# Linear Modeling of the Adversarial Noise Space

Jordan Frecon, Lucas Anquetil, Yuan Liu, Gilles Gasso, Stéphane Canu

► To cite this version:

Jordan Frecon, Lucas Anquetil, Yuan Liu, Gilles Gasso, Stéphane Canu. Linear Modeling of the Adversarial Noise Space. ECML, 2024. hal-04589704

HAL Id: hal-04589704

https://inria.hal.science/hal-04589704

Submitted on 27 May 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Linear Modeling of the Adversarial Noise Space

Jordan Patracone, Lucas Anquetil, Yuan Liu, Gilles Gasso, Stéphane Canu

► To cite this version:

Jordan Patracone, Lucas Anquetil, Yuan Liu, Gilles Gasso, Stéphane Canu. Linear Modeling of the Adversarial Noise Space. ECML PKDD 2024 - European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, Sep 2024, Vilnius, Lithuania. hal-04589704

HAL Id: hal-04589704

https://inria.hal.science/hal-04589704v1

Submitted on 27 May 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Linear Modeling of the Adversarial Noise Space

Jordan Patracone¹(✉), Lucas Anquetil², Yuan Liu², Gilles Gasso², and
Stéphane Canu²

¹ Université Jean Monnet Saint-Etienne, CNRS, Institut d'Optique Graduate School,
Inria, Laboratoire Hubert Curien UMR 5516, F-42023, SAINT-ETIENNE, France

² Normandie Univ, INSA Rouen UNIROUEN, UNIHAVRE, LITIS,
Saint-Etienne-du-Rouvray, France

**Abstract.** Recent works have revealed the vulnerability of deep neural network (DNN) classifiers to adversarial attacks. Among such attacks, it is common to distinguish specific attacks adapted to each example from universal ones, referred to as example-agnostic. Even though specific adversarial attacks are efficient on their target DNN classifier to attack, they struggle to transfer to others. Conversely, universal adversarial attacks suffer from lower attack success. To reconcile universality and efficiency, we propose LIMANS, a model of the adversarial noise space, allowing to frame any specific adversarial perturbation as a linear combination of the universal adversarial directions. We bring in two stochastic gradient based algorithms for learning these universal directions and the associated adversarial attacks. Empirical analyses conducted with the CIFAR-10 and ImageNet datasets show that LIMANS (i) enables crafting specific and robust adversarial attacks with high probability, (ii) provides a deeper understanding of DNN flaws, and (iii) shows significant ability in transferability.

**Keywords:** Adversarial attacks · Dictionary learning · Manifold learning.

## 1 Introduction

With recent technological advances, deep neural networks (DNNs) have found widespread applications ranging from biomedical imaging to autonomous vehicles. However, DNNs have been shown to be vulnerable to adversarial attacks [31]. These attacks are slight perturbations of *clean* examples that are well-classified by the DNN, ultimately leading to misclassification. These perturbations may take the form of common corruptions (e.g., for images it can be a change in lightning conditions, colorimetry or rotations) or visually imperceptible learned adversarial noises.

There essentially exist two ways of crafting adversarial noises. The first strategy consists in finding a paired adversarial noise for each example to attack [5,25]. As such, it is deemed to be *specific* since each adversarial noise is *specifically* designed for a given example. The second strategy aims at finding a unique *universal* noise which, added to any example, is likely to fool the DNN [22]. Each strategy comes with its pros and cons. On the one hand, although specific attacks
# Linear Modeling of the Adversarial Noise Space

Jordan Patracone¹(✉), Lucas Anquetil², Yuan Liu², Gilles Gasso², and
Stéphane Canu²

¹ Université Jean Monnet Saint-Etienne, CNRS, Institut d'Optique Graduate School,
Inria, Laboratoire Hubert Curien UMR 5516, F-42023, SAINT-ETIENNE, France

² Normandie Univ, INSA Rouen UNIROUEN, UNIHAVRE, LITIS,
Saint-Etienne-du-Rouvray, France

**Abstract.** Recent works have revealed the vulnerability of deep neural network (DNN) classifiers to adversarial attacks. Among such attacks, it is common to distinguish specific attacks adapted to each example from universal ones, referred to as example-agnostic. Even though specific adversarial attacks are efficient on their target DNN classifier to attack, they struggle to transfer to others. Conversely, universal adversarial attacks suffer from lower attack success. To reconcile universality and efficiency, we propose LIMANS, a model of the adversarial noise space, allowing to frame any specific adversarial perturbation as a linear combination of the universal adversarial directions. We bring in two stochastic gradient based algorithms for learning these universal directions and the associated adversarial attacks. Empirical analyses conducted with the CIFAR-10 and ImageNet datasets show that LIMANS (i) enables crafting specific and robust adversarial attacks with high probability, (ii) provides a deeper understanding of DNN flaws, and (iii) shows significant ability in transferability.

**Keywords:** Adversarial attacks · Dictionary learning · Manifold learning.

## 1 Introduction

With recent technological advances, deep neural networks (DNNs) have found widespread applications ranging from biomedical imaging to autonomous vehicles. However, DNNs have been shown to be vulnerable to adversarial attacks [31]. These attacks are slight perturbations of *clean* examples that are well-classified by the DNN, ultimately leading to misclassification. These perturbations may take the form of common corruptions (e.g., for images it can be a change in lightning conditions, colorimetry or rotations) or visually imperceptible learned adversarial noises.

There essentially exist two ways of crafting adversarial noises. The first strategy consists in finding a paired adversarial noise for each example to attack [5,25]. As such, it is deemed to be *specific* since each adversarial noise is *specifically* designed for a given example. The second strategy aims at finding a unique *universal* noise which, added to any example, is likely to fool the DNN [22]. Each strategy comes with its pros and cons. On the one hand, although specific attacks
achieve great performances on the target DNN, the learned adversarial noises do not fool other DNNs on the same examples, i.e., they transfer poorly. On the other hand, universal attacks have shown higher transferability at the expense of a weaker ability to fool the target DNN on which the universal adversarial noise is learned.

**Contributions.** To reconcile specificity and universality, we suggest to linearly model the adversarial noise space and propose LIMANS. For each example to attack, an adversarial noise is crafted as a linear combination of adversarial directions. While the adversarial directions are *universal*, the linear combination coefficients are *specific* to each example to perturb. In order to learn both, we propose two optimization problems associated to scalable stochastic numerical solutions. We claim that:

- Adversarial directions learned by LIMANS demonstrate transferability across diverse classifiers;

- The learned adversarial directions provide insights into DNN vulnerabilities;

- Adversarial examples generated by LIMANS exhibit great robustness to existing attack detectors.

**Outline.** The rest of the paper is organized as follows: the state-of-the-art researches on specific attacks, universal attacks and manifold of adversarial perturbations are presented in Section 2. The proposed framework, as well as the corresponding algorithmic solutions are detailed in Section 3. Finally, Section 4 showcases the adversarial noise model and provides experimental evaluations on both CIFAR10 and ImageNet.

## 2 Preliminaries and Related Works

Let us consider the task of predicting labels in $\mathcal{Y} = \{1, \dots, c\}$ associated to data from a $P$-dimensional feature space $\mathcal{X} \subseteq \mathbb{R}^P$. We denote $\mathcal{D}$ the corresponding distribution on $\mathcal{X} \times \mathcal{Y}$ while $\mathcal{D}_{\mathcal{X}}$ stands for the marginal distribution on $\mathcal{X}$. We stand in a white-box setting, where we assume to have fully access to a DNN $f: \mathbb{R}^P \to \mathbb{R}^c$ trained on this task. For any $\mathbf{x} \sim \mathcal{D}_{\mathcal{X}}$, $f(\mathbf{x}) \in \mathbb{R}^c$ represents the vector of scores indicating the likelihood of the example to belong to each of $c$ classes. The predicted class is determined by $C_f(\mathbf{x}) = \underset{k \in \mathcal{Y}}{\operatorname{argmax}} f(\mathbf{x})_k$.

The purpose of adversarial attacks is to craft, for any $\mathbf{x} \sim \mathcal{D}_{\mathcal{X}}$, an example $\mathbf{x}' \in \mathcal{X}$, called adversarial, such that $\mathbf{x}'$ is close to $\mathbf{x}$ and $C_f(\mathbf{x}') \neq C_f(\mathbf{x})$. In other words, the adversarial example manages to change the prediction of the DNN $f$ while being very similar to a well-classified example. Hereafter, we restrict to the peculiar case of perturbation-based attacks where $\mathbf{x}' = \mathbf{x} + \epsilon$ for some adversarial noise $\epsilon$. In order for the perturbation to be imperceptible, it is customary to impose some constraints of the form $\|\epsilon\|_p \le \delta_p$ for some $l_p$-norm (typically $l_2$ or $l_\infty$) and some small budget $\delta_p > 0$.

We now recall the two current paradigms: namely *specific perturbations*, also called *example-based perturbations*, and *universal perturbations* which are *example-agnostic*. Then, we motivate our approach from recent works aiming to learn the manifold of adversarial perturbations.
achieve great performances on the target DNN, the learned adversarial noises do not fool other DNNs on the same examples, i.e., they transfer poorly. On the other hand, universal attacks have shown higher transferability at the expense of a weaker ability to fool the target DNN on which the universal adversarial noise is learned.

**Contributions.** To reconcile specificity and universality, we suggest to linearly model the adversarial noise space and propose LIMANS. For each example to attack, an adversarial noise is crafted as a linear combination of adversarial directions. While the adversarial directions are *universal*, the linear combination coefficients are *specific* to each example to perturb. In order to learn both, we propose two optimization problems associated to scalable stochastic numerical solutions. We claim that:

- Adversarial directions learned by LIMANS demonstrate transferability across diverse classifiers;

- The learned adversarial directions provide insights into DNN vulnerabilities;

- Adversarial examples generated by LIMANS exhibit great robustness to existing attack detectors.

**Outline.** The rest of the paper is organized as follows: the state-of-the-art researches on specific attacks, universal attacks and manifold of adversarial perturbations are presented in Section 2. The proposed framework, as well as the corresponding algorithmic solutions are detailed in Section 3. Finally, Section 4 showcases the adversarial noise model and provides experimental evaluations on both CIFAR10 and ImageNet.

## 2 Preliminaries and Related Works

Let us consider the task of predicting labels in $\mathcal{Y} = \{1, \dots, c\}$ associated to data from a $P$-dimensional feature space $\mathcal{X} \subseteq \mathbb{R}^P$. We denote $\mathcal{D}$ the corresponding distribution on $\mathcal{X} \times \mathcal{Y}$ while $\mathcal{D}_{\mathcal{X}}$ stands for the marginal distribution on $\mathcal{X}$. We stand in a white-box setting, where we assume to have fully access to a DNN $f: \mathbb{R}^P \to \mathbb{R}^c$ trained on this task. For any $\mathbf{x} \sim \mathcal{D}_{\mathcal{X}}$, $f(\mathbf{x}) \in \mathbb{R}^c$ represents the vector of scores indicating the likelihood of the example to belong to each of $c$ classes. The predicted class is determined by $C_f(\mathbf{x}) = \underset{k \in \mathcal{Y}}{\operatorname{argmax}} f(\mathbf{x})_k$.

The purpose of adversarial attacks is to craft, for any $\mathbf{x} \sim \mathcal{D}_{\mathcal{X}}$, an example $\mathbf{x}' \in \mathcal{X}$, called adversarial, such that $\mathbf{x}'$ is close to $\mathbf{x}$ and $C_f(\mathbf{x}') \neq C_f(\mathbf{x})$. In other words, the adversarial example manages to change the prediction of the DNN $f$ while being very similar to a well-classified example. Hereafter, we restrict to the peculiar case of perturbation-based attacks where $\mathbf{x}' = \mathbf{x} + \epsilon$ for some adversarial noise $\epsilon$. In order for the perturbation to be imperceptible, it is customary to impose some constraints of the form $\|\epsilon\|_p \le \delta_p$ for some $\ell_p$-norm (typically $\ell_2$ or $\ell_\infty$) and some small budget $\delta_p > 0$.

We now recall the two current paradigms: namely *specific perturbations*, also called *example-based perturbations*, and *universal perturbations* which are *example-agnostic*. Then, we motivate our approach from recent works aiming to learn the manifold of adversarial perturbations.
## 2.1 Specific Perturbations

Specific perturbations are learned adversarial noises individually designed to attack given examples [5,25]. More precisely, for any $x \sim D_X$, the corresponding attack is of the form $x' = x + \epsilon(x)$ where the perturbation $\epsilon(x)$ depends on $x$.

Among the most prominent specific attacks are one-shot gradient methods such as the Fast Gradient Sign Method (FGSM) [9], and more elaborate iterative procedures like Projected Gradient Descent (PGD) [21], DeepFool [23], and the method by Carlini and Wagner (CW) [3]. Notably, AutoAttack [6], an ensemble of diverse parameter-free attacks, has emerged as the state-of-the-art for evaluating neural network robustness.

The specificity of these attacks enables them to effectively deceive the targeted classifier. However, recent works have shown their limitations in fooling other classifiers trained on the same task. In other words, adversarial examples generated by specific attacks often demonstrate poor transferability across different classifiers. To enhance their transferability, [36] proposed incorporating input transformations, while [34] suggested stabilizing the update directions of adversarial noise to avoid poor local optima, leading to the development of VNI-FGSM and VMI-FGSM methods. Additionally, Neuron Attribution-based Attacks (NAA) improved transferability by conducting feature-level attacks [39]. Lastly, the Reverse Adversarial Perturbation (RAP) attack aimed to find adversarial attacks located on a plateau of the loss function [26].

Learning these perturbations can be computationally extensive in the sense that, for any new example to attack, it requires to run an algorithmic solution once again. To alleviate this burden, universal perturbations were proposed [22].

## 2.2 Universal Perturbations

A universal perturbation is a single perturbation which, added to any example, manage to fool a given classifier with moderate to high probability. Formally, it amounts in finding $\epsilon$ so that, for any $x \sim D_X$, $x' = x + \epsilon$ is an adversarial attack.

Among them, *universal adversarial perturbations* are meticulously crafted to exploit the most vulnerable areas of a classifier's performance, the so-called worst-case, to maximize their effectiveness across various inputs. The first universal adversarial perturbation (UAP) was introduced in [22] by hinging on the DeepFool attack. Later, different extensions of UAP were proposed: UAP-PGD [29] used a projected gradient-descent algorithm to compute the universal perturbation, CD-UAP [37] optimized an universal perturbation on a given subset of classes while the Class-Wise Universal Adversarial Perturbations (CW-UAP) [2] elaborated one universal perturbation per class.

Besides, another line of universal perturbations, called *common corruptions*, aimed a reproducing types of harm that exist in real-world imaging systems [13]. These perturbations are visually understandable modifications of the examples, readily comprehensible to humans, such as adjustments in brightness, rotation, tilt of an image or added Gaussian or impulse noise. They are average-case perturbations beyond the scope of this work. Even though common corruptions
## 2.1 Specific Perturbations

Specific perturbations are learned adversarial noises individually designed to attack given examples [5,25]. More precisely, for any $\mathbf{x} \sim D_X$, the corresponding attack is of the form $\mathbf{x}' = \mathbf{x} + \epsilon(\mathbf{x})$ where the perturbation $\epsilon(\mathbf{x})$ depends on $\mathbf{x}$.

Among the most prominent specific attacks are one-shot gradient methods such as the Fast Gradient Sign Method (FGSM) [9], and more elaborate iterative procedures like Projected Gradient Descent (PGD) [21], DeepFool [23], and the method by Carlini and Wagner (CW) [3]. Notably, AutoAttack [6], an ensemble of diverse parameter-free attacks, has emerged as the state-of-the-art for evaluating neural network robustness.

The specificity of these attacks enables them to effectively deceive the targeted classifier. However, recent works have shown their limitations in fooling other classifiers trained on the same task. In other words, adversarial examples generated by specific attacks often demonstrate poor transferability across different classifiers. To enhance their transferability, [36] proposed incorporating input transformations, while [34] suggested stabilizing the update directions of adversarial noise to avoid poor local optima, leading to the development of VNI-FGSM and VMI-FGSM methods. Additionally, Neuron Attribution-based Attacks (NAA) improved transferability by conducting feature-level attacks [39]. Lastly, the Reverse Adversarial Perturbation (RAP) attack aimed to find adversarial attacks located on a plateau of the loss function [26].

Learning these perturbations can be computationally extensive in the sense that, for any new example to attack, it requires to run an algorithmic solution once again. To alleviate this burden, universal perturbations were proposed [22].

## 2.2 Universal Perturbations

A universal perturbation is a single perturbation which, added to any example, manage to fool a given classifier with moderate to high probability. Formally, it amounts in finding $\epsilon$ so that, for any $\mathbf{x} \sim D_X$, $\mathbf{x}' = \mathbf{x} + \epsilon$ is an adversarial attack.

Among them, *universal adversarial perturbations* are meticulously crafted to exploit the most vulnerable areas of a classifier's performance, the so-called worst-case, to maximize their effectiveness across various inputs. The first universal adversarial perturbation (UAP) was introduced in [22] by hinging on the DeepFool attack. Later, different extensions of UAP were proposed: UAP-PGD [29] used a projected gradient-descent algorithm to compute the universal perturbation, CD-UAP [37] optimized an universal perturbation on a given subset of classes while the Class-Wise Universal Adversarial Perturbations (CW-UAP) [2] elaborated one universal perturbation per class.

Besides, another line of universal perturbations, called *common corruptions*, aimed a reproducing types of harm that exist in real-world imaging systems [13]. These perturbations are visually understandable modifications of the examples, readily comprehensible to humans, such as adjustments in brightness, rotation, tilt of an image or added Gaussian or impulse noise. They are average-case perturbations beyond the scope of this work. Even though common corruptions
<figure><img src="image_2.png" /><figcaption>Fig. 1: **Schematic representation of adversarial attacks.** Two DNN classifiers $f_1$ (blue) and $f_2$ (orange) are trained to classify red circles vs. green diamonds.</figcaption></figure>

are closer to real-world harm, they need to be explicitly defined prior to any perturbation crafting, thereby limiting the modeling of the perturbation space.

Universal attacks are fast but their applicability is still far-fetched because of poor performances compared to specific attacks [4]. In an attempt to bridge the gap between adversarial perturbations and common corruptions, techniques have been explored to learn the manifold within which adversarial perturbations are embedded.

## 2.3 Manifold of Adversarial Perturbations

Learning and understanding the manifold of adversarial perturbations is crucial for comprehending the reasons for the existence and transferability of adversarial attacks, as well as devising effective defense mechanisms against them.

The study done in [32] highlighted that the space of the adversarial noise paired to an input example is a large continuous region. Then, [33] discovered that the decision boundaries of different classifiers are closed and proposed to establish a transferable subspace of the adversarial space across different classifiers. However, the subspace was inferred based on the adversarial noise generated by the FGSM method, significantly compromising its accuracy. Moreover, constraining the hypothesis of transferability solely based on the dimension of this space restricted its efficacy, particularly concerning CNN classifiers. In addition, certain studies have investigated the overall structure of classifiers to elucidate the emergence of adversarial attacks. For instance, [8] demonstrated that the decision boundaries of a classifier reside close to examples and remain flat in most directions. More recently, [7] theoretically studied the sufficient conditions on the existence of effective low-dimensional adversarial perturbations while [18] claimed that adversarial noise is caused by gradient leakage and the adversarial directions are perpendicular to the classifier boundaries. To learn this manifold, it has been proposed to use the singular vectors of some adversarial perturbations [14] or principal component analysis [40], to train a specific neural network as a generative network [1,12] or with generative adversarial networks [35].

Fig. 1 reports a schematic representation of adversarial attacks in the context of a binary classification task (red circles vs. green diamonds). In particular, Fig. 1a
<figure><img src="image_2.png" /><figcaption>Fig. 1: **Schematic representation of adversarial attacks.** Two DNN classifiers $f_1$ (blue) and $f_2$ (orange) are trained to classify red circles vs. green diamonds.</figcaption></figure>

are closer to real-world harm, they need to be explicitly defined prior to any perturbation crafting, thereby limiting the modeling of the perturbation space.

Universal attacks are fast but their applicability is still far-fetched because of poor performances compared to specific attacks [4]. In an attempt to bridge the gap between adversarial perturbations and common corruptions, techniques have been explored to learn the manifold within which adversarial perturbations are embedded.

## 2.3 Manifold of Adversarial Perturbations

Learning and understanding the manifold of adversarial perturbations is crucial for comprehending the reasons for the existence and transferability of adversarial attacks, as well as devising effective defense mechanisms against them.

The study done in [32] highlighted that the space of the adversarial noise paired to an input example is a large continuous region. Then, [33] discovered that the decision boundaries of different classifiers are closed and proposed to establish a transferable subspace of the adversarial space across different classifiers. However, the subspace was inferred based on the adversarial noise generated by the FGSM method, significantly compromising its accuracy. Moreover, constraining the hypothesis of transferability solely based on the dimension of this space restricted its efficacy, particularly concerning CNN classifiers. In addition, certain studies have investigated the overall structure of classifiers to elucidate the emergence of adversarial attacks. For instance, [8] demonstrated that the decision boundaries of a classifier reside close to examples and remain flat in most directions. More recently, [7] theoretically studied the sufficient conditions on the existence of effective low-dimensional adversarial perturbations while [18] claimed that adversarial noise is caused by gradient leakage and the adversarial directions are perpendicular to the classifier boundaries. To learn this manifold, it has been proposed to use the singular vectors of some adversarial perturbations [14] or principal component analysis [40], to train a specific neural network as a generative network [1,12] or with generative adversarial networks [35].

Fig. 1 reports a schematic representation of adversarial attacks in the context of a binary classification task (red circles vs. green diamonds). In particular, Fig. 1a
<figure><img src="image_3.png" /><figcaption>Fig. 2: **High-level overview of LIMANS.** During training, the directions *D* of the linear adversarial noise space are learned. During inference, the coding vector *v* is crafted to attack any example to fool a given classifier.</figcaption></figure>

illustrates how data points are located in the vicinity of the decision boundaries of classifiers $f_1$ (blue) and $f_2$ (orange) trained on this task. Hence, adding a small perturbation, learned on $f_1$ can easily make them misclassified. Attacks can also transfer to $f_2$ when there is little bias between the two classifiers, as it is the case in the Region 3. However, in practical scenarios, the situations depicted in Region 1 and 2 are more prevalent: adversarial examples tend to deviate beyond the decision boundary of $f_1$ without necessarily crossing the boundary shared by $f_1$ and $f_2$. Overall, universal perturbations (see $\epsilon$ in Fig. 1a) can achieve superior transferability by averaging directions across the entire dataset, at the expense of lower attack success rate. Conversely, specific perturbations (see $\epsilon(\mathbf{x}_i)$ in Fig. 1b) show great attack performance on the target $f_1$ but fail to transfer to $f_2$.

In order to bridge the gap between specific attacks and universal attacks, we propose to linearly model the adversarial noise space (LIMANS). The underlying idea is to learn a set of adversarial directions (see $\{D_1, D_2\}$ in Fig. 1c). The spanned space enables the construction of specific adversarial examples by linearly combining the adversarial directions. In essence, this learned space exhibits transferability across different classifiers, leading to a higher attack success rate.

# 3 Linear Modeling of the Adversarial Noise Space

In this section, we introduce the proposed framework LIMANS, sketched in Fig. 2, for modeling the adversarial noise space. Then, we propose two relaxations along with their algorithmic solutions.
<figure><img src="image_3.png" /><figcaption>Fig. 2: **High-level overview of LIMANS.** During training, the directions $D$ of the linear adversarial noise space are learned. During inference, the coding vector $v$ is crafted to attack any example to fool a given classifier.</figcaption></figure>

illustrates how data points are located in the vicinity of the decision boundaries of classifiers $f_1$ (blue) and $f_2$ (orange) trained on this task. Hence, adding a small perturbation, learned on $f_1$ can easily make them misclassified. Attacks can also transfer to $f_2$ when there is little bias between the two classifiers, as it is the case in the Region 3. However, in practical scenarios, the situations depicted in Region 1 and 2 are more prevalent: adversarial examples tend to deviate beyond the decision boundary of $f_1$ without necessarily crossing the boundary shared by $f_1$ and $f_2$. Overall, universal perturbations (see $\epsilon$ in Fig. 1a) can achieve superior transferability by averaging directions across the entire dataset, at the expense of lower attack success rate. Conversely, specific perturbations (see $\epsilon(\mathbf{x}_i)$ in Fig. 1b) show great attack performance on the target $f_1$ but fail to transfer to $f_2$.

In order to bridge the gap between specific attacks and universal attacks, we propose to linearly model the adversarial noise space (LIMANS). The underlying idea is to learn a set of adversarial directions (see $\{D_1, D_2\}$ in Fig. 1c). The spanned space enables the construction of specific adversarial examples by linearly combining the adversarial directions. In essence, this learned space exhibits transferability across different classifiers, leading to a higher attack success rate.

## 3 Linear Modeling of the Adversarial Noise Space

In this section, we introduce the proposed framework LIMANS, sketched in Fig. 2, for modeling the adversarial noise space. Then, we propose two relaxations along with their algorithmic solutions.
## 3.1 Problem Formulation

The originality of the present paper is to express adversarial perturbations using a linear model. More formally, for any $\mathbf{x} \sim D_X$, the corresponding adversarial attack is written as $\mathbf{x}' = \mathbf{x} + \epsilon(\mathbf{x})$ where the adversarial noise is decomposed as $\epsilon(\mathbf{x}) = D\mathbf{v}(\mathbf{x})$. On the one hand, $D = [D_1, \dots, D_M] \in \mathbb{R}^{P \times M}$ is a dictionary made of $M \in \mathbb{N}_+$ normalized adversarial directions (also called noise atoms), i.e., $\|D_j\|_p = 1$ for every $j \in \{1, \dots, M\}$. On the other hand, $\mathbf{v}(\mathbf{x}) \in \mathbb{R}^M$ plays the role of a coding vector. While the dictionary $D$ is shared across all attacks, $\mathbf{v}(\mathbf{x})$ allows combining components of $D$ in order to individually tailor perturbations for each example $\mathbf{x}$ to attack. In other words, $D$ is universal while $\mathbf{v}(\mathbf{x})$ is example-specific. In the remaining of the paper, we simply write $\mathbf{v}(\mathbf{x})$ as $\mathbf{v}$ for the ease of reading.

We advocate to choose a number of atoms $M \ll P$ so that the linear adversarial noise space spanned by the atoms, i.e., $\mathcal{A} = \{\sum_{j=1}^M v_j D_j \mid v_j \in \mathbb{R}\}$, is low dimensional. In order to learn the directions $\{D_j\}$ of $\mathcal{A}$, we suggest maximizing the chances of fooling the classifier $f$ on some training set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$, that is the fooling rate (also known as attack success rate).

$$ \frac{1}{N} \sum_{i=1}^{N} \mathbb{1}\{C_f(\mathbf{x}^{(i)}) \neq C_f(\mathbf{x}^{(i)})\}. \quad (1) $$

This gives rise to the following optimization problem.

**Problem 1 (Training).** Given a classifier $f$ and a training set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim D$, solve

$$
\begin{array}{ll}
\underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{maximize}} & \frac{1}{N} \sum_{i=1}^{N} \mathbb{1}\{C_f(\mathbf{x}^{(i)}) \neq C_f(\mathbf{x}^{(i)})\}, \\
\underset{V=[\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}}{\operatorname{s.t.}} & \left\{
\begin{array}{ll}
\mathbf{x}^{(i)} = \mathbf{x}^{(i)} + D\mathbf{v}^{(i)} \in \mathcal{X} & (\forall i \in \{1, \dots, N\}), \\
\|D\mathbf{v}^{(i)}\|_p \le \delta_p & (\forall i \in \{1, \dots, N\}), \\
\|D_j\|_p = 1 & (\forall j \in \{1, \dots, M\}),
\end{array}
\right.
\end{array}
\quad (2)
$$

where $1_S$ denotes the indicator function of the set $S$.

The number of atoms $M$ acts as a trade-off quantifying the level of similarity between all adversarial perturbations.

When $M = 1$, each perturbation is of the form $\epsilon(\mathbf{x}) = v_1 D_1$, so they all vary by a multiplicative constant $v_1 \in \mathbb{R}$. Actually, it is more likely that all differ by their sign due to the constraint $\|D\mathbf{v}^{(i)}\|_p \le \delta_p$ in Eq. (2) and the fact that greater perturbations (in norms) are more amenable to fool the classifier. Hence, we are in an under-fitting regime where the adversarial perturbations somewhat boil down to a universal perturbation which cannot manage to fool all examples of the training set but achieve great transferability across different DNN classifiers.

On the other hand of the spectrum, when $M = N$, there are enough degrees of freedom to specifically tailor one direction $D_j$ for each example of the training set to attack. Therefore, we stand in an over-fitting regime, reminiscent of specific attacks, where the learned adversarial noise space may transfer poorly.
## 3.1 Problem Formulation

The originality of the present paper is to express adversarial perturbations using a linear model. More formally, for any $\mathbf{x} \sim D_X$, the corresponding adversarial attack is written as $\mathbf{x}' = \mathbf{x} + \epsilon(\mathbf{x})$ where the adversarial noise is decomposed as $\epsilon(\mathbf{x}) = D\mathbf{v}(\mathbf{x})$. On the one hand, $D = [D_1, \dots, D_M] \in \mathbb{R}^{P \times M}$ is a dictionary made of $M \in \mathbb{N}_+$ normalized adversarial directions (also called noise atoms), i.e., $\|D_j\|_p = 1$ for every $j \in \{1, \dots, M\}$. On the other hand, $\mathbf{v}(\mathbf{x}) \in \mathbb{R}^M$ plays the role of a coding vector. While the dictionary $D$ is shared across all attacks, $\mathbf{v}(\mathbf{x})$ allows combining components of $D$ in order to individually tailor perturbations for each example $\mathbf{x}$ to attack. In other words, $D$ is universal while $\mathbf{v}(\mathbf{x})$ is example-specific. In the remaining of the paper, we simply write $\mathbf{v}(\mathbf{x})$ as $\mathbf{v}$ for the ease of reading.

We advocate to choose a number of atoms $M \ll P$ so that the linear adversarial noise space spanned by the atoms, i.e., $\mathcal{A} = \{\sum_{j=1}^M v_j D_j \mid v_j \in \mathbb{R}\}$, is low dimensional. In order to learn the directions $\{D_j\}$ of $\mathcal{A}$, we suggest maximizing the chances of fooling the classifier $f$ on some training set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$, that is the fooling rate (also known as attack success rate).

$$ \frac{1}{N} \sum_{i=1}^{N} 1\{C_f(\mathbf{x}^{(i)}) \neq C_f(\mathbf{x}^{(i)})\}. \quad (1) $$

This gives rise to the following optimization problem.

**Problem 1 (Training).** Given a classifier $f$ and a training set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim D$, solve

$$
\begin{array}{ll}
\underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{maximize}} & \frac{1}{N} \sum_{i=1}^{N} 1\{C_f(\mathbf{x}^{(i)}) \neq C_f(\mathbf{x}^{(i)})\}, \\
\underset{V=[\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}}{\operatorname{s.t.}} & \left\{
\begin{array}{ll}
\mathbf{x}^{(i)} = \mathbf{x}^{(i)} + D\mathbf{v}^{(i)} \in \mathcal{X} & (\forall i \in \{1, \dots, N\}), \\
\|D\mathbf{v}^{(i)}\|_p \le \delta_p & (\forall i \in \{1, \dots, N\}), \\
\|D_j\|_p = 1 & (\forall j \in \{1, \dots, M\}),
\end{array}
\right.
\end{array}
\quad (2)
$$

where $1_S$ denotes the indicator function of the set $S$.

The number of atoms $M$ acts as a trade-off quantifying the level of similarity between all adversarial perturbations.

When $M = 1$, each perturbation is of the form $\epsilon(\mathbf{x}) = v_1 D_1$, so they all vary by a multiplicative constant $v_1 \in \mathbb{R}$. Actually, it is more likely that all differ by their sign due to the constraint $\|D\mathbf{v}^{(i)}\|_p \le \delta_p$ in Eq. (2) and the fact that greater perturbations (in norms) are more amenable to fool the classifier. Hence, we are in an under-fitting regime where the adversarial perturbations somewhat boil down to a universal perturbation which cannot manage to fool all examples of the training set but achieve great transferability across different DNN classifiers.

On the other hand of the spectrum, when $M = N$, there are enough degrees of freedom to specifically tailor one direction $D_j$ for each example of the training set to attack. Therefore, we stand in an over-fitting regime, reminiscent of specific attacks, where the learned adversarial noise space may transfer poorly.
Our proposed framework LIMANS bridges the gap between the two ends of the spectrum by allowing the attacker to choose the number of atoms M better suited for the task at hand. Once the adversarial noise space $\mathcal{A}$ is learned, it can be used to attack unseen examples on any classifier $f$ (potentially different than the one used to learn $\mathcal{A}$) as follows.

**Problem 2 (Inference).** Given $\mathcal{A}$ spanned by directions $D \in \mathbb{R}^{P \times M}$, a classifier $f$, and an example $\mathbf{x} \sim D_{\mathcal{X}}$. The associated attack reads $\mathbf{x}' = \mathbf{x} + D\mathbf{v}$ where $\mathbf{v}$ solves

$$ \underset{\mathbf{v} \in \mathbb{R}^M}{\text{maximize}} \ 1_{\{C_f(\mathbf{x}') \neq C_f(\mathbf{x})\}}, \quad \text{s.t.} \quad \left\{ \begin{array}{l} \mathbf{x}' = \mathbf{x} + D\mathbf{v} \in \mathcal{X}, \\ \|D\mathbf{v}\|_p \le \delta_p. \end{array} \right. \qquad (3) $$

Problem 2 bears similarities with Problem 1 when the optimization over $D$ is dropped. In that case the optimization over $V = [\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}$ becomes separable into $N$ distinct problems: one for every $\mathbf{v}^{(i)}$. Problem 2 is one instance of them.

In the next section, we suggest two algorithmic solutions for solving Problem 1 and, by extension, also Problem 2.

## 3.2 Relaxations and Algorithmic Solutions

Solving Problem 1 is a challenge for three main reasons: i) the indicator function $1_S$, ii) the presence of the DNN $f$, and iii) the dictionary-based formulation of the adversarial noise.

First, it is customary to replace the fooling rate by a surrogate loss function (to minimize) in order to avoid algorithmic concerns regarding the nonconvexity and nonsmoothness of the indicator function. Hereafter, we resort to one of them, namely the logit margin loss of [3] that we recall below. Given a DNN $f$, an example $\mathbf{x} \sim D_{\mathcal{X}}$ classified as $C_f(\mathbf{x}) = y$, it reads

$$ \mathcal{L}_{\gamma}(f(\mathbf{x}'), f(\mathbf{x})) = \max(-\gamma, f_y(\mathbf{x}') - \max_{k \neq y} f_k(\mathbf{x}')), \qquad (4) $$

where $\gamma > 0$ is a hyperparameter.

Second, the optimization problem is nonconvex because of the highly non-linear mapping $f$. Therefore, studying the Lipschitz regularity of the DNN $f$ plays a pivotal role in the derivation of convergence guarantees of first order algorithms toward critical points of Problem 1. Since, we would like our approach to be general enough for any $f$, we do not pursue the estimation of an upper-bound on the Lipschitz constant of peculiar $f$, as conducted in [10].

Third, Problem 1 is difficult due to nonconvexity inherent to the dictionary-based formulation of the adversarial noise. Although classical dictionary learning problems are nonconvex, they are usually solved by alternating the optimization over $D$ and $V$ since each alternating problem is convex. However, here this no longer the case because of the presence of $f$ being a highly non-linear mapping. A direct optimization scheme over $(D, V)$, in the spirit of the nonconvex proximal splitting framework of [30], later applied in the context of classical dictionary
Our proposed framework LIMANS bridges the gap between the two ends of the spectrum by allowing the attacker to choose the number of atoms M better suited for the task at hand. Once the adversarial noise space $\mathcal{A}$ is learned, it can be used to attack unseen examples on any classifier $f$ (potentially different than the one used to learn $\mathcal{A}$) as follows.

**Problem 2 (Inference).** Given $\mathcal{A}$ spanned by directions $D \in \mathbb{R}^{P \times M}$, a classifier $f$, and an example $\mathbf{x} \sim D_{\mathcal{X}}$. The associated attack reads $\mathbf{x}' = \mathbf{x} + D\mathbf{v}$ where $\mathbf{v}$ solves

$$ \underset{\mathbf{v} \in \mathbb{R}^M}{\text{maximize}} \ 1_{\{C_f(\mathbf{x}') \neq C_f(\mathbf{x})\}}, \quad \text{s.t.} \quad \left\{ \begin{array}{l} \mathbf{x}' = \mathbf{x} + D\mathbf{v} \in \mathcal{X}, \\ \|D\mathbf{v}\|_p \le \delta_p. \end{array} \right. \qquad (3) $$

Problem 2 bears similarities with Problem 1 when the optimization over $D$ is dropped. In that case the optimization over $V = [\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}$ becomes separable into $N$ distinct problems: one for every $\mathbf{v}^{(i)}$. Problem 2 is one instance of them.

In the next section, we suggest two algorithmic solutions for solving Problem 1 and, by extension, also Problem 2.

## 3.2 Relaxations and Algorithmic Solutions

Solving Problem 1 is a challenge for three main reasons: i) the indicator function $1_S$, ii) the presence of the DNN $f$, and iii) the dictionary-based formulation of the adversarial noise.

First, it is customary to replace the fooling rate by a surrogate loss function (to minimize) in order to avoid algorithmic concerns regarding the nonconvexity and nonsmoothness of the indicator function. Hereafter, we resort to one of them, namely the logit margin loss of [3] that we recall below. Given a DNN $f$, an example $\mathbf{x} \sim D_{\mathcal{X}}$ classified as $C_f(\mathbf{x}) = y$, it reads

$$ \mathcal{L}_{\gamma}(f(\mathbf{x}'), f(\mathbf{x})) = \max(-\gamma, f_y(\mathbf{x}') - \max_{k \neq y} f_k(\mathbf{x}')), \qquad (4) $$

where $\gamma > 0$ is a hyperparameter.

Second, the optimization problem is nonconvex because of the highly non-linear mapping $f$. Therefore, studying the Lipschitz regularity of the DNN $f$ plays a pivotal role in the derivation of convergence guarantees of first order algorithms toward critical points of Problem 1. Since, we would like our approach to be general enough for any $f$, we do not pursue the estimation of an upper-bound on the Lipschitz constant of peculiar $f$, as conducted in [10].

Third, Problem 1 is difficult due to nonconvexity inherent to the dictionary-based formulation of the adversarial noise. Although classical dictionary learning problems are nonconvex, they are usually solved by alternating the optimization over $D$ and $V$ since each alternating problem is convex. However, here this no longer the case because of the presence of $f$ being a highly non-linear mapping. A direct optimization scheme over $(D, V)$, in the spirit of the nonconvex proximal splitting framework of [30], later applied in the context of classical dictionary
learning [27], was first considered but it that happened to be less effective than expected in practice. Since we are only interested in finding a good approximate critical point, we suggest two alternative problems which turned out to be more fruitful from the practitioner's point of view.

**Regularized-LIMANS** The first problem is designed by adding a soft penalization of the constraint $||D\mathbf{v}^{(i)}||_p \le \delta_p$ and relaxing the conditions $\mathbf{x}^{(i)}' \in \mathcal{X}$ from Problem 1.

**Problem 3.** Given a classifier $f$ and a set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim \mathcal{D}$, solve

$$ \begin{array}{ll} \underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{mimize}} & \frac{1}{N} \sum_{i=1}^{N} \mathcal{L}_{\gamma}(f(\mathbf{x}^{(i)} + D\mathbf{v}^{(i)}), f(\mathbf{x}^{(i)})) + \lambda h_{(\delta_p, p)}(D, \mathbf{v}^{(i)}), \\ \underset{V=[\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}}{\operatorname{s.t.}} & \|D_j\|_p = 1, \quad (\forall j \in \{1, \dots, M\}), \end{array} \tag{5} $$

where $\lambda > 0$ is a regularization parameter and $h_{(\delta_p, p)}$ is a penalty defined as

$$ h_{(\delta_p, p)}: (D, \mathbf{v}) \mapsto \max(||D\mathbf{v}||_p - \delta_p, 0). \tag{6} $$

**Algorithm 1** summarizes the optimization scheme of Regularized-LIMANS. The parameters $(D, V)$ are optimized stochastically, making them suitable for large-scale datasets. More specifically, $D$ is updated using a projected gradient descent to ensure that the constraints $||D_j||_p = 1, \forall j$ are satisfied.

In order to select the hyperparameter $\lambda > 0$, a cross-validation is conducted to ensure the generalization of the model. In practice, for the selected value of $\lambda$, it might happened that the constraint on $||D\mathbf{v}||_p$ is slightly violated. To ensure the respect of the constraint, a post-processing is performed. Details are provided in the supplementary material.

**Remark 1.** At inference-time, adversarial attacks are crafted as $\mathbf{x}' = \operatorname{Proj}_{\mathcal{X}}(\mathbf{x} + D\mathbf{v})$, where $\operatorname{Proj}_{\mathcal{X}}$ denotes the projection operator onto $\mathcal{X}$, and $\mathbf{v}$ is learned by solving Problem 3 with $D$ fixed.

**Simple-LIMANS** In the second problem relaxation, the constraints $||D\mathbf{v}^{(i)}||_p \le \delta_p$ and $\mathbf{x}^{(i)}' \in \mathcal{X}$ from Problem 1 are directly integrated in the objective function as follows.

**Problem 4.** Given a classifier $f$ and a set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim \mathcal{D}$, solve

$$ \begin{array}{ll} \underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{mimize}} & \frac{1}{N} \sum_{i=1}^{N} \mathcal{L}_{\gamma} \left( f\left(\operatorname{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \delta_p \frac{D\mathbf{v}^{(i)}}{||D\mathbf{v}^{(i)}||_p}), f(\mathbf{x}^{(i)}) \right). \end{array} \tag{7} $$
learning [27], was first considered but it that happened to be less effective than expected in practice. Since we are only interested in finding a good approximate critical point, we suggest two alternative problems which turned out to be more fruitful from the practitioner's point of view.

**Regularized-LIMANS** The first problem is designed by adding a soft penalization of the constraint $||D\mathbf{v}^{(i)}||_p \le \delta_p$ and relaxing the conditions $\mathbf{x}^{(i)}' \in \mathcal{X}$ from Problem 1.

**Problem 3.** Given a classifier $f$ and a set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim \mathcal{D}$, solve

$$ \begin{array}{ll} \underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{mimize}} & \frac{1}{N} \sum_{i=1}^{N} \mathcal{L}_{\gamma}(f(\mathbf{x}^{(i)} + D\mathbf{v}^{(i)}), f(\mathbf{x}^{(i)})) + \lambda h_{(\delta_p, p)}(D, \mathbf{v}^{(i)}), \\ \underset{V=[\mathbf{v}^{(1)}, \dots, \mathbf{v}^{(N)}] \in \mathbb{R}^{M \times N}}{\operatorname{s.t.}} & \|D_j\|_p = 1, \quad (\forall j \in \{1, \dots, M\}), \end{array} \tag{5} $$

where $\lambda > 0$ is a regularization parameter and $h_{(\delta_p, p)}$ is a penalty defined as

$$ h_{(\delta_p, p)}: (D, \mathbf{v}) \mapsto \max(||D\mathbf{v}||_p - \delta_p, 0). \tag{6} $$

**Algorithm 1** summarizes the optimization scheme of Regularized-LIMANS. The parameters $(D, V)$ are optimized stochastically, making them suitable for large-scale datasets. More specifically, $D$ is updated using a projected gradient descent to ensure that the constraints $||D_j||_p = 1, \forall j$ are satisfied.

In order to select the hyperparameter $\lambda > 0$, a cross-validation is conducted to ensure the generalization of the model. In practice, for the selected value of $\lambda$, it might happened that the constraint on $||D\mathbf{v}||_p$ is slightly violated. To ensure the respect of the constraint, a post-processing is performed. Details are provided in the supplementary material.

**Remark 1.** At inference-time, adversarial attacks are crafted as $\mathbf{x}' = \operatorname{Proj}_{\mathcal{X}}(\mathbf{x} + D\mathbf{v})$, where $\operatorname{Proj}_{\mathcal{X}}$ denotes the projection operator onto $\mathcal{X}$, and $\mathbf{v}$ is learned by solving Problem 3 with $D$ fixed.

**Simple-LIMANS** In the second problem relaxation, the constraints $||D\mathbf{v}^{(i)}||_p \le \delta_p$ and $\mathbf{x}^{(i)}' \in \mathcal{X}$ from Problem 1 are directly integrated in the objective function as follows.

**Problem 4.** Given a classifier $f$ and a set $\mathcal{T} = \{(\mathbf{x}^{(i)}, y^{(i)})\}_{i=1}^N$ where each $(\mathbf{x}^{(i)}, y^{(i)}) \sim \mathcal{D}$, solve

$$ \begin{array}{ll} \underset{D=[D_1, \dots, D_M] \in \mathbb{R}^{P \times M}}{\operatorname{mimize}} & \frac{1}{N} \sum_{i=1}^{N} \mathcal{L}_{\gamma} \left( f\left(\operatorname{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \delta_p \frac{D\mathbf{v}^{(i)}}{||D\mathbf{v}^{(i)}||_p}), f(\mathbf{x}^{(i)})\right) \right). \end{array} \tag{7} $$
**Algorithm 1 Regularized-LIMANS**

Require: Classifier $f$; Learning rate $\rho$; Dataset $\mathcal{T}$; Budget $\delta_p > 0$; Optimizer Optim; Batch size $B$; Parameter $\lambda > 0$

1: $D = \mathcal{N}(0, \mathbb{I}_{M \times P}); V = \mathcal{N}(0, \mathbb{I}_{P \times M})$

2: **for** $k = 0$ **to** MAXEPOCH **do**

3: loss = 0

4: **for** $(\mathbf{x}^{(i)}, y^{(i)}) \subset \mathcal{T}$ **do**

5: $\mathbf{x}^{(i)'} = \mathbf{x}^{(i)} + D\mathbf{v}^{(i)}$

6: $\hat{y}_{adv} = f(\mathbf{x}^{(i)})$; $\hat{y} = f(\mathbf{x}^{(i)})$

7: $\text{loss}_i = \mathcal{L}_{\gamma}(\hat{y}_{adv}, \hat{y}) + \lambda h_{(\delta_p, p)}(D, \mathbf{v}^{(i)})$

8: loss = loss + loss$_i$

9: **if** modulo($i$) = $B$ **then**

10: $D \leftarrow \text{Optim}(\nabla_D \text{loss})(\text{Update})$

11: $V \leftarrow \text{Optim}(\nabla_V \text{loss})(\text{Update})$

12: $D = \text{Proj}_{\{D \mid \|D\|_p = 1\}}(D)$

13: loss = 0

14: **end if**

15: **end for**

16: **end for**

17: $D\mathbf{v}^{(i)} \leftarrow \text{Proj}_{\{D\mathbf{v} \mid \|D\mathbf{v}\|_p \le \delta\}}(D\mathbf{v}^{(i)})$

18: $\mathbf{x}^{(i)'} \leftarrow \text{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + D\mathbf{v}^{(i)})$

19: **return** $\{\mathbf{x}^{(i)'}\}_{i=1}^N$, $(D, V)$

**Algorithm 2 Simple-LIMANS**

Require: Classifier $f$; Learning rate $\rho$; Dataset $\mathcal{T}$; Budget $\delta_p > 0$; Optimizer Optim; Batch size $B$

1: $D = \mathcal{N}(0, \mathbb{I}_{M \times P}); V = \mathcal{N}(0, \mathbb{I}_{P \times M})$

2: **for** $k = 0$ **to** MAXEPOCH **do**

3: loss = 0

4: **for** $(\mathbf{x}^{(i)}, y^{(i)}) \subset \mathcal{T}$ **do**

5: noise$^{(i)} = D\mathbf{v}^{(i)}$

6: $\mathbf{x}^{(i)'} = \text{proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \frac{\delta_p \text{noise}^{(i)}}{\|\text{noise}^{(i)}\|_p})$

7: $\hat{y}_{adv} = f(\mathbf{x}^{(i)})$; $\hat{y} = f(\mathbf{x}^{(i)})$

8: loss$_i = \mathcal{L}_{\gamma}(\hat{y}_{adv}, \hat{y})$

9: loss = loss + loss$_i$

10: **if** modulo($i$) = $B$ **then**

11: $D \leftarrow \text{Optim}(\nabla_D \text{loss})(\text{Update})$

12: $V \leftarrow \text{Optim}(\nabla_V \text{loss})(\text{Update})$

13: loss = 0

14: **end if**

15: **end for**

16: **end for**

17: $V \leftarrow [\|D_{\bullet,j}\|_p V_{j,\bullet}] \forall j \in \{1, \dots, M\}$

18: $D \leftarrow \text{Proj}_{\{D \mid \|D\|_p = 1\}}(D)$

19: **return** $\{\mathbf{x}^{(i)'}\}_{i=1}^N$, $(D, V)$

By reparametrizing each adversarial attack $\mathbf{x}^{(i)'} = \text{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \delta_p \frac{D\mathbf{v}^{(i)}}{\|D\mathbf{v}^{(i)}\|_p})$, it guarantees that the $\ell_p$-norm of the adversarial noise is at most $\delta_p$ and that $\mathbf{x}^{(i)'} \in \mathcal{X}$, by construction. The proposed algorithmic solution, reported in Algorithm 2, proves to be computationally efficient since it does not require additional hyperparameter tuning, contrary to Regularized-LIMANS.

*Remark 2.* One can determine normalized directions $D$ by solving Problem 4 and, at termination, post-process $D$ by normalizing each of the components.

## 4 Experiments

This section showcases a numerical assessment of LIMANS' efficiency. We present the experimental settings, offer insights, and compare its performance against baseline attacks. Finally, we measure the transferability of the learned adversarial noise space across different classifiers.
**Algorithm 1 Regularized-LIMANS**

Require: Classifier $f$; Learning rate $\rho$; Dataset $\mathcal{T}$; Budget $\delta_p > 0$; Optimizer Optim; Batch size $B$; Parameter $\lambda > 0$

1: $D = \mathcal{N}(0, \mathbb{I}_{M \times P}); V = \mathcal{N}(0, \mathbb{I}_{P \times M})$

2: **for** $k = 0$ to MAXEPOCH **do**

3: loss = 0

4: **for** $(\mathbf{x}^{(i)}, y^{(i)}) \subset \mathcal{T}$ **do**

5: $\mathbf{x}^{(i)'} = \mathbf{x}^{(i)} + D\mathbf{v}^{(i)}$

6: $\hat{y}_{adv} = f(\mathbf{x}^{(i)})$; $\hat{y} = f(\mathbf{x}^{(i)})$

7: $\text{loss}_i = \mathcal{L}_{\gamma}(\hat{y}_{adv}, \hat{y}) + \lambda h_{(\delta_p, p)}(D, \mathbf{v}^{(i)})$

8: loss = loss + loss$_i$

9: **if** modulo($i$) = $B$ **then**

10: $D \leftarrow \text{Optim}(\nabla_D \text{loss})(\text{Update})$

11: $V \leftarrow \text{Optim}(\nabla_V \text{loss})(\text{Update})$

12: $D = \text{Proj}_{\{D \mid \|D\|_p = 1\}}(D)$

13: loss = 0

14: **end if**

15: **end for**

16: **end for**

17: $D\mathbf{v}^{(i)} \leftarrow \text{Proj}_{\{D\mathbf{v} \mid \|D\mathbf{v}\|_p \le \delta\}}(D\mathbf{v}^{(i)})$

18: $\mathbf{x}^{(i)'} \leftarrow \text{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + D\mathbf{v}^{(i)})$

19: **return** $\{\mathbf{x}^{(i)'}\}_{i=1}^N$, $(D, V)$

**Algorithm 2 Simple-LIMANS**

Require: Classifier $f$; Learning rate $\rho$; Dataset $\mathcal{T}$; Budget $\delta_p > 0$; Optimizer Optim; Batch size $B$

1: $D = \mathcal{N}(0, \mathbb{I}_{M \times P}); V = \mathcal{N}(0, \mathbb{I}_{P \times M})$

2: **for** $k = 0$ to MAXEPOCH **do**

3: loss = 0

4: **for** $(\mathbf{x}^{(i)}, y^{(i)}) \subset \mathcal{T}$ **do**

5: noise$^{(i)} = D\mathbf{v}^{(i)}$

6: $\mathbf{x}^{(i)'} = \text{proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \frac{\delta_p \text{noise}^{(i)}}{\|\text{noise}^{(i)}\|_p})$

7: $\hat{y}_{adv} = f(\mathbf{x}^{(i)})$; $\hat{y} = f(\mathbf{x}^{(i)})$

8: loss$_i = \mathcal{L}_{\gamma}(\hat{y}_{adv}, \hat{y})$

9: loss = loss + loss$_i$

10: **if** modulo($i$) = $B$ **then**

11: $D \leftarrow \text{Optim}(\nabla_D \text{loss})(\text{Update})$

12: $V \leftarrow \text{Optim}(\nabla_V \text{loss})(\text{Update})$

13: loss = 0

14: **end if**

15: **end for**

16: **end for**

17: $V \leftarrow [\|D_{\bullet,j}\|_p V_{j,\bullet}] \forall j \in \{1, \dots, M\}$

18: $D \leftarrow \text{Proj}_{\{D \mid \|D\|_p = 1\}}(D)$

19: **return** $\{\mathbf{x}^{(i)'}\}_{i=1}^N$, $(D, V)$

By reparametrizing each adversarial attack $\mathbf{x}^{(i)'} = \text{Proj}_{\mathcal{X}}(\mathbf{x}^{(i)} + \delta_p \frac{D\mathbf{v}^{(i)}}{\|D\mathbf{v}^{(i)}\|_p})$, it guarantees that the $\ell_p$-norm of the adversarial noise is at most $\delta_p$ and that $\mathbf{x}^{(i)'} \in \mathcal{X}$, by construction. The proposed algorithmic solution, reported in Algorithm 2, proves to be computationally efficient since it does not require additional hyperparameter tuning, contrary to Regularized-LIMANS.

*Remark 2.* One can determine normalized directions $D$ by solving Problem 4 and, at termination, post-process $D$ by normalizing each of the components.

# 4 Experiments

This section showcases a numerical assessment of LIMANS' efficiency. We present the experimental settings, offer insights, and compare its performance against baseline attacks. Finally, we measure the transferability of the learned adversarial noise space across different classifiers.
## 4.1 Experimental Settings

Experiments are conducted on two datasets: CIFAR-10[17] and ImageNet [16]. As suggested in [38], we discard the training set, used to train the classifiers, and learn attacks only on the validation set. The latter is split into three parts, the first for learning the adversarial directions, the second for tuning hyperparameters, and the last one for testing.

**CIFAR-10 Experiments.** We use 8000, 1000 and 1000 examples for training, validating and testing, respectively. Attacks are evaluated on four vanilla classifiers (MobileNet-V2, ResNet50, DenseNet121, VGG11) and two robust ones (ResNet-18, WideResNet-34-10) obtained from the RobustBench repository<fnref n="3" />. Experiments are conducted on a GPU Nvidia RTX 2080.

**ImageNet Experiments.** We split into 10000 training examples, 2000 validation examples, and 5000 test examples. Attacks are designed on four vanilla classifiers (ResNet-18, MobileNet-V2, DenseNet121, VGG11) and two robust classifiers<fnref n="3" /> (R-r18 and R-wrn-50-2, equivalent to ResNet-18 and WideResNet-50-2). Experiments are conducted on 4 GPU Volta V100-SXM2-32GB.

**Baseline Attacks.** Specific attacks are crafted by resorting to the TorchAttacks library [15], while universal attacks are implemented using publicly available resources. Additional details concerning LIMANS' attack as well as the hyperparameter selection are provided in the supplementary material. Attack budgets $\delta_p$ are the same as the one used in RobustBench, namely $\delta_\infty = 8/255$ and $\delta_2 = 0.5$ for CIFAR-10 and $\delta_\infty = 4/255$ for ImageNet experiments.

## 4.2 Insights and Attack Performance

In this section, we provide an analysis of the Simple-LIMANS attack (see Algorithm 2) on CIFAR-10. We consider the pre-trained VGG11 with batch normalization [24] and the robust ResNet-18 [28] classifier, referred to as the *Standard Classifier* and *Robust Classifier* respectively.

**Visualisation of Adversarial Directions** Having a linear model of the adversarial noise space allows for visual inspection of the adversarial directions, which is advantageous for understanding the attack behavior. Fig. 3 shows how the learned directions for $M = 5$ exhibit patterns which vary depending on the classifier and the $\ell_p$-norm. Overall, they spotlight recurring patterns in classification such as edges and corners for the $\ell_\infty$ atoms and local spots in the images for $\ell_2$ atoms. In particular, the directions of LIMANS-$\ell_2$ on the robust classifier are reminiscent of Fourier modes. Similar conclusions, detailed in the supplementary material, can be drawn on the MNIST dataset.

**Impact of the Number of Directions** Fig. 4 reports the test fooling rate of $\ell_2$-based attacks<fnref n="4" />. The performance of LIMANS are displayed as functions of the

<footnote n="3">³ https://robustbench.github.io/</footnote>

<footnote n="4">⁴ A similar experiment for $\ell_\infty$-based attacks is reported in the supplementary material.</footnote>
## 4.1 Experimental Settings

Experiments are conducted on two datasets: CIFAR-10[17] and ImageNet [16]. As suggested in [38], we discard the training set, used to train the classifiers, and learn attacks only on the validation set. The latter is split into three parts, the first for learning the adversarial directions, the second for tuning hyperparameters, and the last one for testing.

**CIFAR-10 Experiments.** We use 8000, 1000 and 1000 examples for training, validating and testing, respectively. Attacks are evaluated on four vanilla classifiers (MobileNet-V2, ResNet50, DenseNet121, VGG11) and two robust ones (ResNet-18, WideResNet-34-10) obtained from the RobustBench repository<fnref n="3" />. Experiments are conducted on a GPU Nvidia RTX 2080.

**ImageNet Experiments.** We split into 10000 training examples, 2000 validation examples, and 5000 test examples. Attacks are designed on four vanilla classifiers (ResNet-18, MobileNet-V2, DenseNet121, VGG11) and two robust classifiers<fnref n="3" /> (R-r18 and R-wrn-50-2, equivalent to ResNet-18 and WideResNet-50-2). Experiments are conducted on 4 GPU Volta V100-SXM2-32GB.

**Baseline Attacks.** Specific attacks are crafted by resorting to the TorchAttacks library [15], while universal attacks are implemented using publicly available resources. Additional details concerning LIMANS' attack as well as the hyperparameter selection are provided in the supplementary material. Attack budgets $\delta_p$ are the same as the one used in RobustBench, namely $\delta_\infty = 8/255$ and $\delta_2 = 0.5$ for CIFAR-10 and $\delta_\infty = 4/255$ for ImageNet experiments.

## 4.2 Insights and Attack Performance

In this section, we provide an analysis of the Simple-LIMANS attack (see Algorithm 2) on CIFAR-10. We consider the pre-trained VGG11 with batch normalization [24] and the robust ResNet-18 [28] classifier, referred to as the *Standard Classifier* and *Robust Classifier* respectively.

**Visualisation of Adversarial Directions** Having a linear model of the adversarial noise space allows for visual inspection of the adversarial directions, which is advantageous for understanding the attack behavior. Fig. 3 shows how the learned directions for $M = 5$ exhibit patterns which vary depending on the classifier and the $\ell_p$-norm. Overall, they spotlight recurring patterns in classification such as edges and corners for the $\ell_\infty$ atoms and local spots in the images for $\ell_2$ atoms. In particular, the directions of LIMANS-$\ell_2$ on the robust classifier are reminiscent of Fourier modes. Similar conclusions, detailed in the supplementary material, can be drawn on the MNIST dataset.

**Impact of the Number of Directions** Fig. 4 reports the test fooling rate of $\ell_2$-based attacks<fnref n="4" />. The performance of LIMANS are displayed as functions of the

<footnote n="3">³ https://robustbench.github.io/</footnote>

<footnote n="4">⁴ A similar experiment for $\ell_\infty$-based attacks is reported in the supplementary material.</footnote>
<figure><img src="image_4.png" /><figcaption>Fig. 3: Visualization of the learned universal adversarial directions (atoms of the dictionary $D$) when $M = 5$, on CIFAR-10 and corresponding to the classifier (left) VGG11 and (right) robust ResNet-18. All atoms have been rescaled for display.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 4: **Impact of the number of directions.** Test fooling rate of adversarial attacks under the $\ell_2$ norm constraint ($\delta_2 = 0.5$) on CIFAR-10 test data when fixing a number of atoms $M$, associated to a standard VGG11 classifier (left) and robust ResNet-18 classifier (right).</figcaption></figure>

number of directions $M$. Interestingly, results show that LIMANS consistently outperforms all universal attacks, even with just a single direction, i.e., $M = 1$. In light of the discussion in Section 3.1, this indicates that allowing each individual perturbation to tailor its own multiplicative constant in front of the universal perturbation $D_1$ already permits to yield more efficient attacks. As $M$ increases, LIMANS progressively narrows the performance gap with specific attacks. Between $M = 500$ and $M = 4000$, LIMANS achieves performance akin to state-of-the-art specific attacks. It's noteworthy that all specific attack methods necessitate learning individual perturbations of size $32 \times 32 \times 3 = 3072$ (for RGB CIFAR-10 images) while LIMANS attacks only require to optimize over a coding vector $v$ of dimension $M$.

**Attack Robustness** Attacks, while effective in fooling classifiers, can also be detected by trained detectors. To gauge the robustness of attacks, we employ
<figure><img src="image_4.png" /><figcaption>Fig. 3: Visualization of the learned universal adversarial directions (atoms of the dictionary $D$) when $M = 5$, on CIFAR-10 and corresponding to the classifier (left) VGG11 and (right) robust ResNet-18. All atoms have been rescaled for display.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 4: **Impact of the number of directions.** Test fooling rate of adversarial attacks under the $\ell_2$ norm constraint ($\delta_2 = 0.5$) on CIFAR-10 test data when fixing a number of atoms $M$, associated to a standard VGG11 classifier (left) and robust ResNet-18 classifier (right).</figcaption></figure>

number of directions $M$. Interestingly, results show that LIMANS consistently outperforms all universal attacks, even with just a single direction, i.e., $M = 1$. In light of the discussion in Section 3.1, this indicates that allowing each individual perturbation to tailor its own multiplicative constant in front of the universal perturbation $D_1$ already permits to yield more efficient attacks. As $M$ increases, LIMANS progressively narrows the performance gap with specific attacks. Between $M = 500$ and $M = 4000$, LIMANS achieves performance akin to state-of-the-art specific attacks. It's noteworthy that all specific attack methods necessitate learning individual perturbations of size $32 \times 32 \times 3 = 3072$ (for RGB CIFAR-10 images) while LIMANS attacks only require to optimize over a coding vector $v$ of dimension $M$.

**Attack Robustness** Attacks, while effective in fooling classifiers, can also be detected by trained detectors. To gauge the robustness of attacks, we employ
<table><caption>Table 1: Robustness performance of the LIMANS $\ell_{\infty}$-attack ($\delta_{\infty} = 8/255$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). The smaller the RAUD, the more robust the adversarial attack is. The best performance is marked in black bold font.</caption><thead><tr><th>Detectors d</th><th colspan="2">d<sub>FGSM</sub></th><th colspan="2">d<sub>PGD</sub></th><th colspan="2">d<sub>Autoattack</sub></th><th colspan="2">d<sub>LIMANS<sub>10</sub></sub></th></tr></thead><tbody><tr><td>Classifiers f</td><td>S.C.</td><td>R.C</td><td>S.C.</td><td>R.C</td><td>S.C.</td><td>R.C</td><td>S.C.</td><td>R.C</td></tr><tr><td>SA</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td></tr><tr><td>FGSM</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>83.4</td><td>79.5</td></tr><tr><td>PGD</td><td>90.6</td><td>84.9</td><td>91.1</td><td>85.0</td><td>91.1</td><td>85.1</td><td>55.9</td><td>73.7</td></tr><tr><td>Autoattack</td><td>89.9</td><td>84.6</td><td>90.9</td><td>85.0</td><td>91.1</td><td>85.0</td><td>52.7</td><td>71.5</td></tr><tr><td>LIMANS<sub>10</sub></td><td>75.7</td><td>81.0</td><td>81.0</td><td>80.8</td><td>81.6</td><td>81.0</td><td>88.9</td><td>79.6</td></tr><tr><td>LIMANS<sub>500</sub></td><td>17.5</td><td>71.5</td><td>25.6</td><td>72.2</td><td>31.8</td><td>74.2</td><td>26.6</td><td>69.4</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>15.9</td><td>70.1</td><td>26.1</td><td>70.9</td><td>32.1</td><td>72.5</td><td><b>21.7</b></td><td>68.7</td></tr><tr><td>LIMANS<sub>4000</sub></td><td><b>15.6</b></td><td><b>69.6</b></td><td><b>23.7</b></td><td><b>70.4</b></td><td><b>28.2</b></td><td><b>72.6</b></td><td>31.1</td><td><b>68.4</b></td></tr></tbody></table>

the *Robust Accuracy Under Defense* (RAUD) [20], quantifying the percentage of successful attacks detected. Lower RAUD values indicate greater attack robustness. We provide the RAUD for both LIMANS and specific $\ell_{\infty}$-attacks in Table 1, with $\ell_2$-attack results available in the supplementary material. Notably, LIMANS attacks consistently evade detection, outperforming specific attacks even at $M = 10$ and exhibiting robustness from $M \ge 500$.

## 4.3 Transferability of the Adversarial Noise Space

In [33], it's suggested that decision boundaries of classifiers trained on the same dataset are close. This implies that if LIMANS learns an adversarial space aligned with directions perpendicular to these boundaries, it can transfer effectively between classifiers. Here, we empirically support this claim using Regularized-LIMANS (see Algorithm 1). All attacks are $\ell_{\infty}$-bounded perturbations.

**CIFAR-10 Experiment.** We select $M = 150$ and report the test fooling rates in Table 2. The results validate our intuition: the adversarial directions derived from both ResNet50 and VGG exhibit superior transfer performance compared to state-of-the-art attacks across standard classifiers. Moreover, the efficacy of the LIMANS attack on a target classifier isn't contingent on its performance on the source classifier, but rather on the characteristics of the target classifier. For instance, the fooling rate of the LIMANS specific attack on ResNet is 91.3%. However, when employing the learned LIMANS model to generate adversarial perturbations to deceive MobileNet, its performance improves further to 96.0%. This discrepancy arises because MobileNet is simpler and more susceptible to attacks. Ultimately, through comparative analysis, we deduce that a model trained on a robust classifier is more readily transferable to other classifiers.
<table><caption>Table 1: Robustness performance of the LIMANS $\ell_\infty$-attack ($\delta_\infty = 8/255$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). **The smaller the RAUD, the more robust the adversarial attack is.** The best performance is marked in black bold font.</caption><thead><tr><th>Detectors d</th><th>d<sub>FGSM</sub></th><th>d<sub>PGD</sub></th><th>d<sub>Autoattack</sub></th><th>d<sub>LIMANS<sub>10</sub></sub></th></tr></thead><tbody><tr><td>Classifiers f</td><td>S.C. R.C</td><td>S.C. R.C</td><td>S.C. R.C</td><td>S.C. R.C</td></tr><tr><td>SA</td><td>91.1 85.1</td><td>91.1 85.1</td><td>91.1 85.1</td><td>91.1 85.1</td></tr><tr><td>FGSM</td><td>91.1 85.1</td><td>91.1 85.1</td><td>91.1 85.1</td><td>83.4 79.5</td></tr><tr><td>PGD</td><td>90.6 84.9</td><td>91.1 85.0</td><td>91.1 85.1</td><td>55.9 73.7</td></tr><tr><td>Autoattack</td><td>89.9 84.6</td><td>90.9 85.0</td><td>91.1 85.0</td><td>52.7 71.5</td></tr><tr><td>LIMANS<sub>10</sub></td><td>75.7 81.0</td><td>81.0 80.8</td><td>81.6 81.0</td><td>88.9 79.6</td></tr><tr><td>LIMANS<sub>500</sub></td><td>17.5 71.5</td><td>25.6 72.2</td><td>31.8 74.2</td><td>26.6 69.4</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>15.9 70.1</td><td>26.1 70.9</td><td>32.1 72.5</td><td><b>21.7</b> 68.7</td></tr><tr><td>LIMANS<sub>4000</sub></td><td><b>15.6</b> 69.6</td><td><b>23.7</b> 70.4</td><td><b>28.2</b> 72.6</td><td>31.1 <b>68.4</b></td></tr></tbody></table>

the *Robust Accuracy Under Defense* (RAUD) [20], quantifying the percentage of successful attacks detected. Lower RAUD values indicate greater attack robustness. We provide the RAUD for both LIMANS and specific $\ell_\infty$-attacks in Table 1, with $\ell_2$-attack results available in the supplementary material. Notably, LIMANS attacks consistently evade detection, outperforming specific attacks even at $M = 10$ and exhibiting robustness from $M \ge 500$.

## 4.3 Transferability of the Adversarial Noise Space

In [33], it's suggested that decision boundaries of classifiers trained on the same dataset are close. This implies that if LIMANS learns an adversarial space aligned with directions perpendicular to these boundaries, it can transfer effectively between classifiers. Here, we empirically support this claim using Regularized-LIMANS (see Algorithm 1). All attacks are $\ell_\infty$-bounded perturbations.

**CIFAR-10 Experiment.** We select $M = 150$ and report the test fooling rates in Table 2. The results validate our intuition: the adversarial directions derived from both ResNet50 and VGG exhibit superior transfer performance compared to state-of-the-art attacks across standard classifiers. Moreover, the efficacy of the LIMANS attack on a target classifier isn't contingent on its performance on the source classifier, but rather on the characteristics of the target classifier. For instance, the fooling rate of the LIMANS specific attack on ResNet is 91.3%. However, when employing the learned LIMANS model to generate adversarial perturbations to deceive MobileNet, its performance improves further to 96.0%. This discrepancy arises because MobileNet is simpler and more susceptible to attacks. Ultimately, through comparative analysis, we deduce that a model trained on a robust classifier is more readily transferable to other classifiers.
<table><caption>Table 2: Performance of $\ell_\infty$-attacks on CIFAR-10 ($\delta_\infty = 8/255$), in terms of FR, where the left column lists the source classifiers and the first line presents the target classifiers. The best results of transferability are marked in red bold style. That of the specific attacks are shown in blue bold style.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">ResNet50</td><td>AutoAttack</td><td>63.3</td><td>100</td><td>54.6</td><td>25.1</td><td>1.2</td><td>2.4</td></tr><tr><td>VNI-FGSM</td><td>78.3</td><td>95.9</td><td>80.3</td><td>57.2</td><td>2.7</td><td>2.1</td></tr><tr><td>NAA</td><td>50.7</td><td>64.7</td><td>22.9</td><td>18.4</td><td>1.4</td><td>2.1</td></tr><tr><td>RAP</td><td>49.0</td><td>75.1</td><td>52.5</td><td>35.4</td><td>1.6</td><td>2.8</td></tr><tr><td>Ours</td><td>96.0</td><td>91.3</td><td>81.8</td><td>82.1</td><td>11.7</td><td>13.2</td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>62.5</td><td>43.0</td><td>44.0</td><td>100</td><td>2.7</td><td>2.7</td></tr><tr><td>VNI-FGSM</td><td>69.3</td><td>62.6</td><td>61.4</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>NAA</td><td>42.3</td><td>14.5</td><td>1.8</td><td>71.6</td><td>1.6</td><td>1.2</td></tr><tr><td>RAP</td><td>46.5</td><td>39.5</td><td>40.9</td><td>73.8</td><td>3.3</td><td>3.4</td></tr><tr><td>Ours</td><td>97.4</td><td>87.5</td><td>81.5</td><td>91.0</td><td>11.5</td><td>12.6</td></tr></tbody></table>

**ImageNet Experiment.** Due to memory limitations inherent to the large images sizes, we only consider $M = 100$ which may be far from the actual dimension of the underlying adversarial noise space. However, it still offers evidence of transferability, as shown in Table 3. Nevertheless, in the case of robust classifiers, the decision boundaries tend to be more intricate. This complexity results in the inability to close the performance gap with AutoAttack for $M = 100$. Despite this challenge, the LIMANS attack still demonstrates strong performance overall.

# 5 Conclusion

This work introduced LIMANS, a linear model of the adversarial noise space designed to bridge the gap between universal and specific adversarial attacks. This is achieved by framing attacks as specific linear combinations of universal adversarial directions. Additionally, we proposed two implementations: Simple-LIMANS, a parameter-free algorithm, and Regularized-LIMANS, which exhibits greater efficiency when its regularization parameter is appropriately tuned.

Empirical findings demonstrated that adversarial examples generated by LIMANS exhibit enhanced resilience against adversarial example detectors. Furthermore, the study confirmed the transferability of the adversarial noise space across various classifiers. Future research works involve extending its scope to encompass for generating black-box attacks and learning adversarial directions jointly across multiple DNNs. Such a step holds promise for enhancing its universality, efficiency, and alignment with the genuine adversarial threats encountered in practical applications.
<table><caption>Table 2: Performance of $\ell_\infty$-attacks on CIFAR-10 ($\delta_\infty = 8/255$), in terms of FR, where the left column lists the source classifiers and the first line presents the target classifiers. The best results of transferability are marked in red bold style. That of the specific attacks are shown in blue bold style.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">ResNet50</td><td>AutoAttack</td><td>63.3</td><td>100</td><td>54.6</td><td>25.1</td><td>1.2</td><td>2.4</td></tr><tr><td>VNI-FGSM</td><td>78.3</td><td>95.9</td><td>80.3</td><td>57.2</td><td>2.7</td><td>2.1</td></tr><tr><td>NAA</td><td>50.7</td><td>64.7</td><td>22.9</td><td>18.4</td><td>1.4</td><td>2.1</td></tr><tr><td>RAP</td><td>49.0</td><td>75.1</td><td>52.5</td><td>35.4</td><td>1.6</td><td>2.8</td></tr><tr><td>Ours</td><td>96.0</td><td>91.3</td><td>81.8</td><td>82.1</td><td>11.7</td><td>13.2</td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>62.5</td><td>43.0</td><td>44.0</td><td>100</td><td>2.7</td><td>2.7</td></tr><tr><td>VNI-FGSM</td><td>69.3</td><td>62.6</td><td>61.4</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>NAA</td><td>42.3</td><td>14.5</td><td>1.8</td><td>71.6</td><td>1.6</td><td>1.2</td></tr><tr><td>RAP</td><td>46.5</td><td>39.5</td><td>40.9</td><td>73.8</td><td>3.3</td><td>3.4</td></tr><tr><td>Ours</td><td>97.4</td><td>87.5</td><td>81.5</td><td>91.0</td><td>11.5</td><td>12.6</td></tr></tbody></table>

**ImageNet Experiment.** Due to memory limitations inherent to the large images sizes, we only consider $M = 100$ which may be far from the actual dimension of the underlying adversarial noise space. However, it still offers evidence of transferability, as shown in Table 3. Nevertheless, in the case of robust classifiers, the decision boundaries tend to be more intricate. This complexity results in the inability to close the performance gap with AutoAttack for $M = 100$. Despite this challenge, the LIMANS attack still demonstrates strong performance overall.

## 5 Conclusion

This work introduced LIMANS, a linear model of the adversarial noise space designed to bridge the gap between universal and specific adversarial attacks. This is achieved by framing attacks as specific linear combinations of universal adversarial directions. Additionally, we proposed two implementations: Simple-LIMANS, a parameter-free algorithm, and Regularized-LIMANS, which exhibits greater efficiency when its regularization parameter is appropriately tuned.

Empirical findings demonstrated that adversarial examples generated by LIMANS exhibit enhanced resilience against adversarial example detectors. Furthermore, the study confirmed the transferability of the adversarial noise space across various classifiers. Future research works involve extending its scope to encompass for generating black-box attacks and learning adversarial directions jointly across multiple DNNs. Such a step holds promise for enhancing its universality, efficiency, and alignment with the genuine adversarial threats encountered in practical applications.
<table><caption>Table 3: Performance of $\ell_\infty$-attacks on ImageNet ($\delta_\infty = 4/255$), in terms of FR, where the left column lists the source classifiers and the first line presents the target classifiers. The best results of transferability are marked in red bold font. Those of the specific attacks are shown in blue bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet18</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-50-2</th></tr></thead><tbody><tr><td rowspan="5">ResNet18</td><td>AutoAttack</td><td>40.30</td><td>100</td><td>35.76</td><td>34.90</td><td>1.80</td><td>1.34</td></tr><tr><td>VNI-FGSM</td><td>56.74</td><td>99.98</td><td>51.40</td><td>51.42</td><td>2.84</td><td>2.04</td></tr><tr><td>NAA</td><td>22.54</td><td>97.94</td><td>14.84</td><td>19.30</td><td>2.12</td><td>1.20</td></tr><tr><td>RAP</td><td>53.36</td><td>96.74</td><td>51.30</td><td>50.60</td><td>3.80</td><td>3.14</td></tr><tr><td>LIMANS</td><td>59.16</td><td>59.16</td><td>53.14</td><td>48.28</td><td>10.48</td><td>6.62</td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>47.94</td><td>40.06</td><td>32.62</td><td>100</td><td>2.34</td><td>1.42</td></tr><tr><td>VNI-FGSM</td><td>57.98</td><td>53.96</td><td>42.88</td><td>99.84</td><td>2.76</td><td>2.24</td></tr><tr><td>NAA</td><td>19.62</td><td>14.92</td><td>12.18</td><td>79.96</td><td>2.18</td><td>1.40</td></tr><tr><td>RAP</td><td>53.14</td><td>53.12</td><td>42.68</td><td>95.68</td><td>3.48</td><td>2.84</td></tr><tr><td>LIMANS</td><td>57.68</td><td>54.14</td><td>50.04</td><td>51.62</td><td>10.68</td><td>6.24</td></tr><tr><td rowspan="5">R-r18</td><td>AutoAttack</td><td>13.70</td><td>15.8</td><td>10.82</td><td>14.60</td><td>71.74</td><td>10.78</td></tr><tr><td>VNI-FGSM</td><td>16.14</td><td>17.66</td><td>12.48</td><td>16.08</td><td>63.22</td><td>11.74</td></tr><tr><td>NAA</td><td>11.46</td><td>10.86</td><td>9.34</td><td>11.42</td><td>21.48</td><td>4.90</td></tr><tr><td>RAP</td><td>11.32</td><td>10.80</td><td>8.16</td><td>10.32</td><td>45.80</td><td>7.94</td></tr><tr><td>LIMANS</td><td>37.14</td><td>33.2</td><td>33.76</td><td>29.90</td><td>29.84</td><td>12.94</td></tr><tr><td rowspan="5">R-50-2</td><td>AutoAttack</td><td>20.14</td><td>22.76</td><td>17.36</td><td>19.44</td><td>15.42</td><td>59.02</td></tr><tr><td>VNI-FGSM</td><td>23.88</td><td>26.22</td><td>19.68</td><td>23.28</td><td>18.00</td><td>52.28</td></tr><tr><td>NAA</td><td>14.08</td><td>13.12</td><td>10.20</td><td>14.04</td><td>9.82</td><td>12.58</td></tr><tr><td>RAP</td><td>13.82</td><td>14.06</td><td>10.52</td><td>13.50</td><td>15.54</td><td>34.10</td></tr><tr><td>LIMANS</td><td>42.18</td><td>42.50</td><td>42.46</td><td>34.22</td><td>23.70</td><td>18.02</td></tr></tbody></table>

References

1. Baluja, S., Fischer, I.: Learning to attack: Adversarial transformation networks. Proceedings of the AAAI Conference on Artificial Intelligence 32(1) (Apr 2018)

2. Benz, P., Zhang, C., Karjauv, A., Kweon, I.S.: Universal adversarial training with class-wise perturbations. In: 2021 IEEE International Conference on Multimedia and Expo (ICME). pp. 1–6. IEEE (2021)

3. Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57 (2017)

4. Chaubey, A., Agrawal, N., Barnwal, K., Guliani, K.K., Mehta, P.: Universal adversarial perturbations: A survey. arXiv preprint arXiv:2005.08087 (2020)

5. Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., Hein, M.: Robustbench: a standardized adversarial robustness benchmark. In: NeurIPS, Datasets and Benchmarks Track (Round 2) (2021)

6. Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: ICML. vol. 119, pp. 2206–2216 (2020)

7. Dohmatob, E., Guo, C., Goibert, M.: Origins of low-dimensional adversarial perturbations. In: Ruiz, F., Dy, J., van de Meent, J.W. (eds.) Proceedings of The 26th
<table><caption>Table 3: Performance of $\ell_\infty$-attacks on ImageNet ($\delta_\infty = 4/255$), in terms of FR, where the left column lists the source classifiers and the first line presents the target classifiers. The best results of transferability are marked in red bold font. Those of the specific attacks are shown in blue bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet18</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-50-2</th></tr></thead><tbody><tr><td rowspan="5">ResNet18</td><td>AutoAttack</td><td>40.30</td><td>100</td><td>35.76</td><td>34.90</td><td>1.80</td><td>1.34</td></tr><tr><td>VNI-FGSM</td><td>56.74</td><td>99.98</td><td>51.40</td><td>51.42</td><td>2.84</td><td>2.04</td></tr><tr><td>NAA</td><td>22.54</td><td>97.94</td><td>14.84</td><td>19.30</td><td>2.12</td><td>1.20</td></tr><tr><td>RAP</td><td>53.36</td><td>96.74</td><td>51.30</td><td>50.60</td><td>3.80</td><td>3.14</td></tr><tr><td>LIMANS</td><td>59.16</td><td>59.16</td><td>53.14</td><td>48.28</td><td>10.48</td><td>6.62</td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>47.94</td><td>40.06</td><td>32.62</td><td>100</td><td>2.34</td><td>1.42</td></tr><tr><td>VNI-FGSM</td><td>57.98</td><td>53.96</td><td>42.88</td><td>99.84</td><td>2.76</td><td>2.24</td></tr><tr><td>NAA</td><td>19.62</td><td>14.92</td><td>12.18</td><td>79.96</td><td>2.18</td><td>1.40</td></tr><tr><td>RAP</td><td>53.14</td><td>53.12</td><td>42.68</td><td>95.68</td><td>3.48</td><td>2.84</td></tr><tr><td>LIMANS</td><td>57.68</td><td>54.14</td><td>50.04</td><td>51.62</td><td>10.68</td><td>6.24</td></tr><tr><td rowspan="5">R-r18</td><td>AutoAttack</td><td>13.70</td><td>15.8</td><td>10.82</td><td>14.60</td><td>71.74</td><td>10.78</td></tr><tr><td>VNI-FGSM</td><td>16.14</td><td>17.66</td><td>12.48</td><td>16.08</td><td>63.22</td><td>11.74</td></tr><tr><td>NAA</td><td>11.46</td><td>10.86</td><td>9.34</td><td>11.42</td><td>21.48</td><td>4.90</td></tr><tr><td>RAP</td><td>11.32</td><td>10.80</td><td>8.16</td><td>10.32</td><td>45.80</td><td>7.94</td></tr><tr><td>LIMANS</td><td>37.14</td><td>33.2</td><td>33.76</td><td>29.90</td><td>29.84</td><td>12.94</td></tr><tr><td rowspan="5">R-50-2</td><td>AutoAttack</td><td>20.14</td><td>22.76</td><td>17.36</td><td>19.44</td><td>15.42</td><td>59.02</td></tr><tr><td>VNI-FGSM</td><td>23.88</td><td>26.22</td><td>19.68</td><td>23.28</td><td>18.00</td><td>52.28</td></tr><tr><td>NAA</td><td>14.08</td><td>13.12</td><td>10.20</td><td>14.04</td><td>9.82</td><td>12.58</td></tr><tr><td>RAP</td><td>13.82</td><td>14.06</td><td>10.52</td><td>13.50</td><td>15.54</td><td>34.10</td></tr><tr><td>LIMANS</td><td>42.18</td><td>42.50</td><td>42.46</td><td>34.22</td><td>23.70</td><td>18.02</td></tr></tbody></table>

References

1. Baluja, S., Fischer, I.: Learning to attack: Adversarial transformation networks. Proceedings of the AAAI Conference on Artificial Intelligence 32(1) (Apr 2018)

2. Benz, P., Zhang, C., Karjauv, A., Kweon, I.S.: Universal adversarial training with class-wise perturbations. In: 2021 IEEE International Conference on Multimedia and Expo (ICME). pp. 1–6. IEEE (2021)

3. Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57 (2017)

4. Chaubey, A., Agrawal, N., Barnwal, K., Guliani, K.K., Mehta, P.: Universal adversarial perturbations: A survey. arXiv preprint arXiv:2005.08087 (2020)

5. Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., Hein, M.: Robustbench: a standardized adversarial robustness benchmark. In: NeurIPS, Datasets and Benchmarks Track (Round 2) (2021)

6. Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: ICML. vol. 119, pp. 2206–2216 (2020)

7. Dohmatob, E., Guo, C., Goibert, M.: Origins of low-dimensional adversarial perturbations. In: Ruiz, F., Dy, J., van de Meent, J.W. (eds.) Proceedings of The 26th
International Conference on Artificial Intelligence and Statistics. Proceedings of Machine Learning Research, vol. 206, pp. 9221-9237. PMLR (25-27 Apr 2023)

8. Fawzi, A., Moosavi-Dezfooli, S.M., Frossard, P., Soatto, S.: Empirical study of the topology and geometry of deep networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 3762-3770 (2018)

9. Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9 (2015)

10. Gupta, K., Kaakai, F., Pesquet-Popescu, B., Pesquet, J.C., Malliaros, F.D.: Multivariate lipschitz analysis of the stability of neural networks. Frontiers in Signal Processing 2 (2022)

11. Harder, P., Pfreundt, F.J., Keuper, M., Keuper, J.: Spectraldefense: Detecting adversarial attacks on cnns in the fourier domain. In: 2021 International Joint Conference on Neural Networks (IJCNN). pp. 1-8. IEEE (2021)

12. Hayes, J., Danezis, G.: Learning universal adversarial perturbations with generative models. In: 2018 IEEE Security and Privacy Workshops (SPW). pp. 43-49. IEEE (2018)

13. Hendrycks, D., Dietterich, T.G.: Benchmarking neural network robustness to common corruptions and perturbations. In: ICLR (2019)

14. Khrulkov, V., Oseledets, I.: Art of singular vectors and universal adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 8562-8570 (2018)

15. Kim, H.: Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950 (2020)

16. Krizhevsky, A., Sutskever, I., Hinton, G.E.: Imagenet classification with deep convolutional neural networks. Communications of the ACM 60(6), 84-90 (2017)

17. Krizhevsky, A., et al.: Learning multiple layers of features from tiny images (2009)

18. Li, Y., Cheng, S., Su, H., Zhu, J.: Defense against adversarial attacks via controlling gradient leaking on embedded manifolds. In: Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVIII 16. pp. 753-769. Springer (2020)

19. Lorenz, P., Strassel, D., Keuper, M., Keuper, J.: Is robustbench/autoattack a suitable benchmark for adversarial robustness? (2021)

20. Lorenz, P., Strassel, D., Keuper, M., Keuper, J.: Is autoattack/autobench a suitable benchmark for adversarial robustness? In: The AAAI-22 Workshop on Adversarial Machine Learning and Beyond (2022)

21. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings (2018)

22. Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1765-1773 (2017)

23. Moosavi-Dezfooli, S., Fawzi, A., Frossard, P.: Deepfool: A simple and accurate method to fool deep neural networks. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016. pp. 2574-2582. IEEE Computer Society (2016)

24. Phan, H.: Pytorch cifar10 (2021). https://doi.org/10.5281/zenodo.4431043

25. Qian, Z., Huang, K., Wang, Q.F., Zhang, X.Y.: A survey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies. Pattern Recognition 131, 108889 (2022)
International Conference on Artificial Intelligence and Statistics. Proceedings of Machine Learning Research, vol. 206, pp. 9221-9237. PMLR (25-27 Apr 2023)

8. Fawzi, A., Moosavi-Dezfooli, S.M., Frossard, P., Soatto, S.: Empirical study of the topology and geometry of deep networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 3762-3770 (2018)

9. Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9 (2015)

10. Gupta, K., Kaakai, F., Pesquet-Popescu, B., Pesquet, J.C., Malliaros, F.D.: Multivariate lipschitz analysis of the stability of neural networks. Frontiers in Signal Processing 2 (2022)

11. Harder, P., Pfreundt, F.J., Keuper, M., Keuper, J.: Spectraldefense: Detecting adversarial attacks on cnns in the fourier domain. In: 2021 International Joint Conference on Neural Networks (IJCNN). pp. 1-8. IEEE (2021)

12. Hayes, J., Danezis, G.: Learning universal adversarial perturbations with generative models. In: 2018 IEEE Security and Privacy Workshops (SPW). pp. 43-49. IEEE (2018)

13. Hendrycks, D., Dietterich, T.G.: Benchmarking neural network robustness to common corruptions and perturbations. In: ICLR (2019)

14. Khrulkov, V., Oseledets, I.: Art of singular vectors and universal adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 8562-8570 (2018)

15. Kim, H.: Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950 (2020)

16. Krizhevsky, A., Sutskever, I., Hinton, G.E.: Imagenet classification with deep convolutional neural networks. Communications of the ACM 60(6), 84-90 (2017)

17. Krizhevsky, A., et al.: Learning multiple layers of features from tiny images (2009)

18. Li, Y., Cheng, S., Su, H., Zhu, J.: Defense against adversarial attacks via controlling gradient leaking on embedded manifolds. In: Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVIII 16. pp. 753-769. Springer (2020)

19. Lorenz, P., Strassel, D., Keuper, M., Keuper, J.: Is robustbench/autoattack a suitable benchmark for adversarial robustness? (2021)

20. Lorenz, P., Strassel, D., Keuper, M., Keuper, J.: Is autoattack/autobench a suitable benchmark for adversarial robustness? In: The AAAI-22 Workshop on Adversarial Machine Learning and Beyond (2022)

21. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings (2018)

22. Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1765-1773 (2017)

23. Moosavi-Dezfooli, S., Fawzi, A., Frossard, P.: Deepfool: A simple and accurate method to fool deep neural networks. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016. pp. 2574-2582. IEEE Computer Society (2016)

24. Phan, H.: Pytorch cifar10 (2021). https://doi.org/10.5281/zenodo.4431043

25. Qian, Z., Huang, K., Wang, Q.F., Zhang, X.Y.: A survey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies. Pattern Recognition 131, 108889 (2022)
26. Qin, Z., Fan, Y., Liu, Y., Shen, L., Zhang, Y., Wang, J., Wu, B.: Boosting the transferability of adversarial attacks with reverse adversarial perturbation. In: NeurIPS (2022)

27. Rakotomamonjy, A.: Direct optimization of the dictionary learning problem. IEEE Transactions on Signal Processing **61**(22), 5495–5506 (2013)

28. Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., Mittal, P.: Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In: ICLR (2022)

29. Shafahi, A., Najibi, M., Xu, Z., Dickerson, J., Davis, L.S., Goldstein, T.: Universal adversarial training. Proceedings of the AAAI Conference on Artificial Intelligence **34**(04), 5636–5643 (Apr 2020)

30. Sra, S.: Scalable nonconvex inexact proximal splitting. In: Pereira, F., Burges, C.J.C., Bottou, L., Weinberger, K.Q. (eds.) Advances in Neural Information Processing Systems. vol. 25. Curran Associates, Inc. (2012)

31. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16 (2014)

32. Tabacof, P., Valle, E.: Exploring the space of adversarial images. In: 2016 international joint conference on neural networks (IJCNN). pp. 426–433. IEEE (2016)

33. Tramèr, F., Papernot, N., Goodfellow, I.J., Boneh, D., Mcdaniel, P.: The space of transferable adversarial examples. ArXiv abs/1704.03453 (2017)

34. Wang, X., He, K.: Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE/CVF CVPR. pp. 1924–1933 (2021)

35. Xiao, C., Li, B., Zhu, J.Y., He, W., Liu, M., Song, D.: Generating adversarial examples with adversarial networks. In: IJCNN. p. 3905–3911. IJCAI’18 (2018)

36. Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF CVPR. pp. 2730–2739 (2019)

37. Zhang, C., Benz, P., Imtiaz, T., Kweon, I.S.: CD-UAP: Class discriminative universal adversarial perturbation. Proceedings of the AAAI Conference on Artificial Intelligence **34**(04), 6754–6761 (Apr 2020)

38. Zhang, C., Benz, P., Lin, C., Karjauv, A., Wu, J., Kweon, I.S.: A survey on universal adversarial attack. In: IJCAI-21. pp. 4687–4694 (8 2021), survey Track

39. Zhang, J., Wu, W., Huang, J.t., Huang, Y., Wang, W., Su, Y., Lyu, M.R.: Improving adversarial transferability via neuron attribution-based attacks. In: IEEE/CVF CVPR. pp. 14993–15002 (2022)

40. Zhang, Y., Tian, X., Li, Y., Wang, X., Tao, D.: Principal component adversarial example. IEEE Transactions on Image Processing **29**, 4804–4815 (2020)
26. Qin, Z., Fan, Y., Liu, Y., Shen, L., Zhang, Y., Wang, J., Wu, B.: Boosting the transferability of adversarial attacks with reverse adversarial perturbation. In: NeurIPS (2022)

27. Rakotomamonjy, A.: Direct optimization of the dictionary learning problem. IEEE Transactions on Signal Processing **61**(22), 5495–5506 (2013)

28. Sehwag, V., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chiang, M., Mittal, P.: Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In: ICLR (2022)

29. Shafahi, A., Najibi, M., Xu, Z., Dickerson, J., Davis, L.S., Goldstein, T.: Universal adversarial training. Proceedings of the AAAI Conference on Artificial Intelligence **34**(04), 5636–5643 (Apr 2020)

30. Sra, S.: Scalable nonconvex inexact proximal splitting. In: Pereira, F., Burges, C.J.C., Bottou, L., Weinberger, K.Q. (eds.) Advances in Neural Information Processing Systems. vol. 25. Curran Associates, Inc. (2012)

31. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16 (2014)

32. Tabacof, P., Valle, E.: Exploring the space of adversarial images. In: 2016 international joint conference on neural networks (IJCNN). pp. 426–433. IEEE (2016)

33. Tramèr, F., Papernot, N., Goodfellow, I.J., Boneh, D., Mcdaniel, P.: The space of transferable adversarial examples. ArXiv abs/1704.03453 (2017)

34. Wang, X., He, K.: Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE/CVF CVPR. pp. 1924–1933 (2021)

35. Xiao, C., Li, B., Zhu, J.Y., He, W., Liu, M., Song, D.: Generating adversarial examples with adversarial networks. In: IJCNN. p. 3905–3911. IJCAI’18 (2018)

36. Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF CVPR. pp. 2730–2739 (2019)

37. Zhang, C., Benz, P., Imtiaz, T., Kweon, I.S.: CD-UAP: Class discriminative universal adversarial perturbation. Proceedings of the AAAI Conference on Artificial Intelligence **34**(04), 6754–6761 (Apr 2020)

38. Zhang, C., Benz, P., Lin, C., Karjauv, A., Wu, J., Kweon, I.S.: A survey on universal adversarial attack. In: IJCAI-21. pp. 4687–4694 (8 2021), survey Track

39. Zhang, J., Wu, W., Huang, J.t., Huang, Y., Wang, W., Su, Y., Lyu, M.R.: Improving adversarial transferability via neuron attribution-based attacks. In: IEEE/CVF CVPR. pp. 14993–15002 (2022)

40. Zhang, Y., Tian, X., Li, Y., Wang, X., Tao, D.: Principal component adversarial example. IEEE Transactions on Image Processing **29**, 4804–4815 (2020)
## A Adversarial Detector

Regarding the design of an adversarial examples' detector, we followed the guidelines proposed by [19] and [11]. In these two works, authors propose to use a random forest binary classifier with at least 100 trees, in the Fourier domain either of the input images or of the Fourier Features of Feature-Maps from the images. Authors showed that by using either one of the inputs, the random forest binary classifier is able to discriminate with high precision adversarial example computed from state-of-the-art specific adversarial attacks on several complex datasets such as CIFAR-10, CIFAR-100, ImageNet or Celeba. In order to lower as much as possible the bias introduced by the detector, we chose to use a random forest binary classifier with 300 trees in the Fourier domain of the input images. Our choice has been confirmed by extensive experiments reported in Table 4.

<table><caption>Table 4: Confusion matrices of the detectors used to compute the RAUD table from the main paper. All detectors have been trained on the same training dataset as the one used in the training of LIMANS and the displayed values of computed over the validation dataset, such that fair performances are considered. TN: True Negative, FP: False Positive, FN: False Negative, TP: True Positive.</caption><thead><tr><th></th><th>Detectors d</th><th>d<sub>FGSM</sub></th><th>d<sub>PGD</sub></th><th>d<sub>Autoattack</sub></th><th>d<sub>LIMANS<sub>10</sub></sub></th></tr></thead><tbody><tr><td rowspan="2">Confusion Matrix</td><td>TN FP</td><td>863 57</td><td>814 106</td><td>790 130</td><td>846 74</td></tr><tr><td>FN TP</td><td>0 920</td><td>0 920</td><td>0 920</td><td>95 825</td></tr><tr><td colspan="2">Accuracy</td><td>96.9 %</td><td>94.2 %</td><td>92.9 %</td><td>90.8 %</td></tr><tr><td colspan="2">Precision</td><td>94.1 %</td><td>89.6 %</td><td>87.6 %</td><td>91.7 %</td></tr></tbody></table>

Indeed, Table 4 illustrates the confusion matrix of the detectors involved in the RAUD table of the main paper. These detectors were trained on the same dataset as LIMANS and the values displayed are computed over the validation dataset. The RAUD metric for various adversarial attacks using the detector is performed on the unseen test dataset, ensuring fairness.

We empirically observe highly effective detectors that discriminate real images from adversarial ones with high accuracy, minimizing False-Positive and False-Negative values. These robust performances instill confidence in utilizing these detectors for the RAUD metric, crucial for evaluating the harmfulness and transferability of adversarial attacks.

## B Experimental Details

This section presents the details of the different implementations used in both the Simple-LIMANS and Regularized-LIMANS' experiments.
## A Adversarial Detector

Regarding the design of an adversarial examples' detector, we followed the guidelines proposed by [19] and [11]. In these two works, authors propose to use a random forest binary classifier with at least 100 trees, in the Fourier domain either of the input images or of the Fourier Features of Feature-Maps from the images. Authors showed that by using either one of the inputs, the random forest binary classifier is able to discriminate with high precision adversarial example computed from state-of-the-art specific adversarial attacks on several complex datasets such as CIFAR-10, CIFAR-100, ImageNet or Celeba. In order to lower as much as possible the bias introduced by the detector, we chose to use a random forest binary classifier with 300 trees in the Fourier domain of the input images. Our choice has been confirmed by extensive experiments reported in Table 4.

<table><caption>Table 4: Confusion matrices of the detectors used to compute the RAUD table from the main paper. All detectors have been trained on the same training dataset as the one used in the training of LIMANS and the displayed values of computed over the validation dataset, such that fair performances are considered. TN: True Negative, FP: False Positive, FN: False Negative, TP: True Positive.</caption><thead><tr><th></th><th>Detectors d</th><th>d<sub>FGSM</sub></th><th>d<sub>PGD</sub></th><th>d<sub>Autoattack</sub></th><th>d<sub>LIMANS<sub>10</sub></sub></th></tr></thead><tbody><tr><td rowspan="2">Confusion Matrix</td><td>TN FP</td><td>863 57</td><td>814 106</td><td>790 130</td><td>846 74</td></tr><tr><td>FN TP</td><td>0 920</td><td>0 920</td><td>0 920</td><td>95 825</td></tr><tr><td colspan="2">Accuracy</td><td>96.9 %</td><td>94.2 %</td><td>92.9 %</td><td>90.8 %</td></tr><tr><td colspan="2">Precision</td><td>94.1 %</td><td>89.6 %</td><td>87.6 %</td><td>91.7 %</td></tr></tbody></table>

Indeed, Table 4 illustrates the confusion matrix of the detectors involved in the RAUD table of the main paper. These detectors were trained on the same dataset as LIMANS and the values displayed are computed over the validation dataset. The RAUD metric for various adversarial attacks using the detector is performed on the unseen test dataset, ensuring fairness.

We empirically observe highly effective detectors that discriminate real images from adversarial ones with high accuracy, minimizing False-Positive and False-Negative values. These robust performances instill confidence in utilizing these detectors for the RAUD metric, crucial for evaluating the harmfulness and transferability of adversarial attacks.

## B Experimental Details

This section presents the details of the different implementations used in both the Simple-LIMANS and Regularized-LIMANS' experiments.
## B.1 Simple-LIMANS

**Modeling Details** Simple-LIMANS algorithms operate a relaxation on the definition of the adversarial noise. Given the original example $\mathbf{x}^{(i)}$, Simple-LIMANS consider its adversarial noise as $\epsilon^{(i)} = D\mathbf{v}^{(i)} + \mathbf{b}$ the product of the universal adversarial noise model $D$ with its corresponding coding vector $\mathbf{v}^{(i)}$, to which is added the offset $\mathbf{b}$ universal to all LIMANS adversarial noises.

**Algorithmic Parameters** The learning rate is managed automatically using a scheduler to reduce the learning rate when the loss plateaus. Initially, a high learning rate is used to avoid poor local minima caused by random initialization. As optimization progresses, the learning rate decreases, allowing the parameters to converge to a better minimum. The parameters of the scheduler are: patience=40, factor=0.1, and threshold=0.1.

All Simple-LIMANS experiments were optimized using the Adam optimizer. Among several optimizers tested, Adam was found to be the most effective, as illustrated in Figure 5. While similar performance levels can be achieved with alternative optimizers like RMSProp, the Adam optimizer or one of its variants emerges as a compelling optimization choice overall.

As depicted in Figure 5, the batch size $B$ is not a highly sensitive hyper-parameter when using Simple-LIMANS. We observed that varying batch sizes often led to similar performance outcomes, with differences primarily affecting computational time. Accordingly, we set the batch size $B$ to 256 during training and 64 during inference in our experiments.

<figure><img src="image_6.png" /><figcaption>Fig. 5: Evolution of LIMANS$_{10}$ training loss according to (left) different optimizers and (right) different batch sizes $B$ using the Simple-LIMANS algorithm on the standard classifier under the $\ell_\infty$ norm.</figcaption></figure>

## B.2 Regularized-LIMANS

**Hyperparameters** Figure 6 illustrates the influence of the hyperparameter $\lambda$ and the number of atoms $M$ on attack performance. Increasing $M$ appropriately leads to improved performance, consistent with the findings presented in the
## B.1 Simple-LIMANS

**Modeling Details** Simple-LIMANS algorithms operate a relaxation on the definition of the adversarial noise. Given the original example $\mathbf{x}^{(i)}$, Simple-LIMANS consider its adversarial noise as $\epsilon^{(i)} = D\mathbf{v}^{(i)} + \mathbf{b}$ the product of the universal adversarial noise model $D$ with its corresponding coding vector $\mathbf{v}^{(i)}$, to which is added the offset $\mathbf{b}$ universal to all LIMANS adversarial noises.

**Algorithmic Parameters** The learning rate is managed automatically using a scheduler to reduce the learning rate when the loss plateaus. Initially, a high learning rate is used to avoid poor local minima caused by random initialization. As optimization progresses, the learning rate decreases, allowing the parameters to converge to a better minimum. The parameters of the scheduler are: patience=40, factor=0.1, and threshold=0.1.

All Simple-LIMANS experiments were optimized using the Adam optimizer. Among several optimizers tested, Adam was found to be the most effective, as illustrated in Figure 5. While similar performance levels can be achieved with alternative optimizers like RMSProp, the Adam optimizer or one of its variants emerges as a compelling optimization choice overall.

As depicted in Figure 5, the batch size $B$ is not a highly sensitive hyper-parameter when using Simple-LIMANS. We observed that varying batch sizes often led to similar performance outcomes, with differences primarily affecting computational time. Accordingly, we set the batch size $B$ to 256 during training and 64 during inference in our experiments.

<figure><img src="image_6.png" /><figcaption>Fig. 5: Evolution of LIMANS$_{10}$ training loss according to (left) different optimizers and (right) different batch sizes $B$ using the Simple-LIMANS algorithm on the standard classifier under the $\ell_\infty$ norm.</figcaption></figure>

## B.2 Regularized-LIMANS

**Hyperparameters** Figure 6 illustrates the influence of the hyperparameter $\lambda$ and the number of atoms $M$ on attack performance. Increasing $M$ appropriately leads to improved performance, consistent with the findings presented in the
paper. In our experiments, to strike a balance between attack performance and memory constraints, we choose M = 150 for CIFAR-10 and M = 100 for ImageNet. Moreover, for $p = \infty$, setting $\lambda = 1$ yields optimal performance, while $\lambda = 0.1$ is suitable for $p = 2$. This conclusion holds true when extrapolated to other classifiers, as depicted in Table 5.

**Algorithmic Parameters** The learning rate $\rho$ is fixed to 0.001. In the training phase, we set the number of iterations to MAXEPOCH=1000 while, in the validation and the test phases, MAXEPOCH is set 150 when $p = 2$ and 300 when $p = \infty$.

<figure><img src="image_7.png" /><figcaption>Fig. 6: Performance of LIMANS (left) $\ell_\infty$-attacks and (right) $\ell_2$-attacks on CIFAR-10 when attacking VGG, under different settings of hyperparameter in Regularized LIMANS $\lambda$, and different number of atoms M.</figcaption></figure>

<table><caption>Table 5: Performance of LIMANS attacks on CIFAR-10, in terms of FR, when the number of atoms M = 150. The best results are marked in red bold style.</caption><thead><tr><th rowspan="2">λ</th><th colspan="3">Classifiers</th><th colspan="3">ℓ<sub>∞</sub>-attack</th><th colspan="3">ℓ<sub>2</sub>-attack</th></tr><tr><th></th><th></th><th></th><th>VGG</th><th>MobileNet</th><th>R-R18</th><th>VGG</th><th>MobileNet</th><th>R-R18</th></tr></thead><tbody><tr><td>0.1</td><td></td><td></td><td>73.2</td><td>85.3</td><td>15.8</td><td><span style="color:red;">71.7</span></td><td><span style="color:red;">95.4</span></td><td><span style="color:red;">17.6</span></td></tr><tr><td>1.0</td><td></td><td></td><td><span style="color:red;">91.0</span></td><td><span style="color:red;">97.3</span></td><td><span style="color:red;">25.3</span></td><td>45.4</td><td>49.6</td><td>12.8</td></tr><tr><td>10</td><td></td><td></td><td>46.1</td><td>91.7</td><td>19.9</td><td>13.6</td><td>24.4</td><td>10.3</td></tr></tbody></table>

**Classifiers** To assess the transferability of the adversarial noise space, we conducted experiments on CIFAR-10 using five vanilla DNNs (MobileNet, Inception, ResNet, DenseNet, VGG) and two robust DNNs (Robust ResNet18, Robust WideResNet-34-10). Their respective accuracies are 94.00% (MobileNet), 94.10% (Inception), 93.2% (ResNet), 92.8% (DenseNet), 92.1% (VGG), 82.3% (Robust ResNet18), and 85.1% (Robust WideResNet-34-10). For ImageNet, Inception
paper. In our experiments, to strike a balance between attack performance and memory constraints, we choose M = 150 for CIFAR-10 and M = 100 for ImageNet. Moreover, for $p = \infty$, setting $\lambda = 1$ yields optimal performance, while $\lambda = 0.1$ is suitable for $p = 2$. This conclusion holds true when extrapolated to other classifiers, as depicted in Table 5.

**Algorithmic Parameters** The learning rate $\rho$ is fixed to 0.001. In the training phase, we set the number of iterations to MAXEPOCH=1000 while, in the validation and the test phases, MAXEPOCH is set 150 when $p = 2$ and 300 when $p = \infty$.

<figure><img src="image_7.png" /><figcaption>Fig. 6: Performance of LIMANS (left) $\ell_\infty$-attacks and (right) $\ell_2$-attacks on CIFAR-10 when attacking VGG, under different settings of hyperparameter in Regularized LIMANS $\lambda$, and different number of atoms M.</figcaption></figure>

<table><caption>Table 5: Performance of LIMANS attacks on CIFAR-10, in terms of FR, when the number of atoms M = 150. The best results are marked in red bold style.</caption><thead><tr><th rowspan="2">λ</th><th colspan="3">Classifiers</th><th colspan="3">Classifiers</th></tr><tr><th>VGG</th><th>MobileNet</th><th>R-R18</th><th>VGG</th><th>MobileNet</th><th>R-R18</th></tr></thead><tbody><tr><td>0.1</td><td>73.2</td><td>85.3</td><td>15.8</td><td>71.7</td><td>95.4</td><td>17.6</td></tr><tr><td>1.0</td><td>91.0</td><td>97.3</td><td>25.3</td><td>45.4</td><td>49.6</td><td>12.8</td></tr><tr><td>10</td><td>46.1</td><td>91.7</td><td>19.9</td><td>13.6</td><td>24.4</td><td>10.3</td></tr></tbody></table>

**Classifiers** To assess the transferability of the adversarial noise space, we conducted experiments on CIFAR-10 using five vanilla DNNs (MobileNet, Inception, ResNet, DenseNet, VGG) and two robust DNNs (Robust ResNet18, Robust WideResNet-34-10). Their respective accuracies are 94.00% (MobileNet), 94.10% (Inception), 93.2% (ResNet), 92.8% (DenseNet), 92.1% (VGG), 82.3% (Robust ResNet18), and 85.1% (Robust WideResNet-34-10). For ImageNet, Inception
was excluded due to its different input size. All classifiers were obtained from
the PyTorch model zoo and achieved accuracies of 70.95% (MobileNet), 68.20%
(ResNet), 73.65% (DenseNet), 67.60% (VGG), 51.25% (Robust ResNet18), and
66.55% (Robust WideResNet-50-2). In our experiments, each DNN served as the
source classifier to learn the adversarial noise space, and then crafted adversarial
perturbations in this learned space to deceive the other classifiers, which acted
as the target classifiers.
was excluded due to its different input size. All classifiers were obtained from
the PyTorch model zoo and achieved accuracies of 70.95% (MobileNet), 68.20%
(ResNet), 73.65% (DenseNet), 67.60% (VGG), 51.25% (Robust ResNet18), and
66.55% (Robust WideResNet-50-2). In our experiments, each DNN served as the
source classifier to learn the adversarial noise space, and then crafted adversarial
perturbations in this learned space to deceive the other classifiers, which acted
as the target classifiers.
# C Additional Results: “Insights and Attack Performance”

## C.1 Visualisation of Adversarial Directions

By linearly modeling adversarial noise space, we find that LIMANS' directions hold crucial information for deceiving classifiers, akin to capturing semantic essence within the classification space. Additional experiments on the MNIST dataset further illustrate this observation. We present in Figure 7 the *M* = 10 adversarial directions learned to fool a LeNet classifier achieving more than 98.8% of test accuracy.

<figure><img src="image_8.png" /><figcaption>Fig. 7: Visualization of the *M* = 10 universal adversarial directions on MNIST.</figcaption></figure>

In addition to these visually interesting universal directions, we report in Fig.8 how LIMANS operates to specifically craft adversarial perturbations. LIMANS generates significantly more compelling adversarial perturbations compared to state-of-the-art specific adversarial perturbations, which are essentially random. LIMANS strategically targets the most sensitive areas to deceive the classifiers, rendering its adversarial attack far more realistic than state-of-the-art specific adversarial attacks.

<figure><img src="image_9.png" /><figcaption>Fig. 8: Examples of $\ell_2$ adversarial perturbations produced by LIMANS and PGD on the MNIST dataset for a LeNet classifier achieving more than 98.8% of test accuracy.</figcaption></figure>
# C Additional Results: “Insights and Attack Performance”

## C.1 Visualisation of Adversarial Directions

By linearly modeling adversarial noise space, we find that LIMANS' directions hold crucial information for deceiving classifiers, akin to capturing semantic essence within the classification space. Additional experiments on the MNIST dataset further illustrate this observation. We present in Figure 7 the *M* = 10 adversarial directions learned to fool a LeNet classifier achieving more than 98.8% of test accuracy.

<figure><img src="image_8.png" /><figcaption>Fig. 7: Visualization of the *M* = 10 universal adversarial directions on MNIST.</figcaption></figure>

In addition to these visually interesting universal directions, we report in Fig.8 how LIMANS operates to specifically craft adversarial perturbations. LIMANS generates significantly more compelling adversarial perturbations compared to state-of-the-art specific adversarial perturbations, which are essentially random. LIMANS strategically targets the most sensitive areas to deceive the classifiers, rendering its adversarial attack far more realistic than state-of-the-art specific adversarial attacks.

<figure><img src="image_9.png" /><figcaption>Fig. 8: Examples of $\ell_2$ adversarial perturbations produced by LIMANS and PGD on the MNIST dataset for a LeNet classifier achieving more than 98.8% of test accuracy.</figcaption></figure>
## C.2 Impact of the Number of Directions

We present here the performance of the LIMANS attacks as the number of atoms $M$ increases from 1 to 4000. It's worth noting that both the performance on training data, depicted in Figure 10, and on test data, illustrated in Figure 9, indicate that LIMANS attacks are capable of bridging the gap between universal attacks and specific attacks.

<figure><img src="image_10.png" /><figcaption>Fig. 9: Evolution of LIMANS' test fooling rate according to the number of atoms $M$. Both specific and universal adversarial attack baselines are shown. The problem is solved under the $\ell_2$ norm constraint (first line) and $\ell_\infty$ norm constraint (second line) on the standard classifier (left figure) and the robust classifier (right figure) on CIFAR-10 using Simple-LIMANS. On average over 5 random seeds the fooling rates vary around 0.4% of FR for the standard model and around 0.1% of FR for the robust model, errorbars are plotted but so tiny, are invisible.</figcaption></figure>
## C.2 Impact of the Number of Directions

We present here the performance of the LIMANS attacks as the number of atoms $M$ increases from 1 to 4000. It's worth noting that both the performance on training data, depicted in Figure 10, and on test data, illustrated in Figure 9, indicate that LIMANS attacks are capable of bridging the gap between universal attacks and specific attacks.

<figure><img src="image_10.png" /><figcaption>Fig. 9: Evolution of LIMANS' test fooling rate according to the number of atoms $M$. Both specific and universal adversarial attack baselines are shown. The problem is solved under the $\ell_2$ norm constraint (first line) and $\ell_\infty$ norm constraint (second line) on the standard classifier (left figure) and the robust classifier (right figure) on CIFAR-10 using Simple-LIMANS. On average over 5 random seeds the fooling rates vary around 0.4% of FR for the standard model and around 0.1% of FR for the robust model, errorbars are plotted but so tiny, are invisible.</figcaption></figure>
<figure><img src="image_11.png" /><figcaption>Fig. 10: Evolution of LIMANS’ training fooling rate according to the number of atoms M. Both specific and universal adversarial attack baselines are shown. The problem is solved under the $l_2$ norm constraint (first line) and $l_\infty$ norm constraint (second line) on the standard classifier (left figure) and the robust classifier (right figure) on CIFAR-10 using Simple-LIMANS. On average over 5 random seeds the fooling rates vary around 0.4% of FR for the standard model and around 0.1% of FR for the robust model, error bars are plotted but so tiny, are invisible.</figcaption></figure>

### C.3 Robustness of the Attack

Table 6 and Table 7 display the RAUD of Simple-LIMANS and the specific baselines for both the $l_\infty$ and $l_2$ norms, considering various adversarial example detectors d. The RAUD values are accompanied by their standard deviation over 5 different random seeds. These performances are reported for both the standard and robust classifier on the CIFAR-10 dataset.
<figure><img src="image_11.png" /><figcaption>Fig. 10: Evolution of LIMANS’ training fooling rate according to the number of atoms M. Both specific and universal adversarial attack baselines are shown. The problem is solved under the $l_2$ norm constraint (first line) and $l_\infty$ norm constraint (second line) on the standard classifier (left figure) and the robust classifier (right figure) on CIFAR-10 using Simple-LIMANS. On average over 5 random seeds the fooling rates vary around 0.4% of FR for the standard model and around 0.1% of FR for the robust model, error bars are plotted but so tiny, are invisible.</figcaption></figure>

### C.3 Robustness of the Attack

Table 6 and Table 7 display the RAUD of Simple-LIMANS and the specific baselines for both the $l_\infty$ and $l_2$ norms, considering various adversarial example detectors d. The RAUD values are accompanied by their standard deviation over 5 different random seeds. These performances are reported for both the standard and robust classifier on the CIFAR-10 dataset.
<table><caption>Table 6: Robustness performance of the LIMANS $\ell_{\infty}$-attack ($\delta_{\infty} = 8/255$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). **The smaller the RAUD, the more robust the adversarial attack is.** The best performances are marked in bold red.</caption><thead><tr><th>Detectors d</th><th colspan="2">d<sub>PGD</sub></th><th colspan="2">d<sub>Autoattack</sub></th><th colspan="2">d<sub>LIMANS<sub>10</sub></sub></th></tr><tr><th>Classifiers f</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th></tr></thead><tbody><tr><td>SA</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td></tr><tr><td>FGSM</td><td>91.1 ± 0.0</td><td>85.1 ± 0.0</td><td>91.1 ± 0</td><td>85.1 ± 0.0</td><td>89.3 ± 0.0</td><td>79.5 ± 0.0</td></tr><tr><td>PGD</td><td>91.0 ± 0.0</td><td>84.9 ± 0.1</td><td>91.0 ± 0.0</td><td>85.0 ± 0.0</td><td>80.7 ± 0.5</td><td>73.3 ± 0.3</td></tr><tr><td>Autoattack</td><td>91.0 ± 0.0</td><td>85.0 ± 0.0</td><td>91.1 ± 0.0</td><td>85.0 ± 0.0</td><td>78.2 ± 0.3</td><td>71.5 ± 0.3</td></tr><tr><td>LIMANS<sub>10</sub></td><td>78.3 ± 2.4</td><td>79.6 ± 0.0</td><td>81.7 ± 2.0</td><td>8.0 ± 0.0</td><td>86.4 ± 1.6</td><td>79.5 ± 0.1</td></tr><tr><td>LIMANS<sub>500</sub></td><td>26.3 ± 0.3</td><td>71.3 ± 0.1</td><td>32.1 ± 0.4</td><td>73.2 ± 0.2</td><td>36.5 ± 3.1</td><td>69.4 ± 0.2</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>24.7 ± 0.9</td><td>70.4 ± 0.2</td><td>31.6 ± 1.1</td><td>72.4 ± 0.1</td><td>36.9 ± 4.6</td><td>68.5 ± 0.2</td></tr><tr><td>LIMANS<sub>4000</sub></td><td>23.7 ± 0.5</td><td>69.8 ± 0.0</td><td>30.8 ± 0.9</td><td>72.9 ± 0.3</td><td>35.6 ± 2.2</td><td>68.2 ± 0.1</td></tr></tbody></table>

<table><caption>Table 7: Robustness performance of the LIMANS $\ell_2$-attack ($\delta_2 = 0.5$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). **The smaller the RAUD, the more robust the adversarial attack is.** The best performance is marked in red bold font.</caption><thead><tr><th>Detectors d</th><th colspan="2">d<sub>PGD</sub></th><th colspan="2">d<sub>Autoattack</sub></th><th colspan="2">d<sub>LIMANS<sub>10</sub></sub></th></tr><tr><th>Classifiers f</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th></tr></thead><tbody><tr><td>SA</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td></tr><tr><td>PGD</td><td>64.0 ± 1.2</td><td>82.4 ± 0.0</td><td>65.3 ± 0.6</td><td>81.8 ± 0.1</td><td>42.9 ± 0.6</td><td>80.1 ± 0.0</td></tr><tr><td>Autoattack</td><td>63.1 ± 1.1</td><td>82.19 ± 0.1</td><td>65.8 ± 0.6</td><td>81.1 ± 0.2</td><td>42.1 ± 0.3</td><td>79.4 ± 0.0</td></tr><tr><td>LIMANS<sub>10</sub></td><td>83.5 ± 0.5</td><td>87.4 ± 0.1</td><td>82.9 ± 0.4</td><td>88.1 ± 0.0</td><td>86.9 ± 0.9</td><td>87.6 ± 0.1</td></tr><tr><td>LIMANS<sub>500</sub></td><td>62.9 ± 0.2</td><td>84.0 ± 0.4</td><td>64.7 ± 1.0</td><td>83.8 ± 0.3</td><td>51.7 ± 1.3</td><td>81.7 ± 0.1</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>63.7 ± 0.6</td><td>82.7 ± 0.3</td><td>63.6 ± 0.9</td><td>82.6 ± 0.2</td><td>46.8 ± 0.7</td><td>80.1 ± 0.1</td></tr><tr><td>LIMANS<sub>4000</sub></td><td>62.6 ± 1.2</td><td>82.16 ± 0.2</td><td>62.2 ± 0.6</td><td>82.6 ± 0.3</td><td>46.9 ± 0.2</td><td>80.0 ± 0.2</td></tr></tbody></table>
<table><caption>Table 6: Robustness performance of the LIMANS $\ell_\infty$-attack ($\delta_\infty = 8/255$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). **The smaller the RAUD, the more robust the adversarial attack is.** The best performances are marked in bold red.</caption><thead><tr><th>Detectors d</th><th colspan="2">d<sub>PGD</sub></th><th colspan="2">d<sub>Autoattack</sub></th><th colspan="2">d<sub>LIMANS<sub>10</sub></sub></th></tr><tr><th>Classifiers f</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th></tr></thead><tbody><tr><td>SA</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td></tr><tr><td>FGSM</td><td>91.1 ± 0.0</td><td>85.1 ± 0.0</td><td>91.1 ± 0</td><td>85.1 ± 0.0</td><td>89.3 ± 0.0</td><td>79.5 ± 0.0</td></tr><tr><td>PGD</td><td>91.0 ± 0.0</td><td>84.9 ± 0.1</td><td>91.0 ± 0.0</td><td>85.0 ± 0.0</td><td>80.7 ± 0.5</td><td>73.3 ± 0.3</td></tr><tr><td>Autoattack</td><td>91.0 ± 0.0</td><td>85.0 ± 0.0</td><td>91.1 ± 0.0</td><td>85.0 ± 0.0</td><td>78.2 ± 0.3</td><td>71.5 ± 0.3</td></tr><tr><td>LIMANS<sub>10</sub></td><td>78.3 ± 2.4</td><td>79.6 ± 0.0</td><td>81.7 ± 2.0</td><td>8.0 ± 0.0</td><td>86.4 ± 1.6</td><td>79.5 ± 0.1</td></tr><tr><td>LIMANS<sub>500</sub></td><td>26.3 ± 0.3</td><td>71.3 ± 0.1</td><td>32.1 ± 0.4</td><td>73.2 ± 0.2</td><td>36.5 ± 3.1</td><td>69.4 ± 0.2</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>24.7 ± 0.9</td><td>70.4 ± 0.2</td><td>31.6 ± 1.1</td><td>72.4 ± 0.1</td><td>36.9 ± 4.6</td><td>68.5 ± 0.2</td></tr><tr><td>LIMANS<sub>4000</sub></td><td>23.7 ± 0.5</td><td>69.8 ± 0.0</td><td>30.8 ± 0.9</td><td>72.9 ± 0.3</td><td>35.6 ± 2.2</td><td>68.2 ± 0.1</td></tr></tbody></table>

<table><caption>Table 7: Robustness performance of the LIMANS $\ell_2$-attack ($\delta_2 = 0.5$) in terms of RAUD on the CIFAR-10 test data and against the attack detectors plugged in both standard classifier (S.C.) and robust classifier (R.C.). **The smaller the RAUD, the more robust the adversarial attack is.** The best performance is marked in red bold font.</caption><thead><tr><th>Detectors d</th><th colspan="2">d<sub>PGD</sub></th><th colspan="2">d<sub>Autoattack</sub></th><th colspan="2">d<sub>LIMANS<sub>10</sub></sub></th></tr><tr><th>Classifiers f</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th><th>S.C.</th><th>R.C</th></tr></thead><tbody><tr><td>SA</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td><td>91.1</td><td>85.1</td></tr><tr><td>PGD</td><td>64.0 ± 1.2</td><td>82.4 ± 0.0</td><td>65.3 ± 0.6</td><td>81.8 ± 0.1</td><td>42.9 ± 0.6</td><td>80.1 ± 0.0</td></tr><tr><td>Autoattack</td><td>63.1 ± 1.1</td><td>82.19 ± 0.1</td><td>65.8 ± 0.6</td><td>81.1 ± 0.2</td><td>42.1 ± 0.3</td><td>79.4 ± 0.0</td></tr><tr><td>LIMANS<sub>10</sub></td><td>83.5 ± 0.5</td><td>87.4 ± 0.1</td><td>82.9 ± 0.4</td><td>88.1 ± 0.0</td><td>86.9 ± 0.9</td><td>87.6 ± 0.1</td></tr><tr><td>LIMANS<sub>500</sub></td><td>62.9 ± 0.2</td><td>84.0 ± 0.4</td><td>64.7 ± 1.0</td><td>83.8 ± 0.3</td><td>51.7 ± 1.3</td><td>81.7 ± 0.1</td></tr><tr><td>LIMANS<sub>1000</sub></td><td>63.7 ± 0.6</td><td>82.7 ± 0.3</td><td>63.6 ± 0.9</td><td>82.6 ± 0.2</td><td>46.8 ± 0.7</td><td>80.1 ± 0.1</td></tr><tr><td>LIMANS<sub>4000</sub></td><td>62.6 ± 1.2</td><td>82.16 ± 0.2</td><td>62.2 ± 0.6</td><td>82.6 ± 0.3</td><td>46.9 ± 0.2</td><td>80.0 ± 0.2</td></tr></tbody></table>
## D Additional results: “Transferability of the Adversarial Noise Space”

In this section, we present additional findings concerning the transferability of the adversarial noise space. Consistent with our paper, the learned space under LIMANS $l_{\infty}$-attack demonstrates robust transferability across different classifiers, as corroborated by the results in Table 9 (part 1) and Table 8 (part 2), as well as Table 11. Additionally, the adversarial noise space acquired using the LIMANS $l_2$-attack also exhibits transferability, as depicted in Table 10.

<table><caption>Table 8: Transferability performance of the LIMANS $l_{\infty}$-attacks on CIFAR-10 ($\epsilon = 8/255$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font: Part 2.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">AutoAttack</td><td>UAP</td><td>12.4</td><td>9.9</td><td>6.6</td><td>5.3</td><td>4.4</td><td>1.7</td><td>1.3</td></tr><tr><td>UAPGD</td><td>27.0</td><td>21.5</td><td>12.9</td><td>11.7</td><td>13.1</td><td>2.5</td><td>2.6</td></tr><tr><td>TI-FGSM</td><td>7.9</td><td>6.6</td><td>6.8</td><td>7.7</td><td>8.3</td><td>17.2</td><td>21.2</td></tr><tr><td>VMI-FGSM</td><td>26.8</td><td>25.2</td><td>26.1</td><td>24.3</td><td>26</td><td>26.3</td><td>32.3</td></tr><tr><td>VNI-FGSM</td><td>30.0</td><td>27.7</td><td>28.6</td><td>26.3</td><td>27.4</td><td>26.7</td><td>32.1</td></tr><tr><td rowspan="3">R-wrn-34-10</td><td>NAA</td><td>13.7</td><td>11.3</td><td>10.1</td><td>10.5</td><td>11.4</td><td>9.7</td><td>15.5</td></tr><tr><td>RAP</td><td>11.5</td><td>9.4</td><td>7.7</td><td>7.7</td><td>8.4</td><td>1.5</td><td>19.5</td></tr><tr><td>Ours</td><td>84.9</td><td>76.6</td><td>72.8</td><td>68.9</td><td>64.0</td><td>23.2</td><td>21.6</td></tr></tbody></table>
D Additional results: “Transferability of the Adversarial Noise Space”

In this section, we present additional findings concerning the transferability of the adversarial noise space. Consistent with our paper, the learned space under LIMANS $l_{\infty}$-attack demonstrates robust transferability across different classifiers, as corroborated by the results in Table 9 (part 1) and Table 8 (part 2), as well as Table 11. Additionally, the adversarial noise space acquired using the LIMANS $l_2$-attack also exhibits transferability, as depicted in Table 10.

<table><caption>Table 8: Transferability performance of the LIMANS $l_{\infty}$-attacks on CIFAR-10 ($\epsilon = 8/255$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font: Part 2.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">AutoAttack</td><td>UAP</td><td>12.4</td><td>9.9</td><td>6.6</td><td>5.3</td><td>4.4</td><td>1.7</td><td>1.3</td></tr><tr><td>UAPGD</td><td>27.0</td><td>21.5</td><td>12.9</td><td>11.7</td><td>13.1</td><td>2.5</td><td>2.6</td></tr><tr><td>TI-FGSM</td><td>7.9</td><td>6.6</td><td>6.8</td><td>7.7</td><td>8.3</td><td>17.2</td><td>21.2</td></tr><tr><td>VMI-FGSM</td><td>26.8</td><td>25.2</td><td>26.1</td><td>24.3</td><td>26</td><td>26.3</td><td>32.3</td></tr><tr><td>VNI-FGSM</td><td>30.0</td><td>27.7</td><td>28.6</td><td>26.3</td><td>27.4</td><td>26.7</td><td>32.1</td></tr><tr><td rowspan="3">R-wrn-34-10</td><td>NAA</td><td>13.7</td><td>11.3</td><td>10.1</td><td>10.5</td><td>11.4</td><td>9.7</td><td>15.5</td></tr><tr><td>RAP</td><td>11.5</td><td>9.4</td><td>7.7</td><td>7.7</td><td>8.4</td><td>1.5</td><td>19.5</td></tr><tr><td>Ours</td><td>84.9</td><td>76.6</td><td>72.8</td><td>68.9</td><td>64.0</td><td>23.2</td><td>21.6</td></tr></tbody></table>
<table><caption>Table 9: Transferability performance of the LIMANS $\ell_{\infty}$-attacks on CIFAR-10 ($\epsilon = 8/255$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font: Part 1.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="10">MobileNet</td><td>AutoAttack</td><td><strong>100</strong></td><td>87.1</td><td>37.2</td><td>32.8</td><td>22.4</td><td>1.7</td><td>1.5</td></tr><tr><td>UAP</td><td>47.3</td><td>36.1</td><td>9.3</td><td>8.3</td><td>8.7</td><td>1.3</td><td>0.8</td></tr><tr><td>UAPPGD</td><td>86.2</td><td>56.1</td><td>20.5</td><td>19</td><td>21.3</td><td>1.6</td><td>1.5</td></tr><tr><td>TI-FGSM</td><td>87.2</td><td>25.2</td><td>25.9</td><td>29.1</td><td>16.1</td><td>2.1</td><td>2.0</td></tr><tr><td>VMI-FGSM</td><td><strong>100</strong></td><td>87.3</td><td>53.1</td><td>49.8</td><td>38.9</td><td>2.2</td><td>2.5</td></tr><tr><td>VNI-FGSM</td><td><strong>100</strong></td><td>88.1</td><td>54.8</td><td>53.1</td><td>40.7</td><td>2.4</td><td>2.9</td></tr><tr><td>NAA</td><td>72.2</td><td>25.3</td><td>6.8</td><td>5.9</td><td>6.4</td><td>1.3</td><td>1.0</td></tr><tr><td>RAP</td><td>86.7</td><td>60.3</td><td>38.5</td><td>35.7</td><td>25.8</td><td>3.0</td><td>1.6</td></tr><tr><td>Ours</td><td>97.3</td><td><strong>92.2</strong></td><td><strong>73.6</strong></td><td><strong>66.4</strong></td><td><strong>67.7</strong></td><td><strong>10.2</strong></td><td><strong>10.7</strong></td></tr><tr><td rowspan="10">Inception</td><td>AutoAttack</td><td>54.7</td><td><strong>100</strong></td><td>14.7</td><td>12.9</td><td>12.0</td><td>1.2</td><td>1.1</td></tr><tr><td>UAP</td><td>39.2</td><td>32.9</td><td>9.3</td><td>9.7</td><td>9.4</td><td>1.5</td><td>1.1</td></tr><tr><td>UAPPGD</td><td>73.9</td><td>75.5</td><td>26.3</td><td>23.8</td><td>27.3</td><td>2.2</td><td>1.5</td></tr><tr><td>TI-FGSM</td><td>19.7</td><td>60.2</td><td>19.8</td><td>21</td><td>11.4</td><td>2.2</td><td>1.5</td></tr><tr><td>VMI-FGSM</td><td>69.8</td><td>86.1</td><td>40.8</td><td>38.3</td><td>31.3</td><td>2.6</td><td>1.6</td></tr><tr><td>VNI-FGSM</td><td>75.5</td><td>89.5</td><td>44.4</td><td>42.4</td><td>36.3</td><td>3.2</td><td>2.3</td></tr><tr><td>NAA</td><td>38.7</td><td>70.5</td><td>8.4</td><td>8.1</td><td>9.2</td><td>1.1</td><td>1.5</td></tr><tr><td>RAP</td><td>61.9</td><td>90.2</td><td>42.0</td><td>41.7</td><td>30.3</td><td>2.3</td><td>2.7</td></tr><tr><td>Ours</td><td><strong>98</strong></td><td>95.1</td><td><strong>79.6</strong></td><td><strong>73.9</strong></td><td><strong>75.8</strong></td><td><strong>10.7</strong></td><td><strong>10.8</strong></td></tr><tr><td rowspan="10">ResNet50</td><td>AutoAttack</td><td>63.3</td><td>52.6</td><td><strong>100</strong></td><td>54.6</td><td>25.1</td><td>1.2</td><td>2.4</td></tr><tr><td>UAP</td><td>31.4</td><td>23.6</td><td>12.1</td><td>12.5</td><td>11.2</td><td>1.3</td><td>1.7</td></tr><tr><td>UAPPGD</td><td>63.3</td><td>49.4</td><td>39.4</td><td>35.1</td><td>26.1</td><td>1.1</td><td>2.3</td></tr><tr><td>TI-FGSM</td><td>18.4</td><td>17.1</td><td>74.0</td><td>38.5</td><td>20.4</td><td>2.2</td><td>3.0</td></tr><tr><td>VMI-FGSM</td><td>74.9</td><td>75.3</td><td>96.0</td><td>78.1</td><td>53.5</td><td>2.1</td><td>3.2</td></tr><tr><td>VNI-FGSM</td><td>78.3</td><td>76.9</td><td>95.9</td><td>80.3</td><td>57.2</td><td>2.7</td><td>2.1</td></tr><tr><td>NAA</td><td>50.7</td><td>38.6</td><td>64.7</td><td>22.9</td><td>18.4</td><td>1.4</td><td>2.1</td></tr><tr><td>RAP</td><td>49.0</td><td>45.7</td><td>75.1</td><td>52.5</td><td>35.4</td><td>1.6</td><td>2.8</td></tr><tr><td>Ours</td><td><strong>96.0</strong></td><td><strong>92.9</strong></td><td>91.3</td><td><strong>81.8</strong></td><td><strong>82.1</strong></td><td><strong>11.7</strong></td><td><strong>13.2</strong></td></tr><tr><td rowspan="10">DenseNet</td><td>AutoAttack</td><td>56.9</td><td>51.6</td><td>48.8</td><td><strong>100</strong></td><td>21.8</td><td>2.1</td><td>2.0</td></tr><tr><td>UAP</td><td>27.6</td><td>20.6</td><td>10.6</td><td>12.8</td><td>11.4</td><td>1.6</td><td>1.4</td></tr><tr><td>UAPPGD</td><td>61.1</td><td>49.9</td><td>29.3</td><td>47.4</td><td>27.3</td><td>2.7</td><td>2.1</td></tr><tr><td>TI-FGSM</td><td>17.4</td><td>15.8</td><td>26.3</td><td>65.2</td><td>17</td><td>2.9</td><td>2.3</td></tr><tr><td>VMI-FGSM</td><td>73.7</td><td>71.8</td><td>77.2</td><td>93.1</td><td>47.9</td><td>3.3</td><td>3.7</td></tr><tr><td>VNI-FGSM</td><td>78.1</td><td>76.2</td><td>79.5</td><td>94.0</td><td>53.3</td><td>3.5</td><td>4.2</td></tr><tr><td>NAA</td><td>37.2</td><td>31.1</td><td>23.7</td><td>74.9</td><td>12.5</td><td>1.2</td><td>1.5</td></tr><tr><td>RAP</td><td>47.8</td><td>43.5</td><td>48.7</td><td>75.9</td><td>35.6</td><td>3.2</td><td>3.5</td></tr><tr><td>Ours</td><td><strong>96.7</strong></td><td><strong>93.5</strong></td><td><strong>88.4</strong></td><td><strong>85.5</strong></td><td><strong>82.7</strong></td><td><strong>12.3</strong></td><td><strong>13.4</strong></td></tr><tr><td rowspan="10">VGG</td><td>AutoAttack</td><td>62.5</td><td>58.0</td><td>43.0</td><td>44.0</td><td><strong>100</strong></td><td>2.7</td><td>2.7</td></tr><tr><td>UAP</td><td>22.0</td><td>18.4</td><td>10.2</td><td>10.2</td><td>10.0</td><td>1.1</td><td>1.3</td></tr><tr><td>UAPPGD</td><td>63.6</td><td>55.9</td><td>27.6</td><td>29.4</td><td>41.9</td><td>3.1</td><td>2.1</td></tr><tr><td>TI-FGSM</td><td>19.7</td><td>16.7</td><td>25.6</td><td>27.6</td><td>74.4</td><td>3.7</td><td>2.2</td></tr><tr><td>VMI-FGSM</td><td>66.2</td><td>64.2</td><td>57.5</td><td>56.9</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>VNI-FGSM</td><td>69.3</td><td>68</td><td>62.6</td><td>61.4</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>NAA</td><td>42.3</td><td>38.3</td><td>14.5</td><td>1.8</td><td>71.6</td><td>1.6</td><td>1.2</td></tr><tr><td>RAP</td><td>46.5</td><td>44.5</td><td>39.5</td><td>40.9</td><td>73.8</td><td>3.3</td><td>3.4</td></tr><tr><td>Ours</td><td><strong>97.4</strong></td><td><strong>95.1</strong></td><td><strong>87.5</strong></td><td><strong>81.5</strong></td><td><strong>91.0</strong></td><td><strong>11.5</strong></td><td><strong>12.6</strong></td></tr><tr><td rowspan="10">R-r18</td><td>AutoAttack</td><td>17.5</td><td>15.7</td><td>17.2</td><td>15.6</td><td>17.5</td><td><strong>44.3</strong></td><td><strong>23.4</strong></td></tr><tr><td>UAP</td><td>14.5</td><td>9.5</td><td>7.1</td><td>6.4</td><td>7.6</td><td>1.9</td><td>2.6</td></tr><tr><td>UAPPGD</td><td>18.6</td><td>13.3</td><td>9.7</td><td>8.6</td><td>10.5</td><td>3.1</td><td>3.5</td></tr><tr><td>TI-FGSM</td><td>8.4</td><td>5.5</td><td>8.2</td><td>7.8</td><td>8.6</td><td>26.2</td><td>13.1</td></tr><tr><td>VMI-FGSM</td><td>24</td><td>22.9</td><td>24.2</td><td>21.9</td><td>24.8</td><td>38</td><td>22.7</td></tr><tr><td>VNI-FGSM</td><td>27.1</td><td>23.1</td><td>25.4</td><td>23.8</td><td>25.6</td><td>38.1</td><td>22.9</td></tr><tr><td>NAA</td><td>16.2</td><td>11.5</td><td>11.2</td><td>10.4</td><td>10.4</td><td>18.7</td><td>7.2</td></tr><tr><td>RAP</td><td>10.9</td><td>8.4</td><td>7.9</td><td>8.9</td><td>9.7</td><td>23.8</td><td>12.2</td></tr><tr><td>Ours</td><td><strong>81.3</strong></td><td><strong>73.2</strong></td><td><strong>71.7</strong></td><td><strong>68.3</strong></td><td><strong>61.7</strong></td><td><strong>25.3</strong></td><td><strong>21.6</strong></td></tr></tbody></table>
<table><caption>Table 9: Transferability performance of the LIMANS $\ell_{\infty}$-attacks on CIFAR-10 ($\epsilon = 8/255$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font: Part 1.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="10">MobileNet</td><td>AutoAttack</td><td><strong>100</strong></td><td>87.1</td><td>37.2</td><td>32.8</td><td>22.4</td><td>1.7</td><td>1.5</td></tr><tr><td>UAP</td><td>47.3</td><td>36.1</td><td>9.3</td><td>8.3</td><td>8.7</td><td>1.3</td><td>0.8</td></tr><tr><td>UAPPGD</td><td>86.2</td><td>56.1</td><td>20.5</td><td>19</td><td>21.3</td><td>1.6</td><td>1.5</td></tr><tr><td>TI-FGSM</td><td>87.2</td><td>25.2</td><td>25.9</td><td>29.1</td><td>16.1</td><td>2.1</td><td>2.0</td></tr><tr><td>VMI-FGSM</td><td><strong>100</strong></td><td>87.3</td><td>53.1</td><td>49.8</td><td>38.9</td><td>2.2</td><td>2.5</td></tr><tr><td>VNI-FGSM</td><td><strong>100</strong></td><td>88.1</td><td>54.8</td><td>53.1</td><td>40.7</td><td>2.4</td><td>2.9</td></tr><tr><td>NAA</td><td>72.2</td><td>25.3</td><td>6.8</td><td>5.9</td><td>6.4</td><td>1.3</td><td>1.0</td></tr><tr><td>RAP</td><td>86.7</td><td>60.3</td><td>38.5</td><td>35.7</td><td>25.8</td><td>3.0</td><td>1.6</td></tr><tr><td>Ours</td><td>97.3</td><td><strong>92.2</strong></td><td><strong>73.6</strong></td><td><strong>66.4</strong></td><td><strong>67.7</strong></td><td><strong>10.2</strong></td><td><strong>10.7</strong></td></tr><tr><td rowspan="10">Inception</td><td>AutoAttack</td><td>54.7</td><td><strong>100</strong></td><td>14.7</td><td>12.9</td><td>12.0</td><td>1.2</td><td>1.1</td></tr><tr><td>UAP</td><td>39.2</td><td>32.9</td><td>9.3</td><td>9.7</td><td>9.4</td><td>1.5</td><td>1.1</td></tr><tr><td>UAPPGD</td><td>73.9</td><td>75.5</td><td>26.3</td><td>23.8</td><td>27.3</td><td>2.2</td><td>1.5</td></tr><tr><td>TI-FGSM</td><td>19.7</td><td>60.2</td><td>19.8</td><td>21</td><td>11.4</td><td>2.2</td><td>1.5</td></tr><tr><td>VMI-FGSM</td><td>69.8</td><td>86.1</td><td>40.8</td><td>38.3</td><td>31.3</td><td>2.6</td><td>1.6</td></tr><tr><td>VNI-FGSM</td><td>75.5</td><td>89.5</td><td>44.4</td><td>42.4</td><td>36.3</td><td>3.2</td><td>2.3</td></tr><tr><td>NAA</td><td>38.7</td><td>70.5</td><td>8.4</td><td>8.1</td><td>9.2</td><td>1.1</td><td>1.5</td></tr><tr><td>RAP</td><td>61.9</td><td>90.2</td><td>42.0</td><td>41.7</td><td>30.3</td><td>2.3</td><td>2.7</td></tr><tr><td>Ours</td><td><strong>98</strong></td><td>95.1</td><td><strong>79.6</strong></td><td><strong>73.9</strong></td><td><strong>75.8</strong></td><td><strong>10.7</strong></td><td><strong>10.8</strong></td></tr><tr><td rowspan="10">ResNet50</td><td>AutoAttack</td><td>63.3</td><td>52.6</td><td><strong>100</strong></td><td>54.6</td><td>25.1</td><td>1.2</td><td>2.4</td></tr><tr><td>UAP</td><td>31.4</td><td>23.6</td><td>12.1</td><td>12.5</td><td>11.2</td><td>1.3</td><td>1.7</td></tr><tr><td>UAPPGD</td><td>63.3</td><td>49.4</td><td>39.4</td><td>35.1</td><td>26.1</td><td>1.1</td><td>2.3</td></tr><tr><td>TI-FGSM</td><td>18.4</td><td>17.1</td><td>74.0</td><td>38.5</td><td>20.4</td><td>2.2</td><td>3.0</td></tr><tr><td>VMI-FGSM</td><td>74.9</td><td>75.3</td><td>96.0</td><td>78.1</td><td>53.5</td><td>2.1</td><td>3.2</td></tr><tr><td>VNI-FGSM</td><td>78.3</td><td>76.9</td><td>95.9</td><td>80.3</td><td>57.2</td><td>2.7</td><td>2.1</td></tr><tr><td>NAA</td><td>50.7</td><td>38.6</td><td>64.7</td><td>22.9</td><td>18.4</td><td>1.4</td><td>2.1</td></tr><tr><td>RAP</td><td>49.0</td><td>45.7</td><td>75.1</td><td>52.5</td><td>35.4</td><td>1.6</td><td>2.8</td></tr><tr><td>Ours</td><td><strong>96.0</strong></td><td><strong>92.9</strong></td><td>91.3</td><td><strong>81.8</strong></td><td><strong>82.1</strong></td><td><strong>11.7</strong></td><td><strong>13.2</strong></td></tr><tr><td rowspan="10">DenseNet</td><td>AutoAttack</td><td>56.9</td><td>51.6</td><td>48.8</td><td><strong>100</strong></td><td>21.8</td><td>2.1</td><td>2.0</td></tr><tr><td>UAP</td><td>27.6</td><td>20.6</td><td>10.6</td><td>12.8</td><td>11.4</td><td>1.6</td><td>1.4</td></tr><tr><td>UAPPGD</td><td>61.1</td><td>49.9</td><td>29.3</td><td>47.4</td><td>27.3</td><td>2.7</td><td>2.1</td></tr><tr><td>TI-FGSM</td><td>17.4</td><td>15.8</td><td>26.3</td><td>65.2</td><td>17</td><td>2.9</td><td>2.3</td></tr><tr><td>VMI-FGSM</td><td>73.7</td><td>71.8</td><td>77.2</td><td>93.1</td><td>47.9</td><td>3.3</td><td>3.7</td></tr><tr><td>VNI-FGSM</td><td>78.1</td><td>76.2</td><td>79.5</td><td>94.0</td><td>53.3</td><td>3.5</td><td>4.2</td></tr><tr><td>NAA</td><td>37.2</td><td>31.1</td><td>23.7</td><td>74.9</td><td>12.5</td><td>1.2</td><td>1.5</td></tr><tr><td>RAP</td><td>47.8</td><td>43.5</td><td>48.7</td><td>75.9</td><td>35.6</td><td>3.2</td><td>3.5</td></tr><tr><td>Ours</td><td><strong>96.7</strong></td><td><strong>93.5</strong></td><td><strong>88.4</strong></td><td><strong>85.5</strong></td><td><strong>82.7</strong></td><td><strong>12.3</strong></td><td><strong>13.4</strong></td></tr><tr><td rowspan="10">VGG</td><td>AutoAttack</td><td>62.5</td><td>58.0</td><td>43.0</td><td>44.0</td><td><strong>100</strong></td><td>2.7</td><td>2.7</td></tr><tr><td>UAP</td><td>22.0</td><td>18.4</td><td>10.2</td><td>10.2</td><td>10.0</td><td>1.1</td><td>1.3</td></tr><tr><td>UAPPGD</td><td>63.6</td><td>55.9</td><td>27.6</td><td>29.4</td><td>41.9</td><td>3.1</td><td>2.1</td></tr><tr><td>TI-FGSM</td><td>19.7</td><td>16.7</td><td>25.6</td><td>27.6</td><td>74.4</td><td>3.7</td><td>2.2</td></tr><tr><td>VMI-FGSM</td><td>66.2</td><td>64.2</td><td>57.5</td><td>56.9</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>VNI-FGSM</td><td>69.3</td><td>68</td><td>62.6</td><td>61.4</td><td>96.5</td><td>3.0</td><td>2.6</td></tr><tr><td>NAA</td><td>42.3</td><td>38.3</td><td>14.5</td><td>1.8</td><td>71.6</td><td>1.6</td><td>1.2</td></tr><tr><td>RAP</td><td>46.5</td><td>44.5</td><td>39.5</td><td>40.9</td><td>73.8</td><td>3.3</td><td>3.4</td></tr><tr><td>Ours</td><td><strong>97.4</strong></td><td><strong>95.1</strong></td><td><strong>87.5</strong></td><td><strong>81.5</strong></td><td>91.0</td><td><strong>11.5</strong></td><td><strong>12.6</strong></td></tr><tr><td rowspan="10">R-r18</td><td>AutoAttack</td><td>17.5</td><td>15.7</td><td>17.2</td><td>15.6</td><td>17.5</td><td><strong>44.3</strong></td><td><strong>23.4</strong></td></tr><tr><td>UAP</td><td>14.5</td><td>9.5</td><td>7.1</td><td>6.4</td><td>7.6</td><td>1.9</td><td>2.6</td></tr><tr><td>UAPPGD</td><td>18.6</td><td>13.3</td><td>9.7</td><td>8.6</td><td>10.5</td><td>3.1</td><td>3.5</td></tr><tr><td>TI-FGSM</td><td>8.4</td><td>5.5</td><td>8.2</td><td>7.8</td><td>8.6</td><td>26.2</td><td>13.1</td></tr><tr><td>VMI-FGSM</td><td>24</td><td>22.9</td><td>24.2</td><td>21.9</td><td>24.8</td><td>38</td><td>22.7</td></tr><tr><td>VNI-FGSM</td><td>27.1</td><td>23.1</td><td>25.4</td><td>23.8</td><td>25.6</td><td>38.1</td><td>22.9</td></tr><tr><td>NAA</td><td>16.2</td><td>11.5</td><td>11.2</td><td>10.4</td><td>10.4</td><td>18.7</td><td>7.2</td></tr><tr><td>RAP</td><td>10.9</td><td>8.4</td><td>7.9</td><td>8.9</td><td>9.7</td><td>23.8</td><td>12.2</td></tr><tr><td>Ours</td><td><strong>81.3</strong></td><td><strong>73.2</strong></td><td><strong>71.7</strong></td><td><strong>68.3</strong></td><td><strong>61.7</strong></td><td><strong>25.3</strong></td><td><strong>21.6</strong></td></tr></tbody></table>
<table><caption>Table 10: Transferability performance of the LIMANS $\ell_2$-attacks on CIFAR-10 ($\epsilon = 0.5$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">MobileNet</td><td>AutoAttack</td><td><strong>100</strong></td><td>50.20</td><td>14.20</td><td>13.30</td><td>8.20</td><td>0.90</td><td>0.50</td></tr><tr><td>UAP</td><td>7.50</td><td>5.20</td><td>3.00</td><td>2.50</td><td>2.40</td><td>0.30</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>37.90</td><td>15.20</td><td>2.00</td><td>1.10</td><td>0.90</td><td>0.30</td><td>0.20</td></tr><tr><td>CW</td><td>97.50</td><td>11.00</td><td>4.20</td><td>3.20</td><td>2.40</td><td>0.30</td><td>0.00</td></tr><tr><td>RAP</td><td>67.30</td><td>11.20</td><td>4.20</td><td>3.90</td><td>2.60</td><td>0.50</td><td>0.10</td></tr><tr><td>Ours</td><td>95.40</td><td><strong>91.50</strong></td><td><strong>61.70</strong></td><td><strong>59.30</strong></td><td><strong>51.50</strong></td><td><strong>4.60</strong></td><td><strong>5.00</strong></td></tr><tr><td rowspan="5">Inception</td><td>AutoAttack</td><td>32.80</td><td><strong>100</strong></td><td>6.60</td><td>7.90</td><td>5.50</td><td>0.50</td><td>0.50</td></tr><tr><td>UAP</td><td>9.80</td><td>7.50</td><td>2.50</td><td>3.50</td><td>2.90</td><td>0.20</td><td>0.10</td></tr><tr><td>UAPPGD</td><td>26.90</td><td>16.70</td><td>1.30</td><td>2.30</td><td>2.00</td><td>0.30</td><td>0.10</td></tr><tr><td>CW</td><td>16.30</td><td>82.80</td><td>5.00</td><td>5.20</td><td>3.70</td><td>0.30</td><td>0.00</td></tr><tr><td>RAP</td><td>13.60</td><td>43.50</td><td>3.50</td><td>3.60</td><td>2.70</td><td>0.40</td><td>0.30</td></tr><tr><td>Ours</td><td><strong>94.60</strong></td><td>94.10</td><td><strong>64.30</strong></td><td><strong>63.90</strong></td><td><strong>57.20</strong></td><td><strong>5.10</strong></td><td><strong>5.20</strong></td></tr><tr><td rowspan="5">ResNet50</td><td>AutoAttack</td><td>31.00</td><td>23.40</td><td><strong>99.70</strong></td><td>26.10</td><td>10.00</td><td>1.20</td><td>0.70</td></tr><tr><td>UAP</td><td>5.10</td><td>3.80</td><td>2.40</td><td>1.90</td><td>2.80</td><td>0.50</td><td>0.30</td></tr><tr><td>UAPPGD</td><td>4.10</td><td>3.20</td><td>2.20</td><td>2.30</td><td>2.20</td><td>0.40</td><td>0.20</td></tr><tr><td>CW</td><td>13.50</td><td>9.80</td><td>82.40</td><td>13.10</td><td>6.10</td><td>0.50</td><td>0.40</td></tr><tr><td>RAP</td><td>10.20</td><td>8.60</td><td>33.00</td><td>8.60</td><td>4.90</td><td>0.40</td><td>0.30</td></tr><tr><td>Ours</td><td><strong>92.60</strong></td><td><strong>87.50</strong></td><td>78.10</td><td><strong>71.70</strong></td><td><strong>61.70</strong></td><td><strong>7.90</strong></td><td><strong>7.50</strong></td></tr><tr><td rowspan="5">DenseNet</td><td>AutoAttack</td><td>32.60</td><td>25.20</td><td>27.30</td><td><strong>99.50</strong></td><td>10.20</td><td>0.50</td><td>0.50</td></tr><tr><td>UAP</td><td>4.90</td><td>3.70</td><td>2.60</td><td>3.30</td><td>1.90</td><td>0.20</td><td>0.20</td></tr><tr><td>UAPPGD</td><td>5.00</td><td>4.50</td><td>3.20</td><td>3.70</td><td>2.10</td><td>0.20</td><td>0.20</td></tr><tr><td>CW</td><td>14.60</td><td>13.70</td><td>14.80</td><td>80.00</td><td>6.40</td><td>0.40</td><td>0.30</td></tr><tr><td>RAP</td><td>8.00</td><td>7.30</td><td>7.70</td><td>29.00</td><td>4.50</td><td>0.30</td><td>0.30</td></tr><tr><td>Ours</td><td><strong>91.10</strong></td><td><strong>87.60</strong></td><td><strong>74.00</strong></td><td>74.10</td><td><strong>62.70</strong></td><td><strong>8.40</strong></td><td><strong>7.70</strong></td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>32.00</td><td>28.20</td><td>19.50</td><td>21.10</td><td><strong>98.90</strong></td><td>0.80</td><td>0.60</td></tr><tr><td>UAP</td><td>4.70</td><td>3.80</td><td>2.20</td><td>2.70</td><td>2.00</td><td>0.50</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>4.80</td><td>5.60</td><td>2.00</td><td>2.70</td><td>2.80</td><td>0.40</td><td>0.40</td></tr><tr><td>CW</td><td>10.00</td><td>8.20</td><td>5.70</td><td>7.40</td><td>79.10</td><td>0.60</td><td>0.30</td></tr><tr><td>RAP</td><td>8.80</td><td>7.10</td><td>5.20</td><td>6.50</td><td>32.10</td><td>0.30</td><td>0.50</td></tr><tr><td>Ours</td><td><strong>94.20</strong></td><td><strong>89.00</strong></td><td><strong>74.80</strong></td><td><strong>71.00</strong></td><td><strong>71.70</strong></td><td><strong>8.00</strong></td><td><strong>7.10</strong></td></tr><tr><td rowspan="5">R-r18</td><td>AutoAttack</td><td>6.70</td><td>8.30</td><td>8.00</td><td>8.50</td><td>9.60</td><td><strong>24.60</strong></td><td>11.00</td></tr><tr><td>UAP</td><td>3.40</td><td>3.10</td><td>2.50</td><td>2.30</td><td>1.80</td><td>0.50</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>2.70</td><td>2.10</td><td>2.00</td><td>1.70</td><td>2.60</td><td>0.30</td><td>0.10</td></tr><tr><td>CW</td><td>9.50</td><td>11.60</td><td>10.60</td><td>10.00</td><td>11.60</td><td>22.90</td><td>3.90</td></tr><tr><td>RAP</td><td>8.70</td><td>7.70</td><td>7.60</td><td>8.10</td><td>9.60</td><td>10.70</td><td>4.50</td></tr><tr><td>Ours</td><td><strong>58.70</strong></td><td><strong>53.80</strong></td><td><strong>50.30</strong></td><td><strong>50.70</strong></td><td><strong>41.80</strong></td><td>17.60</td><td><strong>14.60</strong></td></tr><tr><td rowspan="5">R-wrn-34-10</td><td>AutoAttack</td><td>7.70</td><td>7.80</td><td>8.20</td><td>7.80</td><td>8.90</td><td>15.20</td><td><strong>22.50</strong></td></tr><tr><td>UAP</td><td>3.00</td><td>3.10</td><td>2.40</td><td>2.90</td><td>2.60</td><td>0.90</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>2.90</td><td>2.80</td><td>2.20</td><td>1.00</td><td>1.60</td><td>0.70</td><td>0.60</td></tr><tr><td>CW</td><td>10.30</td><td>9.10</td><td>13.00</td><td>10.60</td><td>10.40</td><td>8.80</td><td>21.20</td></tr><tr><td>RAP</td><td>8.10</td><td>7.30</td><td>8.10</td><td>7.60</td><td>7.70</td><td>7.10</td><td>9.90</td></tr><tr><td>Ours</td><td><strong>59.10</strong></td><td><strong>54.80</strong></td><td><strong>51.80</strong></td><td><strong>50.00</strong></td><td><strong>42.50</strong></td><td><strong>17.00</strong></td><td><strong>14.70</strong></td></tr></tbody></table>
<table><caption>Table 10: Transferability performance of the LIMANS $\ell_2$-attacks on CIFAR-10 ($\epsilon = 0.5$), in terms of fooling rates (FR). The best transferable results are marked in red bold font and the best specific attacking results are marked in black bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>Inception</th><th>ResNet50</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-wrn-34-10</th></tr></thead><tbody><tr><td rowspan="5">MobileNet</td><td>AutoAttack</td><td><b>100</b></td><td>50.20</td><td>14.20</td><td>13.30</td><td>8.20</td><td>0.90</td><td>0.50</td></tr><tr><td>UAP</td><td>7.50</td><td>5.20</td><td>3.00</td><td>2.50</td><td>2.40</td><td>0.30</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>37.90</td><td>15.20</td><td>2.00</td><td>1.10</td><td>0.90</td><td>0.30</td><td>0.20</td></tr><tr><td>CW</td><td>97.50</td><td>11.00</td><td>4.20</td><td>3.20</td><td>2.40</td><td>0.30</td><td>0.00</td></tr><tr><td>RAP</td><td>67.30</td><td>11.20</td><td>4.20</td><td>3.90</td><td>2.60</td><td>0.50</td><td>0.10</td></tr><tr><td>Ours</td><td>95.40</td><td><b>91.50</b></td><td><b>61.70</b></td><td><b>59.30</b></td><td><b>51.50</b></td><td><b>4.60</b></td><td><b>5.00</b></td></tr><tr><td rowspan="5">Inception</td><td>AutoAttack</td><td>32.80</td><td><b>100</b></td><td>6.60</td><td>7.90</td><td>5.50</td><td>0.50</td><td>0.50</td></tr><tr><td>UAP</td><td>9.80</td><td>7.50</td><td>2.50</td><td>3.50</td><td>2.90</td><td>0.20</td><td>0.10</td></tr><tr><td>UAPPGD</td><td>26.90</td><td>16.70</td><td>1.30</td><td>2.30</td><td>2.00</td><td>0.30</td><td>0.10</td></tr><tr><td>CW</td><td>16.30</td><td>82.80</td><td>5.00</td><td>5.20</td><td>3.70</td><td>0.30</td><td>0.00</td></tr><tr><td>RAP</td><td>13.60</td><td>43.50</td><td>3.50</td><td>3.60</td><td>2.70</td><td>0.40</td><td>0.30</td></tr><tr><td>Ours</td><td><b>94.60</b></td><td>94.10</td><td><b>64.30</b></td><td><b>63.90</b></td><td><b>57.20</b></td><td><b>5.10</b></td><td><b>5.20</b></td></tr><tr><td rowspan="5">ResNet50</td><td>AutoAttack</td><td>31.00</td><td>23.40</td><td><b>99.70</b></td><td>26.10</td><td>10.00</td><td>1.20</td><td>0.70</td></tr><tr><td>UAP</td><td>5.10</td><td>3.80</td><td>2.40</td><td>1.90</td><td>2.80</td><td>0.50</td><td>0.30</td></tr><tr><td>UAPPGD</td><td>4.10</td><td>3.20</td><td>2.20</td><td>2.30</td><td>2.20</td><td>0.40</td><td>0.20</td></tr><tr><td>CW</td><td>13.50</td><td>9.80</td><td>82.40</td><td>13.10</td><td>6.10</td><td>0.50</td><td>0.40</td></tr><tr><td>RAP</td><td>10.20</td><td>8.60</td><td>33.00</td><td>8.60</td><td>4.90</td><td>0.40</td><td>0.30</td></tr><tr><td>Ours</td><td><b>92.60</b></td><td><b>87.50</b></td><td>78.10</td><td><b>71.70</b></td><td><b>61.70</b></td><td><b>7.90</b></td><td><b>7.50</b></td></tr><tr><td rowspan="5">DenseNet</td><td>AutoAttack</td><td>32.60</td><td>25.20</td><td>27.30</td><td><b>99.50</b></td><td>10.20</td><td>0.50</td><td>0.50</td></tr><tr><td>UAP</td><td>4.90</td><td>3.70</td><td>2.60</td><td>3.30</td><td>1.90</td><td>0.20</td><td>0.20</td></tr><tr><td>UAPPGD</td><td>5.00</td><td>4.50</td><td>3.20</td><td>3.70</td><td>2.10</td><td>0.20</td><td>0.20</td></tr><tr><td>CW</td><td>14.60</td><td>13.70</td><td>14.80</td><td>80.00</td><td>6.40</td><td>0.40</td><td>0.30</td></tr><tr><td>RAP</td><td>8.00</td><td>7.30</td><td>7.70</td><td>29.00</td><td>4.50</td><td>0.30</td><td>0.30</td></tr><tr><td>Ours</td><td><b>91.10</b></td><td><b>87.60</b></td><td><b>74.00</b></td><td>74.10</td><td><b>62.70</b></td><td><b>8.40</b></td><td><b>7.70</b></td></tr><tr><td rowspan="5">VGG</td><td>AutoAttack</td><td>32.00</td><td>28.20</td><td>19.50</td><td>21.10</td><td><b>98.90</b></td><td>0.80</td><td>0.60</td></tr><tr><td>UAP</td><td>4.70</td><td>3.80</td><td>2.20</td><td>2.70</td><td>2.00</td><td>0.50</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>4.80</td><td>5.60</td><td>2.00</td><td>2.70</td><td>2.80</td><td>0.40</td><td>0.40</td></tr><tr><td>CW</td><td>10.00</td><td>8.20</td><td>5.70</td><td>7.40</td><td>79.10</td><td>0.60</td><td>0.30</td></tr><tr><td>RAP</td><td>8.80</td><td>7.10</td><td>5.20</td><td>6.50</td><td>32.10</td><td>0.30</td><td>0.50</td></tr><tr><td>Ours</td><td><b>94.20</b></td><td><b>89.00</b></td><td><b>74.80</b></td><td><b>71.00</b></td><td><b>71.70</b></td><td><b>8.00</b></td><td><b>7.10</b></td></tr><tr><td rowspan="5">R-r18</td><td>AutoAttack</td><td>6.70</td><td>8.30</td><td>8.00</td><td>8.50</td><td>9.60</td><td><b>24.60</b></td><td>11.00</td></tr><tr><td>UAP</td><td>3.40</td><td>3.10</td><td>2.50</td><td>2.30</td><td>1.80</td><td>0.50</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>2.70</td><td>2.10</td><td>2.00</td><td>1.70</td><td>2.60</td><td>0.30</td><td>0.10</td></tr><tr><td>CW</td><td>9.50</td><td>11.60</td><td>10.60</td><td>10.00</td><td>11.60</td><td>22.90</td><td>3.90</td></tr><tr><td>RAP</td><td>8.70</td><td>7.70</td><td>7.60</td><td>8.10</td><td>9.60</td><td>10.70</td><td>4.50</td></tr><tr><td>Ours</td><td><b>58.70</b></td><td><b>53.80</b></td><td><b>50.30</b></td><td><b>50.70</b></td><td><b>41.80</b></td><td><b>17.60</b></td><td><b>14.60</b></td></tr><tr><td rowspan="5">R-wrn-34-10</td><td>AutoAttack</td><td>7.70</td><td>7.80</td><td>8.20</td><td>7.80</td><td>8.90</td><td>15.20</td><td><b>22.50</b></td></tr><tr><td>UAP</td><td>3.00</td><td>3.10</td><td>2.40</td><td>2.90</td><td>2.60</td><td>0.90</td><td>0.40</td></tr><tr><td>UAPPGD</td><td>2.90</td><td>2.80</td><td>2.20</td><td>1.00</td><td>1.60</td><td>0.70</td><td>0.60</td></tr><tr><td>CW</td><td>10.30</td><td>9.10</td><td>13.00</td><td>10.60</td><td>10.40</td><td>8.80</td><td>21.20</td></tr><tr><td>RAP</td><td>8.10</td><td>7.30</td><td>8.10</td><td>7.60</td><td>7.70</td><td>7.10</td><td>9.90</td></tr><tr><td>Ours</td><td><b>59.10</b></td><td><b>54.80</b></td><td><b>51.80</b></td><td><b>50.00</b></td><td><b>42.50</b></td><td><b>17.00</b></td><td><b>14.70</b></td></tr></tbody></table>
<table><caption>Table 11: Transferability performance of the LIMANS $\ell_{\infty}$-attacks on ImageNet ($\epsilon = 4/255$), in terms of fooling rates. The best transferable results are marked in red bold font, and the best specific attacking results are marked in black bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet18</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-50-2</th></tr></thead><tbody><tr><td rowspan="7">MobileNet</td><td>AutoAttack</td><td><strong>100</strong></td><td>26.38</td><td>20.44</td><td>26.94</td><td>1.64</td><td>1.24</td></tr><tr><td>UAP</td><td>48.48</td><td>11.5</td><td>10.46</td><td>17.28</td><td>1.8</td><td>0.84</td></tr><tr><td>UAPPGD</td><td>69.94</td><td>18.04</td><td>14.34</td><td>22.34</td><td>2.72</td><td>1.56</td></tr><tr><td>TI-FGSM</td><td>99.74</td><td>36.98</td><td>31.66</td><td>31.24</td><td>3.2</td><td>2.56</td></tr><tr><td>VMI-FGSM</td><td><strong>100</strong></td><td>44.84</td><td>37.92</td><td>42.92</td><td>2.92</td><td>2.04</td></tr><tr><td>VNI-FGSM</td><td>99.98</td><td>44.64</td><td>36.54</td><td>43.62</td><td>2.88</td><td>2.00</td></tr><tr><td>NAA</td><td>84.56</td><td>15.1</td><td>11.72</td><td>16.88</td><td>2.1</td><td>1.2</td></tr><tr><td rowspan="5">ResNet18</td><td>RAP</td><td>96.52</td><td><strong>54.58</strong></td><td><strong>47.24</strong></td><td><strong>49.16</strong></td><td>3.72</td><td>3.16</td></tr><tr><td>Ours</td><td>75.24</td><td>50.06</td><td>46.94</td><td>44.34</td><td><strong>10.02</strong></td><td><strong>5.62</strong></td></tr><tr><td>AutoAttack</td><td>40.3</td><td><strong>100</strong></td><td>35.76</td><td>34.9</td><td>1.8</td><td>1.34</td></tr><tr><td>UAP</td><td>13.34</td><td>11.3</td><td>9.00</td><td>11.72</td><td>1.36</td><td>0.86</td></tr><tr><td>UAPPGD</td><td>25.3</td><td>47.22</td><td>18.44</td><td>23.26</td><td>2.5</td><td>1.44</td></tr><tr><td rowspan="5">DenseNet</td><td>TI-FGSM</td><td>32.06</td><td>99.84</td><td>31.38</td><td>31.66</td><td>2.98</td><td>2.8</td></tr><tr><td>VMI-FGSM</td><td>56.5</td><td><strong>100</strong></td><td>51.78</td><td>50.2</td><td>2.9</td><td>2.04</td></tr><tr><td>VNI-FGSM</td><td>56.74</td><td>99.98</td><td>51.4</td><td><strong>51.42</strong></td><td>2.84</td><td>2.04</td></tr><tr><td>NAA</td><td>22.54</td><td>97.94</td><td>14.84</td><td>19.3</td><td>2.12</td><td>1.2</td></tr><tr><td>RAP</td><td>53.36</td><td>96.74</td><td>51.30</td><td>50.60</td><td>3.80</td><td>3.14</td></tr><tr><td></td><td>Ours</td><td><strong>59.16</strong></td><td>59.16</td><td><strong>53.14</strong></td><td>48.28</td><td><strong>10.48</strong></td><td><strong>6.62</strong></td></tr><tr><td rowspan="7">DenseNet</td><td>AutoAttack</td><td>37.72</td><td>40.4</td><td><strong>100</strong></td><td>30.22</td><td>1.8</td><td>1.3</td></tr><tr><td>UAP</td><td>12.76</td><td>9.94</td><td>9.8</td><td>11.42</td><td>1.24</td><td>0.92</td></tr><tr><td>UAPPGD</td><td>22.72</td><td>20.7</td><td>40.04</td><td>20.18</td><td>2.48</td><td>1.28</td></tr><tr><td>TI-FGSM</td><td>30.1</td><td>35.56</td><td>99.66</td><td>27</td><td>3.12</td><td>2.32</td></tr><tr><td>VMI-FGSM</td><td>52.22</td><td>55.44</td><td>99.98</td><td>44.82</td><td>2.9</td><td>2.06</td></tr><tr><td>VNI-FGSM</td><td>53.88</td><td><strong>56.9</strong></td><td>99.98</td><td>46.16</td><td>2.64</td><td>2.1</td></tr><tr><td>NAA</td><td>24.22</td><td>25.68</td><td>98.34</td><td>21.38</td><td>1.34</td><td>1.42</td></tr><tr><td rowspan="5">VGG</td><td>RAP</td><td>48.16</td><td>54.12</td><td>96.76</td><td>42.00</td><td>3.12</td><td>3.30</td></tr><tr><td>Ours</td><td><strong>58.86</strong></td><td><strong>56.9</strong></td><td>57.26</td><td><strong>47.74</strong></td><td><strong>11.3</strong></td><td><strong>7.32</strong></td></tr><tr><td>AutoAttack</td><td>47.94</td><td>40.06</td><td>32.62</td><td><strong>100</strong></td><td>2.34</td><td>1.42</td></tr><tr><td>UAP</td><td>13.34</td><td>9.8</td><td>8.82</td><td>13.6</td><td>1.34</td><td>0.78</td></tr><tr><td>UAPPGD</td><td>24.42</td><td>23.16</td><td>18.12</td><td>46.26</td><td>2.54</td><td>1.6</td></tr><tr><td rowspan="5">R-r18</td><td>TI-FGSM</td><td>33.2</td><td>38.26</td><td>29.3</td><td>99.4</td><td>2.96</td><td>2.28</td></tr><tr><td>VMI-FGSM</td><td>57.52</td><td>53.46</td><td>43.76</td><td>99.86</td><td>2.9</td><td>2.2</td></tr><tr><td>VNI-FGSM</td><td><strong>57.98</strong></td><td>53.96</td><td>42.88</td><td>99.84</td><td>2.76</td><td>2.24</td></tr><tr><td>NAA</td><td>19.62</td><td>14.92</td><td>12.18</td><td>79.96</td><td>2.18</td><td>1.4</td></tr><tr><td>RAP</td><td>53.14</td><td>53.12</td><td>42.68</td><td>95.68</td><td>3.48</td><td>2.84</td></tr><tr><td></td><td>Ours</td><td>57.68</td><td><strong>54.14</strong></td><td><strong>50.04</strong></td><td>51.62</td><td><strong>10.68</strong></td><td><strong>6.24</strong></td></tr><tr><td rowspan="7">R-50-2</td><td>AutoAttack</td><td>13.7</td><td>15.8</td><td>10.82</td><td>14.6</td><td><strong>71.74</strong></td><td>10.78</td></tr><tr><td>UAP</td><td>11.52</td><td>9.32</td><td>8.46</td><td>10.90</td><td>1.44</td><td>1.16</td></tr><tr><td>UAPPGD</td><td>14.00</td><td>12.34</td><td>11.20</td><td>13.56</td><td>3.14</td><td>1.66</td></tr><tr><td>TI-FGSM</td><td>11.88</td><td>13.42</td><td>10.08</td><td>11.02</td><td>54.46</td><td>10.14</td></tr><tr><td>VMI-FGSM</td><td>17.00</td><td>17.80</td><td>12.12</td><td>16.08</td><td>64.98</td><td>11.94</td></tr><tr><td>VNI-FGSM</td><td>16.14</td><td>17.66</td><td>12.48</td><td>16.08</td><td>63.22</td><td>11.74</td></tr><tr><td>NAA</td><td>11.46</td><td>10.86</td><td>9.34</td><td>11.42</td><td>21.48</td><td>4.9</td></tr><tr><td rowspan="5">R-50-2</td><td>RAP</td><td>11.32</td><td>10.80</td><td>8.16</td><td>10.32</td><td>45.80</td><td>7.94</td></tr><tr><td>Ours</td><td><strong>37.14</strong></td><td><strong>33.2</strong></td><td><strong>33.76</strong></td><td><strong>29.90</strong></td><td><strong>29.84</strong></td><td><strong>12.94</strong></td></tr><tr><td>AutoAttack</td><td>20.14</td><td>22.76</td><td>17.36</td><td>19.44</td><td>15.42</td><td><strong>59.02</strong></td></tr><tr><td>UAP</td><td>9.88</td><td>7.60</td><td>6.96</td><td>8.62</td><td>1.84</td><td>1.24</td></tr><tr><td>UAPPGD</td><td>14.54</td><td>12.56</td><td>10.92</td><td>14.36</td><td>2.16</td><td>1.38</td></tr><tr><td rowspan="5">R-50-2</td><td>TI-FGSM</td><td>14.16</td><td>16.34</td><td>12.68</td><td>13.68</td><td>17.16</td><td>43.66</td></tr><tr><td>VMI-FGSM</td><td>24.22</td><td>26.66</td><td>20.12</td><td>23.86</td><td>17.82</td><td>54.56</td></tr><tr><td>VNI-FGSM</td><td>23.88</td><td>26.22</td><td>19.68</td><td>23.28</td><td>18.00</td><td>52.28</td></tr><tr><td>NAA</td><td>14.08</td><td>13.12</td><td>10.20</td><td>14.04</td><td>9.82</td><td>12.58</td></tr><tr><td>RAP</td><td>13.82</td><td>14.06</td><td>10.52</td><td>13.5</td><td>15.54</td><td>34.1</td></tr><tr><td></td><td>Ours</td><td><strong>42.18</strong></td><td><strong>42.5</strong></td><td><strong>42.46</strong></td><td><strong>34.22</strong></td><td><strong>23.7</strong></td><td><strong>18.02</strong></td></tr></tbody></table>
<table><caption>Table 11: Transferability performance of the LIMANS $\ell_\infty$-attacks on ImageNet ($\epsilon = 4/255$), in terms of fooling rates. The best transferable results are marked in red bold font, and the best specific attacking results are marked in black bold font.</caption><thead><tr><th></th><th></th><th>MobileNet</th><th>ResNet18</th><th>DenseNet</th><th>VGG</th><th>R-r18</th><th>R-50-2</th></tr></thead><tbody><tr><td rowspan="7">MobileNet</td><td>AutoAttack</td><td><strong>100</strong></td><td>26.38</td><td>20.44</td><td>26.94</td><td>1.64</td><td>1.24</td></tr><tr><td>UAP</td><td>48.48</td><td>11.5</td><td>10.46</td><td>17.28</td><td>1.8</td><td>0.84</td></tr><tr><td>UAPPGD</td><td>69.94</td><td>18.04</td><td>14.34</td><td>22.34</td><td>2.72</td><td>1.56</td></tr><tr><td>TI-FGSM</td><td>99.74</td><td>36.98</td><td>31.66</td><td>31.24</td><td>3.2</td><td>2.56</td></tr><tr><td>VMI-FGSM</td><td><strong>100</strong></td><td>44.84</td><td>37.92</td><td>42.92</td><td>2.92</td><td>2.04</td></tr><tr><td>VNI-FGSM</td><td>99.98</td><td>44.64</td><td>36.54</td><td>43.62</td><td>2.88</td><td>2.00</td></tr><tr><td>NAA</td><td>84.56</td><td>15.1</td><td>11.72</td><td>16.88</td><td>2.1</td><td>1.2</td></tr><tr><td rowspan="5">ResNet18</td><td>RAP</td><td>96.52</td><td><strong>54.58</strong></td><td><strong>47.24</strong></td><td><strong>49.16</strong></td><td>3.72</td><td>3.16</td></tr><tr><td>Ours</td><td>75.24</td><td>50.06</td><td>46.94</td><td>44.34</td><td><strong>10.02</strong></td><td><strong>5.62</strong></td></tr><tr><td>AutoAttack</td><td>40.3</td><td><strong>100</strong></td><td>35.76</td><td>34.9</td><td>1.8</td><td>1.34</td></tr><tr><td>UAP</td><td>13.34</td><td>11.3</td><td>9.00</td><td>11.72</td><td>1.36</td><td>0.86</td></tr><tr><td>UAPPGD</td><td>25.3</td><td>47.22</td><td>18.44</td><td>23.26</td><td>2.5</td><td>1.44</td></tr><tr><td rowspan="5">DenseNet</td><td>TI-FGSM</td><td>32.06</td><td>99.84</td><td>31.38</td><td>31.66</td><td>2.98</td><td>2.8</td></tr><tr><td>VMI-FGSM</td><td>56.5</td><td><strong>100</strong></td><td>51.78</td><td>50.2</td><td>2.9</td><td>2.04</td></tr><tr><td>VNI-FGSM</td><td>56.74</td><td>99.98</td><td>51.4</td><td><strong>51.42</strong></td><td>2.84</td><td>2.04</td></tr><tr><td>NAA</td><td>22.54</td><td>97.94</td><td>14.84</td><td>19.3</td><td>2.12</td><td>1.2</td></tr><tr><td>RAP</td><td>53.36</td><td>96.74</td><td>51.30</td><td>50.60</td><td>3.80</td><td>3.14</td></tr><tr><td></td><td>Ours</td><td><strong>59.16</strong></td><td>59.16</td><td><strong>53.14</strong></td><td>48.28</td><td><strong>10.48</strong></td><td><strong>6.62</strong></td></tr><tr><td rowspan="7">VGG</td><td>AutoAttack</td><td>37.72</td><td>40.4</td><td><strong>100</strong></td><td>30.22</td><td>1.8</td><td>1.3</td></tr><tr><td>UAP</td><td>12.76</td><td>9.94</td><td>9.8</td><td>11.42</td><td>1.24</td><td>0.92</td></tr><tr><td>UAPPGD</td><td>22.72</td><td>20.7</td><td>40.04</td><td>20.18</td><td>2.48</td><td>1.28</td></tr><tr><td>TI-FGSM</td><td>30.1</td><td>35.56</td><td>99.66</td><td>27</td><td>3.12</td><td>2.32</td></tr><tr><td>VMI-FGSM</td><td>52.22</td><td>55.44</td><td>99.98</td><td>44.82</td><td>2.9</td><td>2.06</td></tr><tr><td>VNI-FGSM</td><td>53.88</td><td><strong>56.9</strong></td><td>99.98</td><td>46.16</td><td>2.64</td><td>2.1</td></tr><tr><td>NAA</td><td>24.22</td><td>25.68</td><td>98.34</td><td>21.38</td><td>1.34</td><td>1.42</td></tr><tr><td rowspan="5">R-r18</td><td>RAP</td><td>48.16</td><td>54.12</td><td>96.76</td><td>42.00</td><td>3.12</td><td>3.30</td></tr><tr><td>Ours</td><td><strong>58.86</strong></td><td><strong>56.9</strong></td><td>57.26</td><td><strong>47.74</strong></td><td><strong>11.3</strong></td><td><strong>7.32</strong></td></tr><tr><td>AutoAttack</td><td>47.94</td><td>40.06</td><td>32.62</td><td><strong>100</strong></td><td>2.34</td><td>1.42</td></tr><tr><td>UAP</td><td>13.34</td><td>9.8</td><td>8.82</td><td>13.6</td><td>1.34</td><td>0.78</td></tr><tr><td>UAPPGD</td><td>24.42</td><td>23.16</td><td>18.12</td><td>46.26</td><td>2.54</td><td>1.6</td></tr><tr><td rowspan="5">R-50-2</td><td>TI-FGSM</td><td>33.2</td><td>38.26</td><td>29.3</td><td>99.4</td><td>2.96</td><td>2.28</td></tr><tr><td>VMI-FGSM</td><td>57.52</td><td>53.46</td><td>43.76</td><td>99.86</td><td>2.9</td><td>2.2</td></tr><tr><td>VNI-FGSM</td><td><strong>57.98</strong></td><td>53.96</td><td>42.88</td><td>99.84</td><td>2.76</td><td>2.24</td></tr><tr><td>NAA</td><td>19.62</td><td>14.92</td><td>12.18</td><td>79.96</td><td>2.18</td><td>1.4</td></tr><tr><td>RAP</td><td>53.14</td><td>53.12</td><td>42.68</td><td>95.68</td><td>3.48</td><td>2.84</td></tr><tr><td></td><td>Ours</td><td>57.68</td><td><strong>54.14</strong></td><td><strong>50.04</strong></td><td>51.62</td><td><strong>10.68</strong></td><td><strong>6.24</strong></td></tr><tr><td rowspan="7">R-r18</td><td>AutoAttack</td><td>13.7</td><td>15.8</td><td>10.82</td><td>14.6</td><td><strong>71.74</strong></td><td>10.78</td></tr><tr><td>UAP</td><td>11.52</td><td>9.32</td><td>8.46</td><td>10.90</td><td>1.44</td><td>1.16</td></tr><tr><td>UAPPGD</td><td>14.00</td><td>12.34</td><td>11.20</td><td>13.56</td><td>3.14</td><td>1.66</td></tr><tr><td>TI-FGSM</td><td>11.88</td><td>13.42</td><td>10.08</td><td>11.02</td><td>54.46</td><td>10.14</td></tr><tr><td>VMI-FGSM</td><td>17.00</td><td>17.80</td><td>12.12</td><td>16.08</td><td>64.98</td><td>11.94</td></tr><tr><td>VNI-FGSM</td><td>16.14</td><td>17.66</td><td>12.48</td><td>16.08</td><td>63.22</td><td>11.74</td></tr><tr><td>NAA</td><td>11.46</td><td>10.86</td><td>9.34</td><td>11.42</td><td>21.48</td><td>4.9</td></tr><tr><td rowspan="5">R-50-2</td><td>RAP</td><td>11.32</td><td>10.80</td><td>8.16</td><td>10.32</td><td>45.80</td><td>7.94</td></tr><tr><td>Ours</td><td><strong>37.14</strong></td><td><strong>33.2</strong></td><td><strong>33.76</strong></td><td><strong>29.90</strong></td><td><strong>29.84</strong></td><td><strong>12.94</strong></td></tr><tr><td>AutoAttack</td><td>20.14</td><td>22.76</td><td>17.36</td><td>19.44</td><td>15.42</td><td><strong>59.02</strong></td></tr><tr><td>UAP</td><td>9.88</td><td>7.60</td><td>6.96</td><td>8.62</td><td>1.84</td><td>1.24</td></tr><tr><td>UAPPGD</td><td>14.54</td><td>12.56</td><td>10.92</td><td>14.36</td><td>2.16</td><td>1.38</td></tr><tr><td rowspan="5">R-50-2</td><td>TI-FGSM</td><td>14.16</td><td>16.34</td><td>12.68</td><td>13.68</td><td>17.16</td><td>43.66</td></tr><tr><td>VMI-FGSM</td><td>24.22</td><td>26.66</td><td>20.12</td><td>23.86</td><td>17.82</td><td>54.56</td></tr><tr><td>VNI-FGSM</td><td>23.88</td><td>26.22</td><td>19.68</td><td>23.28</td><td>18.00</td><td>52.28</td></tr><tr><td>NAA</td><td>14.08</td><td>13.12</td><td>10.20</td><td>14.04</td><td>9.82</td><td>12.58</td></tr><tr><td>RAP</td><td>13.82</td><td>14.06</td><td>10.52</td><td>13.5</td><td>15.54</td><td>34.1</td></tr><tr><td></td><td>Ours</td><td><strong>42.18</strong></td><td><strong>42.5</strong></td><td><strong>42.46</strong></td><td><strong>34.22</strong></td><td><strong>23.7</strong></td><td><strong>18.02</strong></td></tr></tbody></table>