Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses

1 Introduction

• Attack strength matters both for evaluating defenses and for generating adversarial samples used in training.Source: §1 · pp. 1–2
• Maximizing standard losses within a threat constraint may fail to find a path toward the class with the nearest decision boundary.Source: §1 · p. 2
• GAMA uses non-maximal-class probabilities and a gradually reduced initial ℓ2 relaxation to guide attacks; gains are significant for single-step but marginal for multi-step training.Source: §1 · p. 2
• GAMA achieves state-of-the-art performance across multiple defenses, while GAT achieves state-of-the-art results among single-step defenses.Source: §1 · p. 2

2 Preliminaries

• The setup concerns image classification under ℓ∞-bounded perturbations, with an adversary assumed to know the defense and model.Source: §2 · p. 2

3.1 Adversarial Attacks

• FGSM uses a single gradient step, I-FGSM iterates with projection, and PGD adds random initialization; C&W uses maximum-margin loss for stronger attacks.Source: §3.1 · p. 3
• FAB favors minimally distorted perturbations, Multi-Targeted cycles over target classes, and AutoAttack ensembles several attacks but requires diverse attack components.Source: §3.1 · p. 3

3.2 Defenses Against Adversarial Attacks

• Multi-step methods such as PGD-Training and TRADES use strong iterative adversaries but are computationally intensive; ATF reuses gradients to update both adversary and model.Source: §3.2 · p. 3
• Unlike R-MGM’s logit-difference regularizer, the proposed defense minimizes squared ℓ2 distance between clean and adversarial softmax outputs and uses guided attacks during training.Source: §3.2 · pp. 3–4
• The authors report that their single-step defense is significantly more robust than FBF, and note that FBF’s acceleration techniques can also be used with their method.Source: §3.2 · p. 4

4.1 Impact of Initial Optimization Trajectory on Attack Efficacy

• Function mapping of clean samples guides the initial attack direction, aiming for stronger attacks with reliable results in a single or few restarts.The approach seeks an effect similar to multi-targeted attacks without separately minimizing loss for each target class, improving scalability to datasets with more classes.Source: §4.1 · p. 4

4.2 Guided Adversarial Margin Attack

• GAMA adds a squared ℓ2 distance between clean and perturbed softmax outputs to the probability-space maximum-margin loss, then decays its weight to zero.The relaxation term smooths the loss surface; its gradients weight class-confidence directions according to their deviation from clean-image confidence, an effect described as similar to momentum.Source: §4.2 · p. 5
• GAMA-PGD uses projected gradient descent, while GAMA-FW uses Frank–Wolfe optimization and is particularly useful when adversarial training imposes a small iteration budget.The attack starts from Bernoulli noise of magnitude ε, and λ is linearly reduced to zero over τ steps.Source: §4.2 · p. 6

4.3 Guided Adversarial Training

• GAT generates single-step adversaries from Bernoulli-initialized inputs, uses cross-entropy for both attack generation and training, and sets λ to zero in alternate attack iterations.The generated perturbation is projected onto the ε-ball, and both adversarial and clean samples are used for training.Source: §4.3 · p. 7
• GAT achieves state-of-the-art robustness among single-step training methods by combining function smoothing with stronger adversaries generated using GAMA.The training regime minimizes loss on adversarial samples while explicitly enforcing function smoothing near each data sample.Source: §4.3 · p. 7

5.1 Evaluation of the proposed attack (GAMA)

• Across CIFAR-10, ImageNet, and MNIST, GAMA-PGD and GAMA-FW remain strongest and are less sensitive to random initialization; GAMA-MT leads on ImageNet and is marginally better on CIFAR-10 and MNIST.Figure 3 reports accuracy against multiple random restarts; the evaluations use an ℓ∞ constraint radius of 8/255 for CIFAR-10 and ImageNet and 0.3 for MNIST.Source: §5 · p. 7, Figure 3 · p. 8, §5.1 · p. 8
• GAMA-PGD and GAMA-FW consistently outperform all other untargeted attacks across all defenses; FAB is the runner-up, but requires approximately 6 times their computation time.Source: §5.1 · p. 8
• GAMA-MT, targeting the top five classes other than the correct class, is consistently the most effective attack across defenses.Source: §5.1 · p. 8
• On TRADES leaderboard models, GAMA-MT reaches 53.01% accuracy on CIFAR-10 with 100 steps and 20 restarts, while GAMA reaches 92.57% on MNIST with 100 steps and 1000 restarts.Source: §5.1 · p. 8
• Ablations find maximum-margin loss more effective than cross-entropy, probability-score margins stronger than logit margins, and graduated optimization and initial Bernoulli noise helpful for 100-step attacks.GAMA-FW achieves the strongest attack when the available number of steps is relatively small.Source: §5.1 · p. 8

5.2 Evaluation of the proposed defense (GAT)

• GAT outperforms FBF on ResNet-18 and WideResNet-34-10; increasing model capacity with GAT yields a 2.97% increase in worst-case robust accuracy and a 4.68% increase in clean accuracy.Source: Table 2 · p. 9, §5.2 · p. 9
• Using GAMA-FW adversaries in TRADES produces marginal accuracy improvement, which improves further when those samples replace standard adversaries in alternate iterations.The authors report that guided-attack adversaries improve robustness more in single-step than multi-step training, where data availability is the stated bottleneck.Source: §5.2 · p. 9

• GAMA uses clean-sample function mappings and a gradually reduced ℓ2 relaxation term to guide adversarial generation and improve optimization.Source: §6 · p. 9
• Frank-Wolfe optimization produces significantly stronger 10-step attacks, and GAMA-FW adversaries improve on TRADES training.Source: §6 · p. 9
• GAT uses the ℓ2 relaxation term in both attack generation and adversarial training, improving robustness over existing single-step methods.Source: §6 · p. 9

• GAMA is presented as a way to reliably bound worst-case performance with a relatively small computational budget.Source: §7 · p. 10
• GAT is presented as producing adversarially robust models using relatively inexpensive single-step adversaries.Source: §7 · p. 10
• GAMA is a white-box attack, applicable only when an adversary knows the entire network architecture and parameters, which the authors say are often confidential.Source: §7 · p. 10

S1 Improved local properties induced by Guided Adversarial Training (GAT)

• The analysis treats the network’s softmax output over the data manifold and seeks local Lipschitz continuity within the ℓ∞ neighborhood of radius ε around each sample.Source: S1 Improved local properties induced… · p. 13
• Under the stated strong assumption of a sufficiently small local Lipschitz constant, predictions are constant within the ε-constraint, guaranteeing adversarial robustness there.Source: S1 Improved local properties induced… · p. 13
• The squared output-distance term is GAT’s regularizer; its weight λ controls its effective learning rate and the extent of function smoothness, trading off clean accuracy and robustness.The combined training loss also includes cross-entropy; without it, the authors note that degenerate constant networks are possible.Source: S1 Improved local properties induced… · p. 13
• GAT’s algorithm perturbs each training image with bounded noise and a gradient-sign step, then minimizes cross-entropy plus the weighted squared output-distance term.The update is applied across minibatches and epochs.Source: S1 Improved local properties induced… · p. 14

• Experiments cover MNIST, CIFAR-10, and ImageNet.The ImageNet experiments use a random 100-class subset.Source: S2 Details on the datasets used · p. 14
• MNIST has 60,000 training images and 10,000 test images; 50,000 training images are used for training and 10,000 for validation.Images are grayscale and 28×28.Source: S2 Details on the datasets used · p. 14
• CIFAR-10 has 50,000 original training images and 10,000 test images; 49,000 images are used for training and 1,000 for validation.The validation split is balanced across the ten classes; images are 32 × 32 × 3.Source: S2 Details on the datasets used · p. 14
• ImageNet has approximately 1.2 million training images and 50,000 validation images; the designated validation set serves as the test set.The training set is split 80/20 for training and validation, and the selected 100 classes are shared with the code.Source: S2 Details on the datasets used · p. 14
• Training and evaluation use NVIDIA DGX workstations with V100 GPUs.On CIFAR-10 ResNet-18, single-step GAT training takes approximately 2 hours and a 100-step GAMA-PGD evaluation run approximately 5 minutes.Source: S2 Details on the datasets used · p. 14

S3.1 Architecture details

• For MNIST, robust models use a modified LeNet; CIFAR-10 and ImageNet-100 use ResNet-18, with WideResNet-34-10 also evaluated on CIFAR-10.The BB-MNIST network is the source model for MNIST black-box attacks.Source: S3.1 Architecture details · p. 14, Table S1 · p. 15

S3.2 Details on the training algorithm

• GAT adds Bernoulli noise, generates a guided cross-entropy attack, then projects the perturbation onto the clean image’s ε-ball.Unlike standard R-FGSM training, the guided formulation can generate an adversary outside that ball before projection; λ weights the squared ℓ2 term and is stepped up as training progresses.Source: S3.2 Details on the training algorithm · p. 15
• GAT’s step-up factor prevents adversarial loss from rising rapidly; clean and adversarial losses decline over epochs, and FGSM-sample loss is close to PGD-sample loss.The authors report this pattern for GAT and describe the step-up factor as an effective learning-rate increase for the squared ℓ2 term.Source: S3.2 Details on the training algorithm · p. 15

S3.3 Implementation details

• On CIFAR-10, GAT uses initial λ/step-up settings of 10/4 for ResNet-18 and 3/20 for WideResNet-34-10; ImageNet-100 uses λ=20 stepped up by 7 at epoch 90.For CIFAR-10, clean and GAMA-PGD accuracy are stable across hyperparameter variations; increasing λ initially trades clean accuracy for robustness, with robustness leveling off or falling beyond λ=10.Source: S3.3 Implementation details · pp. 15–16
• MNIST GAT uses λ=15 and a step-up factor of 3 at all three learning-rate updates; training lasts 50 epochs on MNIST, 100 on CIFAR-10, and 120 on ImageNet-100.The CIFAR-10 and ImageNet-100 settings and schedules vary by architecture and dataset.Source: S3.3 Implementation details · p. 16
• TR-GAT alternates 10-step KL-divergence PGD and 10-step GAMA-FW attacks, using TRADES KL weight β values of 5 for ResNet-18 and 6 for WideResNet on CIFAR-10.It uses the corresponding TRADES model’s learning-rate schedule and total epochs.Source: S3.3 Implementation details · p. 16

• GAMA maximizes maximum-margin loss plus a weighted squared ℓ2 distance between clean and perturbed softmax vectors; λ decays to zero over iterations.For the reported setup, λ starts at 50 and decays to zero over 25 iterations, while attack strength is reported stable across a wide range of λ values.Source: S4 Implementation details of the… · p. 16
• For 100-step GAMA-PGD, the initial step size is 2 · ε and is reduced tenfold at iterations 60 and 85; GAMA-FW starts with γ=0.5 and reduces it fivefold at those iterations.The attack also begins with Bernoulli noise of magnitude ε.Source: S4 Implementation details of the… · pp. 16–17
• Table S2 covers CIFAR-10 attack-accuracy ablations on TRADES-WRN34 under an ℓ∞ bound of ε = 0.031, across step and restart settings.The caption identifies the table’s scope but does not provide individual cell values.Source: Table S2 · p. 17
• For the TRADES leaderboard WideResNet-34 CIFAR-10 model, the multi-targeted attack uses 100 steps and 20 random restarts, alternating GAMA and class-specific margin losses across restarts.For this evaluation the attack is multi-targeted.Source: S4 Implementation details of the… · p. 17
• For MNIST, λ starts at 5 and decays to zero over 50 iterations; PGD step size and FW γ are reduced at iterations 50 and 75.The initial PGD step size is ε, while FW γ starts at 0.5; the text notes different settings are needed for MNIST’s complex adversarially trained loss surface.Source: S4 Implementation details of the… · p. 17

S5 Details on Evaluation of the proposed attack

• Attack evaluations use pretrained defense models supplied by their authors, so architectures are not consistent across the defenses in Table 1.Source: S5 Details on Evaluation of the… · p. 17

S5.1 Ablation Experiments

• Maximum-margin loss outperforms cross-entropy in the reported 10- and 100-step ablations, and probability-score margins outperform corresponding logit margins.The 100-step ablations find stronger adversaries with graduated optimization and initial Bernoulli noise; GAMA-FW is strongest under a relatively small step budget.Source: S5.1 Ablation Experiments · p. 17

S5.2 Variation of Accuracy and Cross-Entropy loss across attack iterations

• GAMA achieves lower accuracy and higher cross-entropy loss than maximum-margin-only attacks during optimization on TRADES ResNet-18 CIFAR-10.The authors report that decaying the relaxation term over the first 25 iterations helps cross-entropy loss rise; switching to the primary maximum-margin objective is important for stronger attacks.Source: S5.2 Variation of Accuracy and… · p. 17, Figure S3 · p. 18

S5.3 Use of ADAM optimizer in the GAMA attack

• With ADAM and true gradients, the strongest searched 100-step attack leaves 53.66% accuracy on TRADES WideResNet-34, versus 53.29% for original GAMA-PGD.The authors characterize the ADAM attack as marginally weaker.Source: S5.3 Use of ADAM optimizer in the GAMA… · p. 18

S6.1 Ablation Experiments

• GAT's robustness depends on using the modified loss in both attack generation and training; either component alone is insufficient for the reported state-of-the-art results.R-FGSM training improves on training with GA-CE adversaries and clean-plus-adversarial cross-entropy, but remains significantly weaker than GAT.Source: S6.1 Ablation Experiments · p. 19

S6.2 Stability of Guided Adversarial Training

• Across six CIFAR-10 reruns, GAT's PGD-100 accuracy ranged from 51.7% to 52.35% (standard deviation 0.224), and the models did not show catastrophic overfitting.The final training epoch also retained high adversarial accuracy against strong multi-step attacks.Source: S6.2 Stability of Guided Adversarial… · p. 19

S6.3 Loss Surface Plots

• GAT has a smooth loss surface under both cross-entropy and GAMA losses, while GAMA's surface is smoother than cross-entropy's across the evaluated models.FGSM training instead produces significant gradient masking and a convoluted cross-entropy loss surface.Source: S6.3 Loss Surface Plots · pp. 19–20, Figure S4 · p. 19

S6.4 Performance against White-Box attacks

• On ImageNet-100 and MNIST, GAT improves robustness over existing single-step defenses and achieves robustness comparable to TRADES and PGD-AT.The cited tables report white-box attack results; GAT is also stronger than other defenses on the GAMA-PGD 100-step attack.Source: S6.4 Performance against White-Box… · p. 20, Table S4 · p. 20, Table S5 · p. 20
• For ℓ2 robustness, GAT's performance against C&W is comparable to other ℓ∞ adversarial-training methods, and C&W is stronger than DDN on CIFAR-10.The mean ℓ2 perturbation is 0.805 for DDN versus 0.762 for C&W.Source: S6.4 Performance against White-Box… · pp. 20–21, Table S4 · p. 20

S6.5 Performance against Black-Box and gradient-free attacks

• Across three datasets, black-box accuracy closely tracks clean accuracy and exceeds white-box accuracy; Square results also support GAT's robustness against query-based attacks.GAT improves on existing single-step defenses on MNIST and CIFAR-10; on ImageNet-100, R-FGSM has better Square accuracy but is more susceptible to white-box attacks.Source: Table S7 · p. 21, S6.5 Performance against Black-Box and… · p. 22, Table S9 · p. 22

S6.6 Performance Against Adaptive Adversaries

• For adaptive attacks, margin-based attacks are stronger than cross-entropy-based attacks, and the adaptive attacks are stronger than standard PGD but weaker than AutoAttack.The authors note that comparing one attack with an ensemble is not fair; GAT's robustness does not deteriorate further relative to AutoAttack.Source: Table S10 · p. 22, S6.6 Performance Against Adaptive… · p. 23

S6.7 Sanity checks to ensure absence of gradient masking

• Increasing ε drives unbounded attacks to 100% success across datasets, while FGSM loss rises monotonically, supporting the conclusion that GAT's robustness is not gradient masking.The supplementary evaluation also reports that iterative attacks are stronger than single-step attacks and white-box attacks stronger than black-box attacks.Source: S6.7 Sanity checks to ensure absence… · p. 23, Figure S5 · p. 23, Figure S6 · p. 23