论文标题
交替的目标会产生更强大的基于PGD的对抗攻击
Alternating Objectives Generates Stronger PGD-Based Adversarial Attacks
论文作者
论文摘要
设计强大的对抗攻击对于评估$ \ ell_p $结合的对抗防御至关重要。预计的梯度下降（PGD）是产生此类对手的最有效和概念上最简单的算法之一。 PGD的搜索空间由目标的最陡峭上升方向决定。尽管有很多目标功能选择，但没有普遍的选择，稳健性高估可能是由于不适合的客观选择而产生的。在这一观察结果的推动下，我们假设通过简单的损失交替方案组合不同目标的组合使PGD更适合设计选择。我们在合成数据示例上实验验证了这一断言，并通过评估我们在25个不同的$ \ ell _ {\ infty} $的方法中我们提出的方法 - 强大的模型和3个数据集。与单个损失对应物相比，性能的提高是一致的。在CIFAR-10数据集中，我们最强烈的对抗性攻击优于AutoAttack（AA）合奏的所有白色盒子组件，以及文献上现有的最强大的攻击，实现了最新的攻击，从而实现了我们研究的计算预算（$ t = 100 $，无重新启动）。
Designing powerful adversarial attacks is of paramount importance for the evaluation of $\ell_p$-bounded adversarial defenses. Projected Gradient Descent (PGD) is one of the most effective and conceptually simple algorithms to generate such adversaries. The search space of PGD is dictated by the steepest ascent directions of an objective. Despite the plethora of objective function choices, there is no universally superior option and robustness overestimation may arise from ill-suited objective selection. Driven by this observation, we postulate that the combination of different objectives through a simple loss alternating scheme renders PGD more robust towards design choices. We experimentally verify this assertion on a synthetic-data example and by evaluating our proposed method across 25 different $\ell_{\infty}$-robust models and 3 datasets. The performance improvement is consistent, when compared to the single loss counterparts. In the CIFAR-10 dataset, our strongest adversarial attack outperforms all of the white-box components of AutoAttack (AA) ensemble, as well as the most powerful attacks existing on the literature, achieving state-of-the-art results in the computational budget of our study ($T=100$, no restarts).
