Source-linked AI summary
Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
Jérôme Rony, Luiz G. Hafemann, Luiz S. Oliveira, Ismail Ben Ayed, Robert Sabourin, Eric Granger
TL;DR
The paper addresses the slowness of minimum-distortion C&W attacks, proposing DDN, which decouples perturbation direction and norm. Across MNIST, CIFAR-10, and ImageNet, DDN achieves comparable or better attack performance with far fewer iterations, while DDN-trained models show strong bounded-norm robustness.
Problem
C&W obtains low-L2-norm adversarial examples but requires line search and many iterations, limiting efficient robustness evaluation and adversarial training.
Method
DDN optimizes cross-entropy while decoupling perturbation direction and norm through norm adaptation and projection onto an L2 sphere.
Results
Across MNIST, CIFAR-10, and ImageNet, DDN achieves state-of-the-art-comparable L2 results with ~100 times fewer iterations; DDN-trained models outperform Madry under bounded norms.
Takeaways & Limitations
DDN enables faster evaluation of differentiable-model robustness and adversarial training, with state-of-the-art white-box L2 robustness reported on MNIST and CIFAR-10.
Takeaways & Limitations
The proposed adversarial-training method does not have the theoretical guarantees of the Madry defense, and the analysis assumes a white-box differentiable-classifier setting.
Abstract
from arXiv · showhide
Research on adversarial examples in computer vision tasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering $L_2$ norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low $L_2$ norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of $L_2$ norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against white-box gradient-based $L_2$ attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm.
1. Introduction
Gradient-based L2 attacks must balance low distortion against misclassification, but C&W is slow because its penalty weighting requires line search and many iterations. DDN decouples perturbation direction and norm, matching state-of-the-art results with substantially fewer iterations and supporting adversarial training.
- Motivation: C&W minimizes L2 distortion and misclassification jointly, using an expensive line search to balance the objectives.This makes robustness evaluation and adversarial training impractical.
- Proposed attack: DDN generates low-L2-norm misclassifications by optimizing cross-entropy while decoupling perturbation direction from norm.It projects perturbations onto an L2 sphere and adjusts the norm according to whether the current sample is adversarial.
- Experimental results: ~100 times less iterations: DDN achieves results comparable to the state of the art across MNIST, CIFAR-10, and ImageNet.The experiments evaluate the attack on all three datasets.
- Experimental results: Less than 10 minutes versus over 35 hours: DDN attacks 1,000 ImageNet images faster than C&W in untargeted attacks.The passage also reports better performance than C&W for this ImageNet setting.
- Adversarial training: 87.2% versus 67.3% accuracy: on MNIST with attack norm restricted to 1.5, DDN-trained models outperform Madry-trained models.On CIFAR-10 with norm restricted to 0.5, the corresponding accuracies are 67.6% and 56.1%.
2. Related Work
Prior work frames adversarial-example generation around trading off distortion, misclassification, and computational cost, while defenses seek robustness against increasingly strong attacks.
- Attacks: Adversarial-example research includes attacks that minimize perturbation and attacks designed for fast generation during adversarial training.
- Attacks: The L-BFGS attack uses box-constrained optimization and line search to find an appropriate balancing constant C.
- Attacks: FGSM generates adversarial examples in one step, originally targeting the L∞ norm but also adapted to L2 attacks.
- Attacks: DeepFool iteratively refines an untargeted adversarial example by approximating the classifier locally and crossing its decision boundary.
- Attacks: C&W jointly minimizes adversariality and L2 distortion, using tanh reparameterization and logit differences; its confidence parameter κ controls misclassification confidence.
- Defenses: Madry adversarial training alternates between finding a loss-maximizing perturbation in a feasible region and minimizing the loss over model parameters.
3. Decoupled Direction and Norm Attack
DDN replaces penalty-based joint optimization with separate control of perturbation direction and L2 norm, using projection and adversarial-status feedback to search efficiently.
- Motivation: Penalty methods jointly optimize norm and classification terms, but selecting their balance can require an expensive line search and many iterations.The C&W formulation becomes slow and impractical for adversarial training when the balancing constant is poorly chosen.
- Core approach: DDN optimizes cross-entropy while projecting the perturbation onto an L2-sphere centered at the original image.The norm is constrained by projection rather than penalized during optimization.
- Norm control: If the current sample is non-adversarial, DDN increases the next norm; if adversarial, it decreases it.The updates use ϵ_k+1 = (1 + γ)ϵ_k for non-adversarial samples and ϵ_k+1 = (1 −γ)ϵ_k for adversarial samples.
- Iteration procedure: Each iteration takes a gradient step, projects back onto the selected sphere, and clips the result to the feasible image range.For images normalized to [0, 1], clipping keeps every pixel within that interval; quantization may also be applied.
- Norm refinement: Near a tangent decision boundary, alternating norm increases and decreases produce a finer search while globally reducing the norm by 1 −γ^2 every two steps.At tangency, the gradient step and perturbation direction align, causing oscillation across the boundary.
4. Attack Evaluation
The evaluation compares DDN with C&W and DeepFool across MNIST, CIFAR-10, and ImageNet under untargeted and targeted settings. DDN generally matches or exceeds state-of-the-art L2 performance with substantially fewer iterations.
- Experimental setup: Experiments evaluate DDN against C&W L2 and DeepFool on MNIST, CIFAR-10, and ImageNet using untargeted and targeted attacks.Untargeted evaluation reports success rate, successful-attack mean L2 norm, median L2 norm, gradient computations, and runtime.
- Baselines: C&W is evaluated with its standard 9×10 000-iteration configuration and additional 100-iteration settings with fixed or searched constants.The limited-iteration C&W settings use either 1×100 iterations or 4×25 iterations, with dataset-specific grid search.
- DDN configuration: DDN uses 100, 300, or 1,000 iterations with ϵ0 = 1 and γ = 0.05, while its step size is cosine-annealed from 1 to 0.01.Images are quantized to 256 levels and constrained to the [0, 1] range.
- Untargeted results: 100 iterations brings DDN within 5% of C&W’s MNIST norm, compared with 54 007 iterations for C&W; capped at 100 iterations, C&W performs worse than DDN.For MNIST and CIFAR-10, DDN is comparable to state-of-the-art, while on ImageNet it achieves better mean L2 norms than both comparison attacks and reaches 100% success in 300 iterations.
- Targeted results: For targeted attacks, DDN matches C&W with 9×10 000 iterations on MNIST and CIFAR-10, outperforms 100-iteration C&W, and surpasses C&W on ImageNet at 100 iterations.With 100 iterations, C&W shows a noticeable success-rate drop when targeting the least likely class.
5. Adversarial Training with DDN
DDN enables adversarial training by generating adversarial examples that are projected into a bounded L2 region around each training sample. Unlike Madry training, it optimizes the loss of the closest adversarial example rather than the worst-case example.
- DDN-generated adversarial examples are projected into an ϵ-ball around the original sample, bounding the perturbation norm during training.
- DDN adversarial training optimizes the loss of the closest adversarial example, whereas Madry training uses the worst-case adversarial example within the ϵ-ball.
- The defense is motivated by pushing the decision boundary away from each training sample at every iteration.
- The proposed defense does not have Madry’s theoretical guarantees, although both methods are compared empirically because Madry training also uses approximations in practice.
6. Defense Evaluation
The defense evaluation compares adversarially trained models with baseline and Madry models under untargeted attacks and bounded perturbation norms. DDN-trained models require larger perturbations and retain higher accuracy across the reported MNIST and CIFAR-10 bounds.
- Evaluation setup: Three untargeted attacks—Carlini, DeepFool, and DDN—are evaluated, with the smallest perturbation across attacks reported in the “All” row.
- Unbounded attacks: For unbounded attacks, adversarial examples succeed almost 100% of the time, but DDN-trained models require an increased L2 norm to induce misclassification.
- Bounded-norm robustness: At ϵ = 1.5 on MNIST, accuracy is 40.8% for the baseline, 67.3% for Madry, and 87.2% for the DDN defense.
- Bounded-norm robustness: At ϵ = 2.0 on MNIST, accuracy is 9.2% for the baseline, 38.6% for Madry, and 74.8% for the DDN defense.
- Bounded-norm robustness: At ϵ = 0.5 on CIFAR-10, accuracy is 0.1% for the baseline, 56.1% for Madry, and 67.6% for the DDN defense.
- Bounded-norm robustness: At ϵ = 1.0 on CIFAR-10, accuracy is 0% for the baseline, 24.4% for Madry, and 39.9% for the DDN defense.
7. Conclusion
The paper concludes that DDN matches state-of-the-art L2 attack performance with far fewer iterations and supports faster robustness evaluation and adversarial training. MNIST and CIFAR-10 experiments show state-of-the-art white-box L2 robustness, while challenge results extend the reported effectiveness to black-box settings.
- DDN achieves state-of-the-art-comparable L2 perturbations in much fewer iterations, enabling faster robustness evaluation and adversarial training.
- MNIST and CIFAR-10 experiments show state-of-the-art robustness against white-box L2-based attacks.
- The methods ranked first in untargeted attacks and third in targeted attacks and robust models at the NIPS 2018 Adversarial Vision Challenge.
A. Model architectures
The evaluation uses architectures matched to prior work for fair attack comparisons and a Wide ResNet for CIFAR-10 robust-model training. Additional C&W settings vary iteration allocation and search over learning rates and penalty weights.
- Attack evaluation: Attack evaluation uses the same architecture as Carlini and Wagner for fair comparison with C&W and DeepFool.
- Robust-model architecture: The CIFAR-10 robust model uses a Wide ResNet with 28 layers and widening factor 10 (WRN-28-10).
- C&W settings: C&W is tested with either 100 iterations and fixed C or four C-search steps of 25 iterations each.
- C&W settings: The C&W grid search varies learning rates [0.01, 0.05, 0.1, 0.5, 1] and C values [0.001, 0.01, 0.1, 1, 10, 100, 1 000].
C. Examples of adversarial images
The examples compare adversarial attacks across baseline and defended models, showing that adversarially trained models may require visibly larger changes to induce misclassification.
- C&W attacks on the first 10 MNIST samples are organized by source label in rows and target class in columns.Diagonal entries are the original samples.
- Adversarially trained models require much larger changes than baseline models to make MNIST samples adversarial.Some resulting adversarial samples visually resemble another class.
- CIFAR-10 examples compare attacks against the baseline, Madry defense, and proposed defense.Randomly selected examples use the minimum-L2 result from DDN, C&W, and DeepFool attacks; cherry-picked examples for the proposed defense visually resemble another class.
D. Attack performance curves
The performance plots compare perturbation size and model accuracy across multiple attack methods, datasets, and model settings.
- Perturbation-size-versus-accuracy curves compare Carlini, DeepFool, and DDN attacks.The plotted configurations use Carlini 9×10 000, DeepFool 100, and DDN 300 iterations.
- Figure 6 compares C&W L2 adversarial examples on a baseline model and a model adversarially trained with the proposed attack.
- Figure 7 compares randomly chosen CIFAR-10 adversarial examples for the baseline and Madry defense models.The figure arranges original images above attacks against the baseline and Madry defense.
- Figure 8 compares cherry-picked CIFAR-10 examples for the baseline, Madry defense, and proposed defense.The bottom row reports predicted labels for attacks against the proposed defense.
- Figure 9 reports attack performances across different datasets and models.