Back

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco CroceMatthias Hein

article2020ICML2,528 citations

Establishes a standardized, parameter-free ensemble of diverse attacks that reliably evaluates adversarial defense claims and exposes vulnerabilities across dozens of published machine learning models.

Listen

The article addresses the challenge of reliably assessing adversarial robustness in machine learning classifiers. Many proposed defenses against adversarial attacks have later been shown to be ineffective due to inadequate evaluation methods, such as improper attack tuning or gradient masking, which creates uncertainty about true progress in the field and hinders identification of effective approaches, particularly for safety-critical applications.

The article set out to create and validate a parameter-free ensemble of attacks that can autonomously and consistently evaluate adversarial robustness across diverse models and datasets without requiring user-specific adjustments.

The authors developed two extensions to the standard PGD attack, introduced an alternative loss function called DLR, and combined these with existing complementary attacks (FAB and Square Attack) to form the AutoAttack ensemble. They then applied this ensemble to more than 50 models from 35 recent papers across MNIST, CIFAR-10, CIFAR-100, and ImageNet in both l-infinity and l2 threat models, using original or retrained networks where possible.

AutoAttack produced lower robust accuracy than originally reported in all but one case, with reductions exceeding 10 percent in 13 cases and 30 percent in eight cases. The targeted DLR variant performed best on most CIFAR and ImageNet models, while Square Attack excelled on MNIST; the ensemble also succeeded on randomized defenses. Several claimed state-of-the-art defenses proved significantly weaker than prior evaluations suggested, while adversarial training variants using extra data remained among the strongest.

These results indicate that current evaluation practices frequently overestimate robustness and that AutoAttack offers a practical, low-cost baseline for future work. Adopting it as a standard test would help distinguish genuinely effective defenses from broken ones and accelerate reliable progress.

The authors recommend integrating AutoAttack into standard evaluation pipelines for new defenses because it requires no hyperparameter tuning and runs at modest computational cost. Additional data collection or model access would enable a more exhaustive survey of the field.

The evaluation covers a broad but not complete set of published models, and certain discontinuous classifiers may still require supplementary black-box methods. Overall confidence in the findings is high given the scale and consistency of results across datasets and norms.

University of Tübingencomputer visionensemble classifiersobfuscationAutoAttackAuto‑PGDPGD
arXiv: 2003.01690fra31/auto-attack
Cover for Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Abstract

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness. Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art. Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking. In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function. We then combine our novel attacks with two complementary existing ones to form a parameter-free, computationally affordable and user-independent ensemble of attacks to test adversarial robustness. We apply our ensemble to over 50 models from papers published at recent top machine learning and computer vision venues. In all except one of the cases we achieve lower robust test accuracy than reported in these papers, often by more than 10%10\%, identifying several broken defenses.

Topics

computer visionensemble classifiersobfuscationstep sizedenial of service attacksmalicious attackrobust performance

Keywords

AutoAttackAuto‑PGDPGDFAB AttackSquare AttackDLR LossAdversarial RobustnessGradient MaskingParameter‑FreeEnsemble

Table of Contents

  • 1 Introduction
  • 2 Adversarial examples and PGD
  • 3 Auto-PGD: A budget-aware step size-free variant of PGD
  • 3.1 Auto-PGD (APGD) algorithm
  • 3.2 Comparison of APGD to usual PGD
  • 4 An alternative loss
  • 4.1 Difference of Logits Ratio Loss
  • 4.2 APGD versus PGD on different losses
  • 5 AutoAttack: an ensemble of parameter-free attacks
  • 5.1 Untargeted vs targeted attacks
  • 6 Experiments
  • 6.1 Analysis of SOTA of adversarial defenses
  • References
  • A Auto-PGD
  • A.1 Comparison of APGD to PGD
  • B AutoAttack: implementation details
  • C Experiments
  • C.1 Comparison PGD vs PGD with Momentum vs APGD on different losses
  • D Potential failure cases of APGDCE and APGDDLR
  • D.1 Cross-entropy loss
  • D.2 Difference-of-Logits Ratio (DLR) loss

Knowls

  1. Knowl 1 — Auto-PGD: budget-aware optimization without a hand-tuned step size

    algorithm

    Auto-PGD (APGD) is a projected-gradient attack that adapts its step size to both the iteration budget and observed optimization progress. Given a differentiable objective f:S→Rf:S\to\mathbb{R}, feasible set S⊆RdS\subseteq\mathbb{R}^d, feasible starting point x(0)∈Sx^{(0)}\in S, and budget NiterN_{\mathrm{iter}}, APGD returns the best point xmax⁡x_{\max} found and its objective value.

    The first update uses step size η(0)=2ϵ\eta^{(0)}=2\epsilon, where ϵ\epsilon is the allowed perturbation radius, and projects onto SS. Subsequent updates use momentum:

    z(k+1)=PS(x(k)+η(k)∇f(x(k))),z^{(k+1)}=P_S\left(x^{(k)}+\eta^{(k)}\nabla f(x^{(k)})\right), x(k+1)=PS(x(k)+α(z(k+1)−x(k))+(1−α)(x(k)−x(k−1))),x^{(k+1)}=P_S\left(x^{(k)}+\alpha\left(z^{(k+1)}-x^{(k)}\right)+(1-\alpha)\left(x^{(k)}-x^{(k-1)}\right)\right),

    where kk is the iteration index, PSP_S is projection onto SS, and α=0.75\alpha=0.75. For an ℓ∞\ell_\infty threat model, the gradient direction is replaced by its coordinate-wise sign; for an ℓ2\ell_2 threat model, the gradient is normalized with respect to the ℓ2\ell_2 norm.

    APGD checks the optimization at checkpoints wj=⌊pjNiter⌋w_j=\lfloor p_jN_{\mathrm{iter}}\rfloor. The schedule is p0=0p_0=0, p1=0.22p_1=0.22, and pj+1=pj+max⁡{pj−pj−1−0.03,0.06}p_{j+1}=p_j+\max\{p_j-p_{j-1}-0.03,0.06\}. At checkpoint wjw_j, the step size is halved if either fewer than a fraction ρ=0.75\rho=0.75 of the updates since wj−1w_{j-1} increased the objective, or the step size was not halved at the previous checkpoint and the best objective value has not improved since then. Whenever the step size is halved, the next iterate is reset to the best point found so far. APGD keeps the point with the largest objective value throughout the run. It requires one forward and one backward pass per iteration and has no tunable parameter beyond the iteration budget once these fixed constants are adopted.

  2. Knowl 2 — Difference-of-Logits Ratio loss

    model/method

    The Difference-of-Logits Ratio (DLR) loss is designed to depend only on the classifier’s decision structure rather than on arbitrary shifts or positive rescalings of its logits. Let a classifier produce logits z=(z1,…,zK)∈RKz=(z_1,\ldots,z_K)\in\mathbb{R}^K for input xx, let yy be the correct class, and let π\pi order the logits in decreasing order, so zπ1≥zπ2≥⋯≥zπKz_{\pi_1}\ge z_{\pi_2}\ge\cdots\ge z_{\pi_K}. The untargeted DLR loss is

    DLR⁡(x,y)=−zy−max⁡i≠yzizπ1−zπ3.\operatorname{DLR}(x,y)=-\frac{z_y-\max_{i\ne y}z_i}{z_{\pi_1}-z_{\pi_3}}.

    The loss is invariant to adding the same constant to every logit and to multiplying all logits by a positive constant. It is positive only when the predicted class is not yy; after misclassification, maximizing it further reduces the relative score of the correct class. For a correctly classified input, the loss lies in [−1,0][-1,0] and encourages the second-highest logit to approach the correct-class logit while remaining above the third-highest logit.

    For a specified target class t≠yt\ne y, the targeted version is

    Targeted-DLR⁡(x,y,t)=−zy−ztzπ1−(zπ3+zπ4)/2.\operatorname{Targeted\text{-}DLR}(x,y,t)=-\frac{z_y-z_t}{z_{\pi_1}-\left(z_{\pi_3}+z_{\pi_4}\right)/2}.

    This targeted objective retains shift and positive-rescaling invariance while encouraging zt>zyz_t>z_y. The authors use it in targeted APGD and report that it is more stable than the cross-entropy and, in their experiments, less prone to severe failure than the CW loss.

  3. Knowl 3 — AutoAttack: a fixed ensemble for robustness evaluation

    model/method

    AutoAttack is an automatic adversarial-robustness evaluation protocol that combines four attacks with complementary failure modes. For a classifier, input with true label, threat norm and radius ϵ\epsilon, it declares an input successfully attacked if at least one component finds a misclassified point within the allowed perturbation set. The reported robust accuracy is therefore the fraction of evaluated inputs for which all four attacks fail.

    The fixed ensemble contains: (1) untargeted APGD on cross-entropy without random restarts, (2) targeted APGD on Targeted-DLR using nine target classes, (3) targeted FAB using nine target classes, and (4) one run of the score-based black-box Square Attack with 5,000 queries. Each white-box attack uses 100 iterations. The nine target classes are the nine non-correct classes with the highest scores at the original input. The attack hyperparameters are held fixed across datasets, models, and threat norms, so users do not tune a step size, restart count, or loss-specific parameter for each defense.

    APGD searches for any adversarial point using gradients, FAB searches for a low-distortion boundary crossing, and Square Attack performs gradient-free random search. The ensemble is intended to remain effective when one attack fails because of gradient masking, an unsuitable loss landscape, discontinuities, or a mismatch between the attack objective and the decision boundary. Its computational cost is designed to be comparable to the average attack budget used in the evaluated defense papers.

  4. Knowl 4 — Cross-entropy gradient masking under logit rescaling

    empirical result

    The cross-entropy objective can make gradient-based robustness evaluation depend on the arbitrary scale of a classifier’s logits. If ziz_i is the logit for class ii, yy is the correct class, and pi=exp⁡(zi)/∑j=1Kexp⁡(zj)p_i=\exp(z_i)/\sum_{j=1}^{K}\exp(z_j), then

    CE⁡(x,y)=−log⁡py=−zy+log⁡(∑j=1Kexp⁡(zj)).\operatorname{CE}(x,y)=-\log p_y=-z_y+\log\left(\sum_{j=1}^{K}\exp(z_j)\right).

    Its input gradient is

    ∇xCE⁡(x,y)=(−1+py)∇xzy+∑i≠ypi∇xzi.\nabla_x\operatorname{CE}(x,y)=(-1+p_y)\nabla_x z_y+\sum_{i\ne y}p_i\nabla_x z_i.

    When pyp_y is close to one, the gradient can be numerically zero. This can happen even though replacing logits g(x)g(x) by g(x)/αg(x)/\alpha for any α>0\alpha>0 leaves every classifier decision unchanged. On a CIFAR-10 classifier, the authors ran 100 iterations of ℓ∞\ell_\infty PGD with ϵ=0.031\epsilon=0.031 on 1,000 test points while using logit rescalings α∈{1,10,100,1000}\alpha\in\{1,10,100,1000\}. With the original scale, gradients were zero in nearly every coordinate, making PGD ineffective; merely rescaling the logits produced a much more informative and substantially lower robustness estimate. This demonstrates that cross-entropy PGD can overestimate robustness because of finite-precision gradient masking, although maximizing cross-entropy remains useful for randomized defenses because it reduces confidence in the correct class rather than merely seeking a label change.

  5. Knowl 5 — APGD outperforms fixed-step PGD across attack budgets

    empirical result

    The authors compared APGD with ordinary PGD and momentum PGD on deterministic robust models from MNIST and CIFAR-10, using ℓ∞\ell_\infty perturbations. Fixed-step PGD and momentum PGD were tested with step sizes ϵ/t\epsilon/t for t∈{0.5,1,2,4,10,25,100}t\in\{0.5,1,2,4,10,25,100\} over 1,000 iterations, while APGD was tested with budgets in {25,50,100,200,400,1000}\{25,50,100,200,400,1000\}. Attack strength was measured by the largest cross-entropy value found and by robust accuracy, where lower robust accuracy is better.

    For every tested iteration budget, APGD obtained the highest cross-entropy objective and generally the lowest robust accuracy. Fixed-step methods typically plateaued early, whereas APGD continued improving when given a larger budget. The longer exploratory phase of APGD sometimes produced slower initial progress but ultimately reached better solutions. The same qualitative result held when APGD was compared with PGD without momentum.

    In the larger comparison over 43 deterministic ℓ∞\ell_\infty-robust models, APGD achieved the lowest robust accuracy among APGD and six fixed-step PGD variants on 32 models for cross-entropy, 37 models for CW loss, and 35 models for DLR loss. With the best conventional momentum-PGD setting, step size ϵ/4\epsilon/4, mean robust accuracy was 54.84%54.84\% for cross-entropy, 50.42%50.42\% for CW, and 50.47%50.47\% for DLR; APGD reduced these means to 54.00%54.00\%, 49.46%49.46\%, and 48.53%48.53\%, respectively.

  6. Knowl 6 — DLR gives a more stable objective than cross-entropy or CW

    empirical result

    The authors evaluated PGD, momentum PGD, and APGD while optimizing cross-entropy, CW, or DLR losses on deterministic models trained for ℓ∞\ell_\infty robustness. The fixed-step baselines used step sizes ϵ/10\epsilon/10, ϵ/4\epsilon/4, and 2ϵ2\epsilon, while APGD used the same iteration budget without a user-selected step size.

    Across the 43 evaluated models, APGD was usually the strongest method regardless of the loss: it beat the six fixed-step PGD variants on 32 models with cross-entropy, 37 with CW, and 35 with DLR. Comparing losses across all attack variants, CW could be up to 21 percentage points worse than DLR on a model, whereas CW was never more than 5 percentage points better. Thus DLR was more stable than CW and improved on cross-entropy while retaining comparable performance to CW. For the evaluated ℓ2\ell_2-robust models, APGD was again most often strongest, but the differences among cross-entropy, CW, and DLR were small.

  7. Knowl 7 — Targeted attacks improve scalability and often strengthen evaluation

    empirical result

    The ensemble uses targeted rather than untargeted DLR and FAB attacks because targeted attacks can be made computationally independent of the number of classes when the number of targets is fixed. Targeted FAB linearizes only the decision boundary between the correct class and a selected target, instead of all K−1K-1 competing boundaries, where KK is the number of classes. This avoids the class-dependent Jacobian cost that makes untargeted FAB impractical for datasets such as CIFAR-100 and ImageNet.

    The authors compared untargeted attacks with five random restarts against targeted attacks using the nine highest-scoring incorrect classes. On CIFAR-10, CIFAR-100, and ImageNet, targeted APGD-DLR achieved lower robust accuracy in 35 of 36 comparisons and targeted FAB did so in 29 of 32 comparisons. On MNIST, untargeted versions were often stronger, but Square Attack was stronger than both targeted APGD-DLR and targeted FAB, so the authors still selected the targeted versions for the general-purpose ensemble.

  8. Knowl 8 — AutoAttack exposes large overestimates in deterministic defenses

    empirical result

    AutoAttack was evaluated on 49 deterministic models from 35 recent defense papers: 43 models trained for ℓ∞\ell_\infty robustness and 6 trained for ℓ2\ell_2 robustness, covering MNIST, CIFAR-10, CIFAR-100, and ImageNet. Robust accuracy was measured on the complete test set except for ImageNet, where 1,000 validation images were used.

    AutoAttack produced a lower robust accuracy than the original paper reported for 48 of 49 models. The reduction exceeded 10 percentage points for 13 models and 30 percentage points for 8 models. Examples include reductions of 39.97 points for one CIFAR-10 model reported by Wang and Zhang, 33.90 points for the CIFAR-10 model of Xiao et al., and 64.25 points for the MNIST model of Taghanaki et al. The sole case without a reduction differed from the reported value by only 0.030.03 percentage points; the original evaluation used PGD with 180 restarts and 200 iterations, substantially more computation than the fixed AutoAttack protocol.

    The evaluation also suggested that the strongest empirical defenses generally remained variations or refinements of adversarial training, especially methods using additional data. Several methods claiming state-of-the-art robustness were substantially weaker than the Madry et al. adversarial-training baseline. The most resistant evaluated MNIST model was trained for certified robustness and had a reported verified lower bound of 93.32%93.32\%.

  9. Knowl 9 — AutoAttack evaluates randomized defenses with expectation-based gradients

    experimental setup

    For stochastic classifiers whose output may change across repeated evaluations of the same input, the authors evaluated each attack over five runs and reported means and standard deviations. For APGD, each update direction was computed by averaging 20 gradient evaluations at the same point, using untargeted losses and one run of the attack. Square Attack accepted an update only when it reduced the target loss averaged over 20 forward passes and used 1,000 iterations because of the added cost. FAB was omitted because its boundary-near adversarial examples were easily invalidated by small stochastic changes. For the JEM models, deterministic attack examples generated for JEM-0 were reused on JEM-1 and JEM-10 because the stochastic component had little influence.

    On nine randomized CIFAR-10 defense evaluations, AutoAttack achieved lower robust accuracy than the value reported by the original papers in every case. The improvement exceeded 10 percentage points in 7 of 9 cases and 25 percentage points in 3 cases. For example, at ϵ=8/255\epsilon=8/255, the JEM-10, JEM-1, and JEM-0 models had AutoAttack robust accuracies of 9.92%9.92\%, 8.15%8.15\%, and 6.36%6.36\%, compared with reported values of 47.6%47.6\%, 41.8%41.8\%, and 19.8%19.8\%, respectively.

  10. Knowl 10 — Gradient-free components reveal failure cases of gradient-based APGD

    limitation

    APGD-CE and APGD-DLR can still overestimate robustness when the classifier provides unhelpful or discontinuous gradient information. The authors observed this on the discontinuous classifier of Xiao et al.; both APGD variants were less effective than the black-box Square Attack even though they substantially improved on the defense’s originally reported robustness.

    For that classifier, the standard AutoAttack Square Attack configuration of 5,000 queries and one random run produced robust accuracy of 20.44%20.44\% on the evaluated points. Increasing the Square Attack budget to 10,000 queries and 10 random restarts reduced robust accuracy to 8.0%8.0\% on 500 points. This case motivates retaining a gradient-free attack in the ensemble and limits the claim that APGD or DLR alone is a reliable universal evaluator. The large-scale survey itself was also not exhaustive because models or code were unavailable for some defenses.

Coverage note — Auxiliary per-model appendix tables, implementation provenance, and extended $\ell_2$ PGD comparison tables were not reproduced individually because their main findings are summarized in the algorithm and evaluation knowls.

References

  1. 1.Alayrac, J.-B., Uesato, J., Huang, P.-S., Fawzi, A., Stanforth, R., and Kohli, P. Are labels required for improving adversarial robustness? In NeurIPS, 2019.
  2. 2.Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV, 2020.
  3. 3.Athalye, A., Carlini, N., and Wagner, D. A. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018.
  4. 4.Atzmon, M., Haim, N., Yariv, L., Israelov, O., Maron, H., and Lipman, Y. Controlling neural level sets. In NeurIPS, 2019.
  5. 5.Augustin, M., Meinke, A., and Hein, M. Adversarial robustness on in-and out-distribution improves explainability. In ECCV, 2020.
  6. 6.Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017a.
  7. 7.Carlini, N. and Wagner, D. Adversarial examples are not easily detected: Bypassing ten detection methods. In ACM Workshop on Artificial Intelligence and Security, 2017b.
  8. 8.Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Madry, A., and Kurakin, A. On evaluating adversarial robustness. version from May 14, 2019, 2019. URL https://github.com/evaluating-adversarial-robustness/adv-eval-paper.
  9. 9.Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J. C., and Liang, P. S. Unlabeled data improves adversarial robustness. In NeurIPS, pp. 11190–11201, 2019.
  10. 10.Chan, A., Tay, Y., Ong, Y. S., and Fu, J. Jacobian adversarially regularized networks for robustness. In ICLR, 2020.
  11. 11.Cohen, J. M., Rosenfeld, E., and Kolter, J. Z. Certified adversarial robustness via randomized smoothing. In NeurIPS, 2019.
  12. 12.Croce, F. and Hein, M. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020.
  13. 13.Croce, F., Andriushchenko, M., and Hein, M. Provable robustness of relu networks via maximization of linear regions. In AISTATS, 2019a.
  14. 14.Croce, F., Rauber, J., and Hein, M. Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks. International J. of Computer Vision (IJCV), 2019b.
  15. 15.Ding, G. W., Wang, L., and Jin, X. AdverTorch v0.1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623, 2019.
  16. 16.Ding, G. W., Sharma, Y., Lui, K. Y. C., and Huang, R. Mma training: Direct input space margin maximization through adversarial training. In ICLR, 2020.
  17. 17.Engstrom, L., Ilyas, A., Santurkar, S., and Tsipras, D. Robustness (python library), 2019. URL https://github.com/MadryLab/robustness.
  18. 18.Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In ICLR, 2015.
  19. 19.Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arandjelovic, R., Mann, T. A., and Kohli, P. On the effectiveness of interval bound propagation for training verifiably robust models. In ICCV, 2019.
  20. 20.Grathwohl, W., Wang, K.-C., Jacobsen, J.-H., Duvenaud, D., Norouzi, M., and Swersky, K. Your classifier is secretly an energy based model and you should treat it like one. In ICLR, 2020.
  21. 21.Hendrycks, D., Lee, K., and Mazeika, M. Using pre-training can improve model robustness and uncertainty. In ICML, pp. 2712–2721, 2019.
  22. 22.Jang, Y., Zhao, T., Hong, S., and Lee, H. Adversarial defense via learning to generate diverse attacks. In ICCV, 2019.
  23. 23.Kim, J. and Wang, X. Sensible adversarial learning, 2020. URL https://openreview.net/forum?id=rJlf_RVKwr.
  24. 24.Kumari, N., Singh, M., Sinha, A., Machiraju, H., Krishnamurthy, B., and Balasubramanian, V. N. Harnessing the vulnerability of latent layers in adversarially trained models. In IJCAI, pp. 2779–2785, 7 2019.
  25. 25.Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In ICLR Workshop, 2017.
  26. 26.Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy (SP), 2019.
  27. 27.Li, B., Chen, C., Wang, W., and Carin, L. Certified adversarial robustness with additive noise. In NeurIPS, 2019.
  28. 28.Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Valdu, A. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
  29. 29.Mao, C., Zhong, Z., Yang, J., Vondrick, C., and Ray, B. Metric learning for adversarial robustness. In NeurIPS, pp. 478–489, 2019.
  30. 30.Mirman, M., Gehr, T., and Vechev, M. Differentiable abstract interpretation for provably robust neural networks. In ICML, 2018.
  31. 31.Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., and Frossard, P. Robustness via curvature regularization, and vice versa. In CVPR, 2019.
  32. 32.Mosbach, M., Andriushchenko, M., Trost, T., Hein, M., and Klakow, D. Logit pairing methods can fool gradient-based attacks. In NeurIPS 2018 Workshop on Security in Machine Learning, 2018.
  33. 33.Mustafa, A., Khan, S., Hayat, M., Goecke, R., Shen, J., and Shao, L. Adversarial defense by restricting the hidden space of deep neural networks. In ICCV, 2019.
  34. 34.Pang, T., Xu, K., Du, C., Chen, N., and Zhu, J. Improving adversarial robustness via promoting ensemble diversity. In ICML, 2019.
  35. 35.Pang, T., Xu, K., Dong, Y., Du, C., Chen, N., and Zhu, J. Rethinking softmax cross-entropy loss for adversarial robustness. In ICLR, 2020.
  36. 36.Qin, C., Martens, J., Gowal, S., Krishnan, D., Dvijotham, K., Fawzi, A., De, S., Stanforth, R., and Kohli, P. Adversarial robustness through local linearization. In NeurIPS, 2019.
  37. 37.Rice, L., Wong, E., and Kolter, J. Z. Overfitting in adversarially robust deep learning. In ICML, 2020.
  38. 38.Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., and Granger, E. Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. In CVPR, 2019.
  39. 39.Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free! In NeurIPS, pp. 3353–3364, 2019.
  40. 40.Song, C., He, K., Wang, L., and Hopcroft, J. E. Improving the generalization of adversarial training with domain adaptation. In ICLR, 2019.
  41. 41.Taghanaki, S. A., Abhishek, K., Azizi, S., and Hamarneh, G. A kernelized manifold mapping to diminish the effect of adversarial perturbations. In CVPR, 2019.
  42. 42.Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A. Robustness may be at odds with accuracy. In ICLR, 2019.
  43. 43.Wang, B., Shi, Z., and Osher, S. Resnets ensemble via the feynman-kac formalism to improve natural and robust accuracies. In NeurIPS, 2019.
  44. 44.Wang, J. and Zhang, H. Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks. In ICCV, 2019.
  45. 45.Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z. Scaling provable adversarial defenses. In NeurIPS, 2018.
  46. 46.Wong, E., Rice, L., and Kolter, J. Z. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
  47. 47.Xiao, C., Zhong, P., and Zheng, C. Enhancing adversarial defense by k-winners-take-all. In ICLR, 2020.
  48. 48.Yang, Y., Zhang, G., Katabi, D., and Xu, Z. ME-net: Towards effective adversarial robustness with matrix estimation. In ICML, 2019.
  49. 49.Zhang, D., Zhang, T., Lu, Y., Zhu, Z., and Dong, B. You only propagate once: Accelerating adversarial training via maximal principle. In NeurIPS, pp. 227–238, 2019a.
  50. 50.Zhang, H. and Wang, J. Defense against adversarial attacks using feature scattering-based adversarial training. In NeurIPS, pp. 1829–1839, 2019.
  51. 51.Zhang, H. and Xu, W. Adversarial interpolation training: A simple approach for improving model robustness, 2020. URL https://openreview.net/forum?id=Syejj0NYvr.
  52. 52.Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. I. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019b.
  53. 53.Zhang, H., Chen, H., Xiao, C., Gowal, S., Stanforth, R., Li, B., Boning, D., and Hsieh, C.-J. Towards stable and efficient training of verifiably robust neural networks. In ICLR, 2020.

Citation

MLA
Croce, F., and M. Hein. “Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks”. arXiv, 2020, https://doi.org/10.48550/arxiv.2003.01690.
APA
Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. arXiv. https://doi.org/10.48550/arxiv.2003.01690
Chicago
Croce, F., and M. Hein. 2020. “Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks”. Preprint, ArXiv. https://doi.org/10.48550/arxiv.2003.01690.
Harvard
Croce, F. and Hein, M. (2020) “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks”. arXiv. Available at: https://doi.org/10.48550/arxiv.2003.01690.
Vancouver
1. Croce F, Hein M (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. https://doi.org/10.48550/arxiv.2003.01690

BibTeX

@misc{https://doi.org/10.48550/arxiv.2003.01690,
  doi = {10.48550/ARXIV.2003.01690},
  url = {https://arxiv.org/abs/2003.01690},
  author = {Croce, Francesco and Hein, Matthias},
  keywords = {Machine Learning (cs.LG), Computer Vision and Pattern Recognition (cs.CV), Machine Learning (stat.ML), FOS: Computer and information sciences, FOS: Computer and information sciences},
  title = {Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks},
  publisher = {arXiv},
  year = {2020},
  copyright = {arXiv.org perpetual, non-exclusive license}
}
Metadata:DOI registry

Source Code

This paper has an official code repository available. Click below to access the source code.

View Repository

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: https://creativecommons.org/licenses/by/4.0/