Dummy-Aware Weighted Attack (DAWA): Breaking the Safe Sink in Dummy Class Defenses
Not on the map. Why?
Abstract (arXiv)
Adversarial robustness evaluation faces a critical challenge as new defense paradigms emerge that can exploit limitations in existing assessment methods. This paper reveals that Dummy Classes-based defenses, which introduce an additional "dummy" class as a safety sink for adversarial examples, achieve significantly overestimated robustness under conventional evaluation strategies like AutoAttack. The fundamental limitation stems from these attacks' singular focus on misleading the true class label, which aligns perfectly with the defense mechanism--successful attacks are simply captured by the dummy class. To address this gap, we propose Dummy-Aware Weighted Attack (DAWA), a novel evaluation method that simultaneously targets both the true label and dummy label with adaptive weighting during adversarial example synthesis. Extensive experiments demonstrate that DAWA effectively breaks this defense paradigm, reducing the measured robustness of a leading Dummy Classes-based defense from 58.61% to 29.52% on CIFAR-10 under l_infty perturbation (epsilon=8/255). Our work provides a more reliable benchmark for evaluating this emerging class of defenses and highlights the need for continuous evolution of robustness assessment methodologies.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 30 of its 39 references that are in the map. First posted on arXiv 31 Mar 2026.
Builds on
30 of 39 references.
References · 30
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2018Robustness May Be at Odds with Accuracycited by 873
- 2019Adversarial Training for Free!cited by 638
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2022Diffusion Models for Adversarial Purificationcited by 469
18 more
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
- 2018Generating Adversarial Examples with Adversarial Networkscited by 256
- 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
- 2020Can Autonomous Vehicles Identify, Recover From, and Adapt to Distribution Shifts?cited by 139
- 2020Boosting Adversarial Training with Hypersphere Embeddingcited by 97
- 2019Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Trainingcited by 95
- 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
- 2020Composite Adversarial Attackscited by 29
- 2019Targeted Mismatch Adversarial Attack: Query with a Flower to Retrieve the Towercited by 26
- 2021LAFEAT: Piercing Through Adversarial Defenses with Latent Featurescited by 24
- 2018Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Sizecited by 9
- 2022MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attackcited by 7
- 2025Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Losscited by 1
Built on by
Not cited yet.