PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks
Not on the map. Why?
Abstract (arXiv)
Imperceptible adversarial attacks have recently attracted increasing research interests. Existing methods typically incorporate external modules or loss terms other than a simple lp-norm into the attack process to achieve imperceptibility, while we argue that such additional designs may not be necessary. In this paper, we rethink the essence of imperceptible attacks and propose two simple yet effective strategies to unleash the potential of PGD, the common and classical attack, for imperceptibility from an optimization perspective. Specifically, the Dynamic Step Size is introduced to find the optimal solution with minimal attack cost towards the decision boundary of the attacked model, and the Adaptive Early Stop strategy is adopted to reduce the redundant strength of adversarial perturbations to the minimum level. The proposed PGD-Imperceptible (PGD-Imp) attack achieves state-of-the-art results in imperceptible adversarial attacks for both untargeted and targeted scenarios. When performing untargeted attacks against ResNet-50, PGD-Imp attains 100% (+0.3%) ASR, 0.89 (-1.76) l2 distance, and 52.93 (+9.2) PSNR with 57s (-371s) running time, significantly outperforming existing methods.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 38 references that are in the map. First posted on arXiv 15 Dec 2024.
Builds on
29 of 38 references.
References · 29
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Adam: A Method for Stochastic Optimizationcited by 37,240
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
- 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
- 2016Wide Residual Networkscited by 3,070
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016An overview of gradient descent optimization algorithmscited by 1,033
17 more
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
- 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
- 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 351
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
- 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
- 2021Understanding and Improving Early Stopping for Learning with Noisy Labelscited by 113
- 2018Adversarial Attacks and Defences Competitioncited by 96
- 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
- 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 77
- 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 73
- 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 58
- 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 56
- 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
- 2018Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networkscited by 38
- 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
- 2022Imperceptible Adversarial Attack via Invertible Neural Networkscited by 12
- 2022Enhance transferability of adversarial examples with model architecturecited by 4
Built on by
Not cited yet.