Designing powerful adversarial attacks is of paramount importance for the evaluation of $\ell_p$-bounded adversarial defenses. Projected Gradient Descent (PGD) is one of the most effective and conceptually simple algorithms to generate such adversaries. The search space of PGD is dictated by the steepest ascent directions of an objective. Despite the plethora of objective function choices, there is no universally superior option and robustness overestimation may arise from ill-suited objective selection. Driven by this observation, we postulate that the combination of different objectives through a simple loss alternating scheme renders PGD more robust towards design choices. We experimentally verify this assertion on a synthetic-data example and by evaluating our proposed method across 25 different $\ell_{\infty}$-robust models and 3 datasets. The performance improvement is consistent, when compared to the single loss counterparts. In the CIFAR-10 dataset, our strongest adversarial attack outperforms all of the white-box components of AutoAttack (AA) ensemble, as well as the most powerful attacks existing on the literature, achieving state-of-the-art results in the computational budget of our study ($T=100$, no restarts).
翻译:设计强大的对抗性攻击对于评估 $\ ell_ p$ 绑定的对抗性攻击至关重要。 预测的渐变源( PGD) 是产生这种对手的最有效和概念上最简单的算法之一。 PGD的搜索空间是由一个目标的最陡峭的方向决定的。 尽管有众多的客观功能选择, 但没有普遍优越的选择, 强力估计可能来自不适当的客观选择。 受此观察的驱使, 我们假设, 通过简单的损失交替方案将不同的目标组合在一起, 使PGD 更强有力地选择设计选择。 我们实验性地核实了这个关于合成数据范例的论断, 并评估了我们拟议的方法, 超过 25 $\ ell\ incinfty} $- robust 模型和 3 数据集。 与单一的损失对应方相比, 业绩的改进是始终一致的。 在CFAR- 10 数据集中, 我们最强烈的对抗性攻击超越了 AutAtack (A) comble, 以及目前最强大的攻击在文献上最强大的攻击, 没有预算计算结果。