Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints

Abstract

Evaluating adversarial robustness amounts to finding the minimum perturbation needed to have an input sample misclassified. The inherent complexity of the underlying optimization requires current gradient-based attacks to be carefully tuned, initialized, and possibly executed for many computationally-demanding iterations, even if specialized to a given perturbation model. In this work, we overcome these limitations by proposing a fast minimum-norm (FMN) attack that works with different ${\ell }_p$-norm perturbation models ($p=0,1,2,\infty$), is robust to hyperparameter choices, does not require adversarial starting points, and converges within few lightweight steps. It works by iteratively finding the sample misclassified with maximum confidence within an ${\ell }_p$-norm constraint of size $\epsilon$, while adapting $\epsilon$ to minimize the distance of the current sample to the decision boundary. Extensive experiments show that FMN significantly outperforms existing attacks in terms of convergence speed and computation time, while reporting comparable or even smaller perturbation sizes.

arXiv commentAccepted at NeurIPS'21

References in corpus (7)

• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Evaluating Adversarial Robustness
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• RobustBench: a standardized adversarial robustness benchmark
• Accurate, reliable and fast robustness evaluation

Cited by in corpus (3)

• Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples
• Where to Look: A Unified Attention Model for Visual Recognition with Reinforcement Learning
• Improving Fast Minimum-Norm Attacks with Hyperparameter Optimization