Source-linked AI summary
Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
Francesco Croce, Matthias Hein
TL;DR
Neural-network robustness is commonly assessed with empirical attacks because exact minimal-perturbation computation does not scale to large networks. The paper proposes a geometric white-box attack for l_p norms with p ∈{1, 2, ∞}, reporting strong quality, broad applicability, and resistance to gradient masking.
Problem
Robustness evaluation relies on empirical attacks to approximate minimal adversarial perturbations because exact computation does not scale to large networks.
Method
The paper proposes FAB, a geometrically motivated white-box attack that seeks minimal-distance adversarial examples for l_p norms with p ∈{1, 2, ∞}.
Results
FAB outperforms state-of-the-art attacks on average with limited computation, works across l_p norms, and is effective against gradient masking.
Takeaways & Limitations
A single FAB run can provide robust accuracy across perturbation thresholds, while its scaling invariance and lack of a step-size parameter support reliable robustness assessment.
Takeaways & Limitations
Gradient masking can make PGD ineffective, while FAB’s standard formulation can become inefficient on datasets with many classes because Jacobian computation and memory scale with the class count.
Abstract
from arXiv · showhide
The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the $l_p$-norms for $p \in \{1,2,\infty\}$ aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one $l_p$-norm, and is robust to the phenomenon of gradient masking.
1. Introduction
Adversarial examples expose vulnerabilities in neural-network classifiers, motivating empirical attacks that approximate minimal perturbations to assess robustness. The paper introduces a white-box attack designed to work broadly across conditions while reducing tuning demands.
- Adversarial examples are small input perturbations that can change a neural-network classifier’s decision, raising concerns about safe and reliable real-world use.
- Existing defenses have had limited success as increasingly powerful attacks continue to emerge.
- Robustness evaluation approximates the minimal adversarial perturbation problem using black-box or white-box attacks under specified norms.
- The proposed white-box attack targets minimal-distance adversarial samples for l_p norms with p ∈{1, 2, ∞}.
2. FAB: a Fast Adaptive Boundary Attack
FAB-attack constructs minimally distorted adversarial examples by projecting iterates onto locally approximated decision boundaries under box constraints, biasing steps toward the original input, and extrapolating across the boundary. Its projection is efficiently solvable for l1, l2, and l∞ norms, while its scale invariance avoids a gradient-masking failure mode associated with cross-entropy-based attacks.
- Projection: For p ∈ {1, 2, ∞}, box-constrained hyperplane projection is solvable in O(d log d) time, including detection of infeasibility.The stated complexity corresponds to sorting a vector of d elements.
- FAB-attack: FAB-attack linearizes the classifier locally, projects the current input onto an approximated decision hyperplane under box constraints, and iteratively generates adversarial examples.The method uses first-order Taylor approximations of class boundaries and selects the closest relevant hyperplane.
- FAB-attack: The attack biases the projected step toward xorig using a convex combination whose weight depends on the relative distances of the current iterate and xorig to the approximated boundary.The bias is capped by αmax, keeping the iterate near xorig when the local approximation is most reliable.
- FAB-attack: The Figure 1 scheme keeps FAB-attack’s iterate closer to xorig than the corresponding unbiased projection step, for both η = 1 and η > 1.The figure distinguishes the unbiased projection, the introduced bias, and the actual FAB iterate by blue, green, and red, respectively.
- FAB-attack: FAB-attack adds extrapolation to cross the decision boundary faster, then moves misclassified iterates back toward xorig to obtain progressively smaller-norm adversarial perturbations.The backward step uses a fixed β = 0.9 in the experiments.
- Scale invariance: FAB-attack is invariant to positive classifier rescaling and logit shifts, unlike cross-entropy gradients, and therefore avoids the described scaling-induced gradient-masking failure.The paper states that PGD can fail under incorrect scaling while FAB-attack remains unaffected.
3. Experiments
Experiments across MNIST, CIFAR-10, and Restricted ImageNet compare FAB with state-of-the-art attacks under l1, l2, and l∞ norms. FAB generally achieves strong or best robustness evaluations, produces small perturbations, resists gradient masking, and can be computationally efficient.
- Experimental setup: Experiments cover normally trained and adversarially trained models on MNIST, CIFAR-10, and Restricted ImageNet under l1, l2, and l∞ attacks.For each dataset, the study considers plain, l∞-adversarially trained, and l2-adversarially trained models.
- Evaluation metrics: Robust accuracy is evaluated at five thresholds, with lower robust accuracy indicating a more effective attack.The reported statistics include average robust accuracy, number of best results, and average and maximum differences from the best attack.
- Main results: FAB achieves the best results in all reported statistics for every norm except maximum difference to best on aggregated MNIST and CIFAR-10.FAB also outperforms algorithms specialized to individual norms, while FAB-10 achieves results better than or close to stronger competing configurations.
- Main results: On Restricted ImageNet, FAB is best for l1, while PGD is better on average for l2 and l∞ with a small average robust-accuracy difference.FAB's average and maximum differences to the best attack remain small across datasets and norms.
- Perturbation quality: FAB outperforms or matches competitors in 16 out of 18 comparisons of average adversarial-perturbation norms.This result concerns the average l_p norms of generated adversarial perturbations.
- Robustness and efficiency: FAB remains effective under gradient masking and classifier rescaling, whereas PGD can fail sharply because of scaling and step-size sensitivity.On a rescaled classifier, PGD robust accuracy falls below 13% or to 2.5% with a better step size, while FAB reaches 0.3% without parameter tuning or rescaling.
- Robustness and efficiency: FAB-10 is the fastest attack among methods excluding the substantially worse DF and SF attacks, while FAB can reach good results in only a few iterations.Runtime comparisons use a single attack run for FAB to evaluate all five thresholds, unlike PGD's threshold-specific evaluation.
- Additional results: Across more than 50 defended classifiers in later evaluations, fixed-hyperparameter FAB yields the best results in most CIFAR-10, CIFAR-100, and ImageNet cases for l2 and l∞.These comparisons include several PGD variants with different momentum terms, step sizes, and losses.
4. FAB-attack with a large number of classes
To handle classifiers with many classes, FAB uses a targeted variant that compares the original class with selected target classes, reducing computation while retaining strong robust-accuracy performance.
- The standard FAB attack becomes computationally expensive because each iteration computes a K × d Jacobian, especially when the number of classes is large.For ImageNet, K = 1000 makes the normal formulation potentially inefficient.
- The targeted variant projects onto the linearized boundary between the original class and a fixed target class at each iteration.The final adversarial example need only be misclassified, not assigned to the selected target class.
- Only the gradient of the target-versus-original logit difference is required, making computational cost independent of the total number of classes.The target is usually the second-most-likely class, with additional high-scoring classes available when restarts are allowed.
- On CIFAR-10, CIFAR-100, and ImageNet, top-10 targeted FAB almost always achieves better robust accuracy than normal FAB, whereas normal FAB is almost always better on MNIST.
5. Conclusion
FAB-attack is presented as a geometrically motivated attack that performs strongly across l_p norms with limited computation and resists gradient masking through scaling invariance and the absence of a step-size parameter.
- FAB-attack outperforms state-of-the-art attacks in average quality with limited computational effort and supports l_p norms for p ∈ {1, 2, ∞}.
- Its scaling invariance and step-size-free design make FAB resistant to gradient masking and more reliable than standard PGD for robustness assessment.
A. Scale invariance of FAB-attack
FAB-attack produces the same output when classifier logits are positively rescaled or uniformly shifted, because its geometric construction is unchanged by either transformation.
- Proposition 2.1 states that Algorithm 1 returns the same output for f, αf with α > 0, and f + β with β ∈ R.
- Rescaling and shifting leave the defining decision hyperplanes and distances to those hyperplanes unchanged.
- The remaining geometric steps and final search iterates therefore remain invariant under classifier rescaling and shifting.
B. Experiments
The experiments evaluate attacks across MNIST, CIFAR-10, and Restricted ImageNet using specified model architectures, iteration budgets, and attack-specific parameter settings.
- The evaluated models include convolutional architectures for MNIST and CIFAR-10 and ResNet-50 models for Restricted ImageNet.
- CW and EAD are configured to produce minimally distorted examples using 40 binary-search steps and 10000 iterations for CW, and 1000 iterations for EAD.
- DAA uses 200 iterations on MNIST and 50 on other datasets, with step sizes of ϵ/30 and ϵ/10 respectively.
- PGD uses 150 iterations, or 450 for l1 on Restricted ImageNet, with step sizes selected by grid search over ϵ/t.
- FAB uses 100 iterations, or 300 for l1 on Restricted ImageNet, with dataset-specific values for αmax, η, and β.
B.3. Complete results
Across 135 evaluations spanning three datasets, three models per dataset, five thresholds, and three norms, FAB retains the best aggregate statistics when problematic PGD cases are excluded.
- 135 evaluations cover 3 datasets, 3 models per dataset, 5 thresholds per model, and l∞, l2, and l1 robust accuracy.The complete results are reported across Tables 7–15.
- FAB has the better aggregate statistics after excluding the l∞-AT model cases where PGD fails completely for l1- and l2-attacks.
B.4. Further results
Further results show that FAB usually finds smaller successful perturbations and leads aggregated performance comparisons across MNIST and CIFAR-10, with results organized by norm, model, and dataset.
- FAB finds the smallest average perturbation for every model under l∞ and l2, and in 4 of 6 cases under l1.Lower average lp-norm means a stronger attack.
- Random-restart experiments use sampling radii specified in Table 4 for FAB-attack.
- Table 5 aggregates robust accuracy across 30 model-threshold cases for each norm on MNIST and CIFAR-10.It reports average robust accuracy, number of best results, and average and maximum differences to the best attack.
- The appendix reports comparisons for naturally trained, l∞-robust, and l2-robust models on MNIST, CIFAR-10, and Restricted ImageNet.
C. Analysis of the attacks
FAB often achieves good attack results within a few iterations and is frequently faster than PGD, although some cases benefit substantially from more iterations.
- FAB often achieves good results within a few iterations, frequently faster than PGD.
- Some cases obtain significantly better robust accuracy when FAB uses a higher number of iterations.
C.1. Choice of the step size of PGD
The PGD step-size analysis compares robust accuracy over iterations across norms and datasets, highlighting the selected step sizes against alternatives. The chosen values are generally among the strongest performers in these comparisons.
- The experiments report robust accuracy as a function of iterations, using six step sizes and the best of 10 randomly initialized runs.The evaluation uses 150 total iterations and focuses on large ϵ.
- l2: For l2 attacks, the selected step size ϵ/4 achieves the best or nearly best robust accuracy across all evaluated models.The comparison covers three models on each of MNIST and CIFAR-10.
- l∞: For l∞ attacks, the selected step size ϵ/10 performs best on average across the evaluated models.
- l1: For l1 attacks, the selected step size ϵ/2 performs best on average across the evaluated models.
C.2. Evolution across iteration
The section examines how robust accuracy evolves with PGD and FAB under different iteration, pass-count, step-size, dataset, model, and threat-model settings. It rescales results by network passes to compare PGD-1 and FAB-1 fairly.
- Fair comparison: PGD and FAB are compared using the same number of network forward/backward passes rather than raw iterations.PGD uses one forward and one backward pass per iteration, whereas FAB uses two forward and one backward pass.
- Fair comparison: The pass-count rescaling maps 300 network passes to 150 PGD iterations and 100 FAB iterations.This conversion follows the methods’ respective forward/backward-pass costs.
- PGD step sizes: Figures 4–6 show robust-accuracy evolution across PGD iterations for different step sizes under l∞, l2, and l1 threat models.The plots use models trained on MNIST and CIFAR-10, with the experimental step size marked in red.
- PGD versus FAB: Figures 7–9 compare PGD-1 and FAB-1 across network passes on MNIST, CIFAR-10, and Restricted ImageNet.Each figure varies model training, threat model, and the thresholds ϵ shown above the plots.