 of its 86 references that are in the map. First posted on arXiv 23 Mar 2023.

Builds on

52 of 86 references.

References · 52

  1. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  9. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  11. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  12. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
38 more
  1. 2019On Evaluating Adversarial Robustnesscited by 442
  2. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  3. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  4. 2018Certified Defenses against Adversarial Examplescited by 305
  5. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  6. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  7. 2018Spatially Transformed Adversarial Examplescited by 195
  8. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  9. 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 181
  10. 2017OSQP: An Operator Splitting Solver for Quadratic Programscited by 156
  11. 2018Scaling provable adversarial defensescited by 141
  12. 2019Branch and Bound for Piecewise Linear Neural Network Verificationcited by 138
  13. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  14. 2019Adversarial Training Can Hurt Generalizationcited by 131
  15. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 124
  16. 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 123
  17. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  18. 2019Sparse and Imperceivable Adversarial Attackscited by 95
  19. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  20. 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
  21. 2018Semantic Adversarial Examplescited by 86
  22. 2019Functional Adversarial Attackscited by 82
  23. 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
  24. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75
  25. 2015Learning with a Strong Adversarycited by 68
  26. 2020Enabling certification of verification-agnostic networks via memory-efficient semidefinite programmingcited by 65
  27. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  28. 2018Training verified learners with learned verifierscited by 50
  29. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  30. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
  31. 2019Provable robustness against all adversarial lp-perturbations for p≥ 1cited by 39
  32. 2019Fastened CROWN: Tightened Neural Network Robustness Certificatescited by 39
  33. 2020Non-convex Min-Max Optimization: Applications, Challenges, and Recent Theoretical Advancescited by 37
  34. 2018Logit Pairing Methods Can Fool Gradient-Based Attackscited by 27
  35. 2018Gradient Sampling Methods for Nonsmooth Optimizationcited by 23
  36. 2019GENO -- GENeric Optimization for Classical Machine Learningcited by 12
  37. 2022NCVX: A General-Purpose Optimization Solver for Constrained Machine and Deep Learningcited by 7
  38. 2022Optimization for Classical Machine Learning Problems on the GPUcited by 5

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 4; 2026: 1.

6 papers.

  1. 2024Selective Classification Under Distribution Shiftscited by 12
  2. 2025SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinationscited by 9
  3. 2025Unveiling and Mitigating Adversarial Vulnerabilities in Iterative Optimizerscited by 4
  4. 2025Exact Reformulation and Optimization for Direct Metric Optimization in Binary Imbalanced Classificationcited by 2
  5. 2025A stochastic smoothing framework for nonconvex-nonconcave minEmax problems with applications to Wasserstein distributionally robust optimizationcited by 1
  6. 2026REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinationscited by 0