PaperlayerView exact revision on arXiv

Source-linked AI summary

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco Croce, Matthias Hein

arXiv:2003.01690v2cs.LGcs.CVstat.ML

TL;DR

Adversarial-defense evaluation can overestimate robustness because attack settings and attack diversity are inadequate, making it difficult to distinguish effective defenses. The paper develops parameter-free PGD extensions and combines them with complementary attacks into AutoAttack, then evaluates over 50 models and finds lower robust accuracy than previously reported in nearly all cases. The study also identifies several broken defenses, while noting that its evaluation is not exhaustive.

  • Problem

    Defense evaluations can give a wrong impression of robustness because attacks may be improperly tuned or insufficiently diverse, making reliable comparison difficult.

  • Method

    The paper proposes two PGD extensions and combines them with FAB and Square Attack into a parameter-free, computationally affordable, user-independent ensemble called AutoAttack.

  • Results

    AutoAttack evaluated over 50 classifiers from 35 papers and obtained lower robust test accuracy than reported in all but two cases, reducing robust accuracy by more than 10% for 13 models.

  • Takeaways & Limitations

    The evaluation identifies several broken defenses and supports using AutoAttack as a minimal test for new defenses without hyperparameter tuning.

  • Takeaways & Limitations

    The evaluation is not exhaustive because some authors did not provide models or code, and AutoAttack retains the iteration budget as its free variable.

Abstract

from arXiv · show

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness. Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art. Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking. In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function. We then combine our novel attacks with two complementary existing ones to form a parameter-free, computationally affordable and user-independent ensemble of attacks to test adversarial robustness. We apply our ensemble to over 50 models from papers published at recent top machine learning and computer vision venues. In all except one of the cases we achieve lower robust test accuracy than reported in these papers, often by more than $10\%$, identifying several broken defenses.

1. Introduction

Evaluating adversarial defenses remains difficult because attacks and protocols can overestimate robustness. The paper proposes an autonomous ensemble that improves evaluation and exposes weaknesses in many recent defenses.

  • Motivation: Many proposed defenses can be broken by more powerful or adapted attacks, making independent evaluation necessary.The field lacks a reliable protocol that works autonomously without fine-tuning parameters for each new defense.
  • Motivation: PGD can fail because its fixed step size and commonly used cross-entropy loss may produce significant robustness overestimation.The paper addresses these issues with a step-size-free attack scheme and an alternative loss function.
  • Proposed protocol: AutoAttack combines two new PGD variants with the complementary FAB and Square Attack methods.The resulting ensemble is parameter-free, computationally affordable, and user-independent.
  • Evaluation: AutoAttack was evaluated on over 50 classifiers from 35 papers, including randomized defenses, from recent leading conferences.The evaluation was designed to independently assess reported robust accuracy across recent robust models.
  • Evaluation: For 13 models, AutoAttack reduced robust accuracy by more than 10% and identified several broken defenses.In all except two cases, its robust test accuracy was lower than reported in the original papers.
  • Implication: The authors recommend AutoAttack as a minimal test for new defenses because it performs reliably without hyperparameter tuning at relatively low computational cost.They do not claim it is the ultimate adversarial attack.

2. Adversarial examples and PGD

The paper formulates adversarial examples through constrained optimization and describes PGD as a projected iterative attack. Its standard formulation uses a loss, a step size, and projection onto the feasible threat-model set.

  • Adversarial examples: A classifier maps inputs to K classes and makes decisions according to the class with the maximum output.The classifier is denoted g and operates on a domain D contained in R^d.
  • Adversarial examples: An adversarial sample changes the classifier’s decision while remaining within distance ϵ of the original input and inside the domain D.The threat model is the feasible set defined by the distance constraint d(xorig, z) ≤ ϵ.
  • Optimization formulation: Finding an adversarial sample is expressed as a constrained optimization problem using a surrogate function L that enforces assignment away from the correct class.For image classification, common threat models use lp distances and inputs in [0, 1]^d.
  • PGD: PGD iteratively updates the input by taking a gradient-based step and projecting it onto the feasible set S.The update is repeated for k = 1, . . . , Niter, with η(k) as the step size and PS as the projection operator.
  • PGD: The standard PGD attack uses the cross-entropy loss as its objective and requires inputs such as the model, feasible set, initialization, step size, and iteration budget.Its implementation tracks the best objective value among iterates.
  • PGD: In the usual formulation, the step size is fixed across iterations, and initialization may be the original input or a randomly perturbed feasible point.The descent direction follows the threat-model norm, such as the gradient sign for l∞.

3. Auto-PGD: A budget-aware step size-free variant of PGD

Auto-PGD adapts its step size to the optimization budget and progress, alternating broad exploration with local exploitation. Compared with fixed-step PGD with momentum, it achieves stronger attack objectives and robust-accuracy outcomes across tested models.

  • Motivation and design: APGD addresses PGD's fixed-step-size weakness by adapting the step size to the available iteration budget and optimization progress.The standard fixed step size is highly influential and can be suboptimal; APGD instead governs reductions using objective trends and checkpoints.
  • Exploration and exploitation: APGD transitions from exploration to exploitation by progressively reducing the step size, with longer initial exploration and more frequent later updates.Large steps move quickly through the feasible set, while smaller steps support more localized objective maximization.
  • Algorithm settings: APGD uses momentum with α = 0.75, starts from η(0) = 2ϵ, and fixes its internal parameters so the iteration budget Niter is the only free variable.Checkpoints determine when the algorithm evaluates whether to halve the current step size.
  • Step-size selection: At checkpoints, APGD halves the step size when progress is insufficient and restarts from the best point found so far.One condition tracks the fraction of successful updates, while another detects no improvement after the previous reduction; restarting localizes the subsequent search around the best candidate.
  • Comparison with PGD: Across MNIST and CIFAR-10 l∞ tests, APGD attained the highest cross-entropy loss and lowest robust accuracy for every tested iteration budget.The comparison used 1000 PGD-with-momentum iterations across seven fixed step sizes and APGD budgets from 25 to 1000 iterations.
  • Comparison with PGD: PGD with momentum tended to plateau at suboptimal cross-entropy values, whereas APGD increased more slowly but reached higher final values.The slower initial increase reflects APGD's longer exploration phase when larger budgets are available.

4. An alternative loss

The paper addresses failures of cross-entropy-based PGD caused by gradient vanishing and logit rescaling, proposing the shift- and rescaling-invariant DLR loss alongside APGD. Experiments show APGD and DLR generally improve robustness evaluation across norms and models.

  • Cross-entropy failure: Gradient vanishing can make cross-entropy PGD ineffective when correctly classified inputs have near-certain predicted labels.Rescaling logits can induce this failure even when the classifier’s decisions remain unchanged.
  • Cross-entropy failure: Logit rescaling changes cross-entropy gradients, so PGD’s measured robust accuracy depends on the classifier’s logit scale.The CIFAR-10 experiment varies the rescaling factor and reports corresponding changes in zero-gradient frequency and PGD robustness.
  • DLR loss: The Difference of Logits Ratio loss is shift- and rescaling-invariant, aligning its degrees of freedom with the classifier’s decision function.Its normalization also encourages the score of the correct class to approach that of the strongest alternative class.
  • APGD evaluation: APGD outperforms the best tested PGD variant on 32/43 models with CE, 37/43 with CW, and 35/43 with DLR.These comparisons use the same attack budget across deterministic models and multiple step sizes for PGD.
  • APGD evaluation: Across models, DLR improves on CE and is more stable than CW, while APGD most often achieves the best results for l2 robustness as well.For l∞ models, CW is up to 21% worse than DLR but never more than 5% better; loss differences are marginal for l2 models.

5. AutoAttack: an ensemble of parameter-free attacks

AutoAttack combines parameter-free PGD extensions with complementary white-box and black-box attacks to provide an automatic robustness evaluation protocol. Its fixed, diverse components are designed to remain effective across models, datasets, norms, and attack failure modes.

  • Ensemble design: AutoAttack combines APGDCE, APGDDLR, FAB, and Square Attack into an ensemble requiring no free parameters.The ensemble combines two parameter-free PGD variants with two existing complementary attacks.
  • Ensemble design: The selected protocol uses APGDCE, targeted APGDDLR and FABT with nine target classes, and one 5000-query Square Attack run.Each white-box attack uses 100 iterations, and APGDCE runs without random restarts.
  • Attack diversity: APGD searches for any adversarial example, FAB minimizes the perturbation needed for misclassification, and Square Attack performs gradient-free score-based random search.These components cover distinct attack mechanisms, including effectiveness against some gradient-masked models.
  • Attack diversity: Attack diversity helps because some classifiers defeat individual attacks, while different attacks can succeed on different points of the same model.AutoAttack therefore uses the worst-case result across its component attacks.
  • Evaluation protocol: The ensemble keeps hyperparameters fixed across datasets, models, and norms while aiming for reliable, cost-efficient, fully automatic evaluation.Its computational budget is described as similar to the average budget used in the evaluated defenses.
  • Targeted attacks: Targeted APGDDLR and FAB variants generally outperform their untargeted counterparts on CIFAR-10, CIFAR-100, and ImageNet.Targeted attacks achieve lower robust accuracy in 35/36 APGDDLR comparisons and 29/32 FAB comparisons, though MNIST shows the opposite pattern.

6. Experiments

The experiments evaluate AutoAttack across more than 50 robust classifiers and find that it usually reports lower robust accuracy than the original papers, including for randomized defenses. The results also show complementary attack strengths and identify current robustness patterns and broken defenses.

  • Experimental setup: AutoAttack evaluates more than 50 classifiers from 35 recent defense papers across MNIST, CIFAR-10, CIFAR-100, and ImageNet.The evaluation covers l∞- and l2-threat models and includes deterministic and randomized defenses.
  • Experimental setup: Good performance generalizes across datasets, models, and threat models with the same hyperparameters.
  • Deterministic defenses: All but one AutoAttack evaluation lowered reported robust accuracy, with reductions exceeding 10% for 13 of 49 models and 30% for 8.The sole exception was only 0.03% from the reported accuracy and required 180 restarts and 200 iterations.
  • Attack complementarity: APGDTDLR improved reported evaluations in 45/49 cases, while APGDCE, FABT, and Square Attack did so in 21/49, 39/49, and 17/49 cases, respectively.APGDTDLR most often achieved the best result on CIFAR-10, CIFAR-100, and ImageNet, whereas Square Attack did so on MNIST.
  • Randomized defenses: AutoAttack always lowered robust accuracy for randomized defenses, with significant improvements exceeding 10% in 7 of 9 cases and 25% in 3.APGDCE was the best-performing attack, closely followed by APGDDLR.
  • Analysis of the state of the art: The evaluation indicates that adversarial-training variations using additional data are among the most robust defenses, while several claimed state-of-the-art defenses are substantially weaker.
  • Scope: The evaluation is not exhaustive because some authors did not provide models or code.

A. Auto-PGD

The appendix compares Auto-PGD with fixed-step PGD with momentum and reports that Auto-PGD adapts to the iteration budget and obtains better loss and robust accuracy.

  • Auto-PGD adapts automatically to the iteration budget and a suitable step size, unlike PGD with momentum using fixed step sizes.
  • Auto-PGD achieves larger loss and smaller robust test accuracy than PGD with momentum in the comparison.

A.1. Comparison of APGD to PGD

The comparison with PGD without momentum shows that fixed-step PGD can plateau quickly, whereas APGD continues improving and generally performs better.

  • PGD without momentum has significantly smaller loss and worse robust accuracy than APGD on MNIST.
  • Fixed-step PGD often plateaus quickly, while APGD continues improving as iterations increase.
  • APGD generally outperforms PGD in the comparison.

B. AutoAttack: implementation details

The implementation fixes parameter choices for APGD, FAB, and Square Attack across threat models and follows standard or original settings for the latter two attacks.

  • APGD: For APGD, the update uses the gradient sign for l∞ attacks and the normalized l2 gradient for l2 attacks.
  • APGD: APGD uses momentum coefficient α = 0.75, ρ = 0.75, and initial step size η(0) = 2ϵ.
  • FAB: FAB uses its standard hyperparameters according to the cited implementation.
  • Square Attack: Square Attack follows the original code with initial square size p = 0.8 and a piecewise constant schedule.The schedule is used for a 10000-query limit without rescaling, despite using up to 5000 queries.

C. Experiments

The experiments evaluate deterministic and randomized defenses, while documenting model sources and reported robustness values. Some reported values required extrapolation because only plots were available.

  • The evaluation covers deterministic and randomized defenses, with additional details on model sources and venues.The randomized-defense evaluation also reports mean and standard deviation because outcomes are nondeterministic.
  • The Pang et al. models are evaluated both with and without adversarial training.
  • For Grathwohl et al. models, reported values are extrapolated because the paper provides only robust-accuracy plots versus perturbation size.

C.1. Comparison PGD vs PGD with Momentum vs APGD on different losses

The comparison tests APGD against PGD variants across losses and step sizes. APGD generally achieves lower robust accuracy, while complementary attacks remain important when gradients are unreliable.

  • APGD is compared with PGD and momentum PGD using three step sizes, 100 iterations, and five restarts across CE, CW, and DLR losses.
  • APGD achieves the lowest robust accuracy in 36/49 CE-loss, 42/49 CW-loss, and 39/49 DLR-loss comparisons.
  • PGD performance varies substantially with step size and classifier, whereas APGD avoids selecting a fixed step size.
  • For some defenses, very large-step PGD performs better than APGD, but the same step size performs worse on most other models.
  • AutoAttack can outperform every PGD variant when gradient obfuscation affects optimization, because FAB is less affected by this behavior.

D.2. Difference-of-Logits Ratio (DLR) loss

The DLR loss is presented as a rescaling- and shift-invariant alternative to cross-entropy. Integrated into APGD, it performs best on average but can struggle against discontinuous classifiers.

  • DLR is rescaling- and shift-invariant, avoiding the cross-entropy loss issues described in the paper.
  • APGDDLR is the best-performing attack on average, with the lowest maximal difference to the best attack across tested models.
Loading 2003.01690v2…