Question: What is the major contribution of your work?
Evidence: Adversarial attacks aim to find adversarial examples, which are close to benign inputs in certain distance metrics yet trigger wrong behavior of neural networks. Adversarial attacks are important tools to gauge the empirical robustness of deep neural networks. Finding an adversarial example can be generally formulated as a constrained optimization problem:
where C is often an ∞ or 2 norm ball around the original input x 0 , and f (x) is an attack success criterion involving a neural network (such as the margin between the groundtruth class and another class): f (x) < 0 indicates a successful attack. A straightforward way of solving Eq. () is via firstorder constrained optimization methods, such as projected gradient descent (PGD) and its variants. Additionally, some gradient-free attacks were proposed, mostly based on certain heuristic search on the input space x.
Limitations of existing attacks. As f (x) usually consists of a highly non-convex neural network, solving Eq. () to its global minimum is challenging. This leads to failures in adversarial attacks: an adversarial example may exist but no attacks can find it, giving a false sense of security. Especially, gradient based attacks can be easily trapped into a local minimum or misguided by masked gradients. Even if we give the attacker an infinite amount of time (e.g., run a very large number of PGD steps, or allowing a large number of samples on input space), it is still hard to guarantee to find the adversarial example, since it is extremely difficult to systematically search the high dimensional and continuous input space. Models concluded robust under existing attacks might still have security vulnerability in practice, leading to an urgent request for stronger attacks that can possibly approach ground-truth robustness.
The mixed-integer approach. This paper seeks stronger adversarial attacks from a different angle: instead of searching for adversarial examples in the input space, we look for adversarial examples in the activation space. The main intuition is that neural networks with piece-wise linear activation functions (e.g., ReLU) can be seen as a piece-wise linear function and each piece is uniquely defined by a specific setting of activation function status. For ReLU networks, each neuron can either be active (its input is positive) or inactive (its input is negative so the output is 0), which can be encoded by discrete 0-1 variables. This leads to a mixed integer programming (MIP) formulation, and  conducted attacks using a MIP solver.
Benefits of the MIP formulation. The MIP formulation with the 0-1 encoding of ReLU neurons allows us to systematically search all the linear pieces in the input space, theoretically guarantee to enumerate the entire input space and obtain the global minimum of Eq. () given sufficient time.
Practically, MIP-based attacks can often find adversarial examples that are missed by existing attacks and identify true weaknesses of a model. It also helps to close the gap between the upper and lower bounds of robust accuracy (i.e., attack accuracy vs. verified accuracy). Existing works aimed to reducing this gap by tightening the lower bound with stronger verifiers, while our work aims to tighten the upper bound by a systematic search of adversarial examples. Closing this gap is difficult even on small models.
Generic MIP solvers are inefficient for adversarial attacks. Despite its strengths, a MIP-based attack are often a few orders of magnitudes slower than existing attacks due to the high cost of running an off-the-shelf solver such as Gurobi . There are three root causes for its inefficiency. First, an off-the-shelf solver is not aware of the underlying optimization problem corresponds to a neural network, and has to apply generic solving techniques (e.g., using Simplex algorithm with relaxations) which can be expensive or ineffective. Second, it cannot utilize solutions obtained cheaply from gradient based attacks to accelerate its search. Third, generic MIP solvers are mostly restricted to CPUs and can hardly utilize GPU acceleration, which is crucial for efficiency.
Contributions of this paper. We address the above weaknesses in MIP solvers for adversarial attacks, by developing a GPU-accelerated branch and bound procedure to systematically search adversarial examples in the activation space, which is more efficient than generic MIP solvers. We focus on solving hard instances, where none of existing adversarial attacks based on searching the input space are successful but no verifier can prove their robustness. Our contributions includes:
• We apply the GPU-accelerated bound propagation based methods, which were originally developed for neural network verification, to the adversarial attack setting. These specialized methods can quickly examine thousands of regions in activation space in parallel and rule out the regions with no adversarial examples, which is difficult in off-the-shelf MIP solvers with a generic solving procedure.
• We employ a top-down beam-search to explore the activation space. • Our new attack framework, BaB-Attack, is designed to tackle hard instances where existing strong adversarial attacks (such as AutoAttack) cannot succeed. Despite being more expensive than attacks on the input space, BaB-Attack is about an order of magnitude faster than using an MIP solver on hard instances, and can find adversarial examples that cannot be discovered by any existing attacks.
Contributions of this paper. We address the above weaknesses in MIP solvers for adversarial attacks, by developing a GPU-accelerated branch and bound procedure to systematically search adversarial examples in the activation space, which is more efficient than generic MIP solvers. We focus on solving hard instances, where none of existing adversarial attacks based on searching the input space are successful but no verifier can prove their robustness. Our contributions includes:
•We apply the GPU-accelerated bound propagation based methods (Wang et al., 2021; Xu et al., 2020; Zhang et al., 2018; Wong & Kolter, 2018), which were originally developed for neural net_x005f_x005f_x005f_x005f_x005f_x005f_x005f_x005f_x001f_work verification, to the adversarial attack setting. These specialized methods can quickly examine thousands of regions in activation space in parallel and rule out the regions with no adversarial examples, which is difficult in off-the-shelf MIP solvers with a generic solving procedure.
•We employ a top-down beam-search to explore the activation space. Unlike the best-first search scheme used in many neural network verifiers, we can quickly go deep in the search tree and identify the most promising regions with adversarial examples. A smaller sub-MIP can then be created on- the-fly to search adversarial examples in the reduced regions with much fewer integer variables.
•We collect adversarial examples generated by cheap attacks in a candidate pool and utilize them in two ways. First, we conduct a bottom-up search on examples close to decision boundary by applying large neighborhood search (LNS). Second, when conducting the top-down search, we adopt diving by fixing integer variables according to adversarial examples in the pool to reduce the search space.
•Our new attack framework, BaB-Attack, is designed to tackle hard instances where existing strong adversarial attacks (such as AutoAttack) cannot succeed. Despite being more expensive than attacks on the input space, BaB-Attack is about an order of magnitude faster than using an MIP solver on hard instances, and can find adversarial examples that cannot be discovered by any existing attacks.
Answer: When solving the activation space attack using a generic MIP solver like Gurobi or CPLEX, the generic MIP solver can be very inefficient because it cannot exploit the structure of the neural networks to speed up solving, cannot utilize information from cheap adversarial attacks (e.g., PGD attacks), and also can hardly be accelerated on GPUs. So although attacks on activation space can be powerful, they are extremely slow using a generic MIP solver.
Our work solves these weaknesses using a specialized top-down beam search and bottom-up large neighborhood search. We use bound propagation methods to exploit the structure of the networks to speedup solving; we maintain a pool of existing adversarial examples to guide the search in activation space; our search is also accelerated on GPUs via specialized neural network verifiers.
By overcoming these drawbacks in a generic MIP solver, we greatly improved adversarial example search on the activation space: we can find more adversarial examples and also be over a magnitude faster than the generic MIP solver on most models.