SlowGuess/NeurIPS_2023_OCR huggingface dataset:
3.3 The Proposed QuadAttacK
We first show that any specified ordered top- $K$  attack requirements,  $T$ , can be cast as linear constraints in a compact matrix form, denoted by  $D_T$ . Consider  $\ell_2$  norm of Eqn. 2, we can rewrite it as,
$$
\underset {\delta} {\text {m i n i m i z e}} \quad \| \hat {x} - x \| _ {2} ^ {2}, \tag {6}
$$
$$
\text {s u b j e c t} D _ {T} \cdot \hat {l} > 0, \quad D _ {T} \in \{- 1, 0, 1 \} ^ {C - 1 \times C},
$$
where  $D_{T}$  is a  $C - 1 \times C$  matrix constructed from the specified targets  $T$ , and  $C$  is the number of classes in total. Consider the aforementioned toy example where  $C = 5$  and the ordered top-3 attack targets are  $T = [2,3,1]$ , we have,
$$
\hat {l} _ {2} - \hat {l} _ {3} > 0,
$$
$$
\begin{array}{l} \hat {l} _ {3} - \hat {l} _ {1} > 0, \\ \hat {l} _ {1} - \hat {l} _ {4} > 0, \end{array} \qquad \qquad (7) \qquad D _ {T} \cdot \hat {l} > 0, \quad D _ {T} = \left[ \begin{array}{c c c c c} - 1 & 0 & 1 & 0 & 0 \\ 1 & 0 & 0 & - 1 & 0 \\ 1 & 0 & 0 & 0 & - 1 \end{array} \right],
$$
$$
\hat {l} _ {1} - \hat {l} _ {5} > 0, \tag {8}
$$
where Eqn. 7 is the vanilla form of expressing the specified top-3 attack requirements, and Eqn. 8 is the equivalent compact matrix form.
However, Eqn. 6 can not be easily solved via QP due to the highly nonconvex nature of the feature backbone  $F$  in the third term of the constraints. This nonconvexity hinders the ability to solve the problem and find an optimal solution while satisfying constraints. Eqn. 6 aims to directly seek the adversarial perturbations in the data space, which has to include the nonconvex feature backbone  $F$  in the optimization. Since  $F$  is a frozen transformation in learning attacks, and the head classifier  $f$  is a linear function, we can separate the learning of ordered top-  $K$  attacks in two steps:
i) We first satisfy the ordered top- $K$  constraints without resorting to hand-crafted surrogate losses via QP in the feature embedding space (i.e., the output space of  $F$  and the input space of  $f$ ). The last
constraint in Eqn. 6 will be replaced by  $\hat{l} = A\cdot \bar{z} +B$  (see Eqn. 1). Denote by  $\delta$  the image perturbation at the current iteration. We have the current feature embedding vector  $\bar{z} = \mathrm{Mean}(F(x + \delta ;\theta))$ . our proposed QuadAttac  $K$  first solves the perturbed  $\hat{z}$  via QP,
$$
\underset {\hat {z}} {\text {m i n i m i z e}} \quad \left\| \hat {z} - \bar {z} \right\| _ {2} ^ {2}, \tag {9}
$$
subject to  $D_{T}\cdot \hat{l} >0$
$$
\hat {l} = A \cdot \hat {z} + B.
$$
ii) After having found  $\hat{z}$  we then use the residual (Euclidean distance)  $||\bar{z} - \hat{z}||_2^2$  as the loss to find the perturbed image  $\hat{x}$ . Specifically, with the optimized  $\hat{z}$  (i.e., the closest point in latent space where top- $K$  attack constraints are satisfied), we compute the image perturbation using vanilla one-step back-propagation with a learning rate  $\gamma$  and a loss weighting parameter  $\lambda$ . We find that both  $\gamma$  or  $\lambda$  may be used to control the tradeoff between attack success and magnitude of the perturbation found (see Fig. 3 and Appendix A). We have,
$$
\delta^ {*} = \delta - \gamma \cdot \frac {\partial}{\partial \delta} (\lambda \cdot | | \hat {\bar {z}} - \bar {z} | | _ {2} + | | \delta | | _ {p}), \tag {10}
$$
$$
\hat {\delta} = \operatorname {C l a m p} (x + \delta^ {*}; 0, 1) - x, \quad \hat {x} = x + \hat {\delta},
$$
where  $\mathrm{Clamp}(\cdot ;0,1)$  is an element-wise projection of the input onto [0, 1].
Understanding QuadAttacK: In our QuadAttacK, the matrix  $A$  plays a crucial role in encoding useful semantic class relationships. For instance, if classes like "cat" and "building" have distinct and separate representations in the latent space, the matrix  $A$  will reflect these differences. As a result, the optimization problem would naturally prioritize target logits that have high activations for either "cat" or "building," but not both simultaneously. This semantic constraint in the feature embedding space helps guide the search towards relevant and meaningful perturbations that maintain the desired order constraints while avoiding conflicting activations for disparate classes. By incorporating the matrix  $A$  to capture semantic relationships, our QuadAttacK not only overcomes the nonconvexity challenge of the original problem but also leverages meaningful class information to guide the search and generate effective adversarial perturbations.
3.4 Fast and Parallel Quadratic Programming Solutions
An efficient solver is crucial for addressing the QP formulation of learning ordered top- $K$  adversarial attacks. To that end, a fast, parallel, and GPU-capable quadratic programming solver is required. In this context, the qpth package created by [Amos and Kolter, 2017] emerges as a suitable choice, providing a PyTorch-enabled differentiable quadratic programming solver that enables efficient optimization while harnessing the power of GPUs,
$$
\underset {\hat {z}} {\text {m i n i m i z e}} \quad \frac {1}{2} \hat {z} ^ {\top} Q \hat {z} + p ^ {\top} \hat {z} \tag {11}
$$
subject to  $G\hat{z}\leq h$
$$
W \hat {z} = b.
$$
The main challenge lies in transforming our current formulation into one compatible with the qpth package (Eqn. 11). This involves structuring the objective and constraints to match the required standard form, as well as building the required matrices  $Q$ ,  $G$  and  $h$  from attack targets in an efficient and parallel way. Finding  $Q$  and  $p$  is straightforward from an expansion of our squared Euclidean distance objective since  $||\bar{z} - \hat{z}||_2^2 = \hat{z}^\top \hat{z} - 2\bar{z}^\top \hat{z} + \bar{z}^\top \bar{z}$ . The term  $\bar{z}^\top \bar{z}$  is a constant in our optimization so we can just consider the optimization of  $\hat{z}^T \hat{z} - 2\bar{z}^T \hat{z}$ . From this we can trivially see  $Q = 2I$  where  $I$  is the identity matrix and  $p = -2\bar{z}^\top$ . Further, since we need no equality constraints  $W = 0, b = 0$ . To formulate  $G$  and  $h$  we can rewrite the constraints in Eqn 9 as follows,
$$
D _ {T} \cdot (A \hat {z} + B) > 0 \quad \Rightarrow \quad - D _ {T} \cdot A \hat {z} \leq D _ {T} \cdot B - \eta , \tag {12}
$$
where  $\eta$  is the slack variable which is a small non-zero constant to allow our constraints to define a closed-convex set allowing equality in our constraint but still maintaining top- $K$  order when the constraint is satisfied. We have found  $\eta = 0.2$  is an acceptable value, but other small values will also work. Intuitively if our current value for  $\hat{z}$  does not satisfy our top- $K$  constraints then  $\eta = 0$  would find a  $\hat{z}$  on the boundary of the latent space that satisfies our constraints. The higher  $\eta$  is the further away from the boundary and inside the set  $\hat{z}$  becomes. From the above rearrangement we can easily see  $G = -D_{T} \cdot A$  and  $h = D_{T} \cdot B - \eta$  in Eqn. 11.
(a) DEiT-S and ResNet-50 w/  $K = 5$  and  $1 \times 30$
Figure 3: ASR vs  $\ell_{2}$  energy tradeoff curves, which holistically compare the capacity of our QuadAttacK against the prior art - the adversarial distillation method [Zhang and Wu, 2020], verifying our QuadAttacK's advantages.
(b) DEiT-S and ResNet-50 w/  $K = 10$  and  $1 \times 60$
In this section, we evaluate our QuadAttac  $K$  with  $K = 1,5,10,15,20$  in the ImageNet-1k benchmark [Russakovsky et al., 2015] using two representative pretrained ConvNets: the ResNet-50 [He et al., 2016] and the DenseNet-121 Huang et al. [2017], and two representative pretrained Transformers: the vanilla Vision Transformer (Base) [Dosovitskiy et al., 2020] and the data-efficient variant DEiT (small) [Touvron et al., 2021]. The ImageNet-1k pretrained checkpoints of the four networks are from the mmpretrain package [Contributors, 2023], in which we implement our QuadAttac  $K$  and re-produce both  $\mathrm{CW}^K$  and AD [Zhang and Wu, 2020].
Data and Metric. In ImageNet-1k [Russakovsky et al., 2015], there are 50,000 images for validation. To study attacks, we utilize the subset of images for which the predictions of all the four networks are correct. To reduce the computational demand, we randomly sample a smaller subset following [Zhang and Wu, 2020]: We iterate over all 1000 categories and randomly sample an image labeled with it, resulting in 1000 test images in total. For each  $K$ , we randomly sample 5 groups of  $K$  targets with ground-truth (GT) label exclusive for each image in our selected test set, and then compute the Best, Mean and Worst ASRs, as well as the associated  $\ell_1$ ,  $\ell_2$  and  $\ell_{\infty}$  energies. We mainly focus on low-cost learning of attacks (within 60 steps of optimization) for better practicality and better understanding of the underlying effectiveness of different attack methods. We also learn attacks with higher budgets  $(9 \times 60$  and  $9 \times 30)$  for  $K = 5, 10$ . We use a default value for the trade-off parameter  $\lambda$  in Eqn. 3 and Eqn. 10. Details are provided in the Appendix A and our released code repository.
Baselines. We compare our QuadAttac  $K$  with previous state-of-the-art methods, namely, the top- $K$  extended  $\mathrm{CW}^K$  method and the Adversarial Distillation (AD) proposed in [Zhang and Wu, 2020]. We reproduce them in our code repository and test them on the four networks under the same settings for fair comparisons.
An important detail in optimization: In optimization, perturbations are initialized with some small energy white Gaussian noise. During the initial steps of optimization, the optimizer takes steps with large increases in perturbation energy since happens to be away from many required energies for a successful attack. These large increases in energy induces a momentum in the optimizer, which makes it difficult to reduce L2 energy in future iterations even if our objective function's gradient points towards a direction with minimal energy. By introducing a small number of warmup steps (e.g., 5, as commonly done in training a network on ImageNet from scratch) after which the optimizer's state is reset, we observe the performance of all analyzed methods are significantly improved. Our QuadAttacK benefits most.
Results. The comparison results are shown in Table 1. Our proposed QuadAttac  $K$  retains performance comparably for  $K = 1$ , and obtains consistently better performance, often by a large margin, for  $K = 5, 10, 15, 20$ . Especially, it addresses the challenges associated with large values of  $K$  (e.g.  $K \geq 10$ ) under the low-cost budget setting ( $1 \times 60$ ). The prior art completely fails, while our QuadAttac  $K$  can still obtain appealing ASRs.
Analyses on the Trade-Off Between ASRs and Attack Energies. Since we have two metrics (ASR and attack energy), the trade-off between them needs to be compared in order to comprehensively understand different methods. The trade-off curves (Fig. 3) explore the concept of how a higher success rate may be achieved by choosing to have higher energies and conversely a lower energy may be achieved by choosing to have a lower success rate. They holistically compare the capacity of QuadAttacK against the prior art – the adversarial distillation method [Zhang and Wu, 2020].
Protocol	Attack Method	Best	Mean	Worst
ASR↑	l1↓	l2↓	l∞↓	ASR↑	l1↓	l2↓	l∞↓	ASR↑	l1↓	l2↓	l∞↓
ResNet-50 [He et al., 2016]
Top-20	QuadAttacK1×60	0.2760	2350.79	7.71	0.0941	0.2546	2363.38	7.74	0.0939	0.2420	2381.09	7.80	0.0936
Top-15	QuadAttacK1×60	0.9520	1960.29	6.45	0.0763	0.9400	1957.23	6.44	0.0763	0.9290	1963.93	6.46	0.0767
QuadAttacK1×30	0.3640	2275.78	7.31	0.0711	0.3270	2279.91	7.32	0.0710	0.3050	2266.93	7.28	0.0706
Top-10	AD1×60	0.1150	1584.19	5.23	0.0687	0.1002	1576.03	5.21	0.0685	0.0880	1578.91	5.22	0.0682
QuadAttacK1×60	0.9990	1538.45	5.08	0.0560	0.9982	1534.04	5.06	0.0561	0.9970	1527.30	5.04	0.0559
QuadAttacK1×30	0.9640	1789.45	5.75	0.0538	0.9576	1797.20	5.78	0.0541	0.9530	1795.44	5.77	0.0540
AD9×60	0.2210	1341.07	4.49	0.0643	0.2020	1352.55	4.53	0.0643	0.1900	1370.06	4.58	0.0637
QuadAttacK9×60	1.0000	533.11	1.92	0.0430	0.9992	540.04	1.94	0.0433	0.9970	537.46	1.93	0.0431
QuadAttacK9×30	0.9950	1052.24	3.55	0.0471	0.9926	1052.56	3.55	0.0470	0.9910	1045.70	3.53	0.0471
Top-5	CW1×30	0.2100	1377.22	4.40	0.0413	0.1934	1378.16	4.40	0.0415	0.1800	1374.54	4.39	0.0414
AD1×30	0.8480	1351.05	4.32	0.0389	0.8324	1352.17	4.32	0.0390	0.8140	1357.48	4.34	0.0391
QuadAttacK1×30	0.9450	765.54	2.55	0.0289	0.9380	759.47	2.54	0.0289	0.9330	757.77	2.53	0.0289
CW9×30	0.4470	1003.94	3.28	0.0382	0.4216	1026.70	3.35	0.0384	0.4080	1042.19	3.40	0.0384
AD9×30	0.9550	549.73	1.91	0.0342	0.9498	557.15	1.93	0.0342	0.9380	553.08	1.92	0.0341
QuadAttacK9×30	0.9970	462.81	1.60	0.0277	0.9948	465.20	1.61	0.0278	0.9930	461.15	1.60	0.0277
Top-1	CW1×30	1.0000	483.86	1.53	0.0142	0.9978	483.88	1.53	0.0142	0.9960	485.16	1.54	0.0142
AD1×30	1.0000	465.62	1.48	0.0141	0.9990	467.67	1.48	0.0141	0.9980	469.54	1.49	0.0142
QuadAttacK1×30	1.0000	446.84	1.44	0.0143	0.9990	448.22	1.44	0.0143	0.9980	448.70	1.45	0.0144
DenseNet-121 [Huang et al., 2017]
Top-20	\( \mathbf{QuadAttacK_{1\times 60}} \)	0.9310	2394.04	7.82	0.0907	0.9184	2388.03	7.80	0.0908	0.9070	2387.15	7.80	0.0908
\( \mathbf{QuadAttacK_{1\times 30}} \)	0.3280	2626.42	8.42	0.0793	0.3204	2630.12	8.43	0.0794	0.3160	2632.14	8.44	0.0795
Top-15	\( \mathbf{QuadAttacK_{1\times 60}} \)	0.9910	1880.34	6.17	0.0682	0.9846	1882.11	6.18	0.0683	0.9790	1874.28	6.15	0.0679
\( \mathbf{QuadAttacK_{1\times 30}} \)	0.9130	2176.90	6.98	0.0644	0.9072	2174.17	6.97	0.0641	0.9020	2167.97	6.95	0.0639
Top-10	\( CW_{1\times 60}^{K} \)	0.1650	2088.38	6.74	0.0755	0.1388	2090.22	6.75	0.0750	0.1260	2082.13	6.73	0.0750
\( AD_{1\times 60} \)	0.5200	1432.66	4.78	0.0650	0.5110	1426.53	4.76	0.0646	0.4920	1429.76	4.77	0.0641
\( QuadAttacK_{1\times 60} \)	0.9980	1387.24	4.61	0.0495	0.9960	1395.19	4.63	0.0498	0.9930	1392.97	4.62	0.0497
\( QuadAttacK_{1\times 30} \)	0.9930	1623.21	5.23	0.0471	0.9894	1626.75	5.24	0.0471	0.9870	1637.11	5.27	0.0470
\( CW_{9\times 60}^{K} \)	0.4630	1902.17	6.19	0.0726	0.4470	1895.21	6.16	0.0724	0.4120	1902.44	6.18	0.0723
\( AD_{9\times 60} \)	0.6830	1070.25	3.66	0.0588	0.6648	1073.88	3.67	0.0587	0.6460	1071.64	3.66	0.0587
\( QuadAttacK_{9\times 60} \)	0.9990	451.30	1.61	0.0394	0.9984	443.78	1.59	0.0393	0.9970	446.99	1.60	0.0399
\( AD_{9\times 30} \)	0.0940	1588.57	5.17	0.0581	0.0778	1572.15	5.12	0.0578	0.0690	1572.70	5.13	0.0580
\( QuadAttacK_{9\times 30} \)	0.9990	838.91	2.84	0.0406	0.9956	841.88	2.85	0.0407	0.9930	843.84	2.86	0.0407
Top-5	\( CW_{1\times 30}^{K} \)	0.5560	1062.48	3.45	0.0376	0.5358	1064.42	3.46	0.0377	0.5130	1057.52	3.44	0.0378
\( AD_{1\times 30} \)	0.9120	716.61	2.46	0.0355	0.9040	714.59	2.45	0.0354	0.8890	710.44	2.44	0.0354
\( QuadAttacK_{1\times 30} \)	0.9400	676.94	2.28	0.0269	0.9284	680.24	2.28	0.0268	0.9130	677.48	2.28	0.0267
\( CW_{9\times 30}^{K} \)	0.8690	899.15	2.97	0.0363	0.8566	905.02	2.99	0.0364	0.8430	905.64	2.99	0.0364
\( AD_{9\times 30} \)	0.9810	438.53	1.55	0.0326	0.9694	441.40	1.56	0.0329	0.9570	447.02	1.58	0.0332
\( QuadAttacK_{9\times 30} \)	0.9980	427.58	1.47	0.0259	0.9932	431.84	1.49	0.0261	0.9900	424.47	1.46	0.0262
Top-1	\( CW_{1\times 30}^{K} \)	1.0000	437.41	1.39	0.0134	0.9988	442.44	1.41	0.0135	0.9980	443.43	1.41	0.0135
\( AD_{1\times 30} \)	1.0000	422.10	1.35	0.0137	0.9990	426.98	1.36	0.0137	0.9970	428.25	1.37	0.0137
\( QuadAttacK_{1\times 30} \)	1.0000	377.99	1.25	0.0138	0.9990	383.13	1.26	0.0138	0.9970	386.19	1.27	0.0138
ViT-B [Dosovitskiy et al., 2020]
Top-20	\( \mathbf{QuadAttacK_{1\times 60}} \)	0.6100	2651.86	8.68	0.0847	0.5964	2642.73	8.65	0.0841	0.5810	2640.33	8.65	0.0841
Top-15	\( \mathbf{QuadAttacK_{1\times 60}} \)	0.7150	1919.22	6.28	0.0618	0.7062	1920.08	6.28	0.0618	0.6950	1927.03	6.30	0.0620
Top-10	\( \mathbf{QuadAttacK_{1\times 60}} \)	0.8660	1582.15	5.09	0.0422	0.8480	1579.52	5.08	0.0421	0.8230	1595.84	5.13	0.0420
\( AD_{9\times 60} \)	0.0900	1361.59	4.45	0.0472	0.0690	1398.53	4.56	0.0474	0.0600	1380.14	4.52	0.0476
\( \mathbf{QuadAttacK_{9\times 60}} \)	0.9850	991.22	3.36	0.0383	0.9802	978.89	3.33	0.0383	0.9730	979.63	3.33	0.0383
\( \mathbf{QuadAttacK_{9\times 30}} \)	0.0590	1200.33	3.80	0.0295	0.0550	1193.83	3.78	0.0296	0.0470	1156.53	3.68	0.0294
Top-5	\( AD_{1\times 30} \)	0.2650	1076.10	3.42	0.0286	0.2450	1079.95	3.43	0.0285	0.2320	1089.83	3.46	0.0285
\( \mathbf{QuadAttacK_{1\times 30}} \)	0.4960	1060.31	3.35	0.0267	0.4692	1062.17	3.35	0.0267	0.4380	1060.54	3.35	0.0267
\( CW_{9\times 30}^{K} \)	0.1110	999.43	3.18	0.0278	0.1070	984.00	3.14	0.0277	0.0970	963.58	3.08	0.0275
\( AD_{9\times 30} \)	0.4760	947.39	3.06	0.0282	0.4580	950.24	3.07	0.0282	0.4320	945.25	3.05	0.0282
\( \mathbf{QuadAttacK_{9\times 30}} \)	0.7670	910.88	2.95	0.0264	0.7530	922.78	2.98	0.0264	0.7390	945.03	3.04	0.0266
Top-1	\( CW_{1\times 30}^{K} \)	0.9940	418.85	1.44	0.0162	0.9914	420.89	1.45	0.0163	0.9890	423.64	1.46	0.0164
\( AD_{1\times 30} \)	0.9910	418.44	1.46	0.0176	0.9898	414.87	1.45	0.0176	0.9870	410.74	1.43	0.0174
\( \mathbf{QuadAttacK_{1\times 30}} \)	0.9910	451.55	1.53	0.0169	0.9884	444.51	1.52	0.0169	0.9840	434.08	1.48	0.0167
DeiT-S [Touvron et al., 2021]
Top-20	QuadAttacK1×60	0.7670	2164.35	7.02	0.0707	0.7496	2170.06	7.04	0.0711	0.7320	2179.99	7.08	0.0713
Top-15	QuadAttacK1×60	0.9400	1710.90	5.55	0.0537	0.9308	1712.43	5.55	0.0535	0.9170	1706.33	5.53	0.0534
QuadAttacK1×30	0.0490	1414.01	4.50	0.0379	0.0444	1416.91	4.51	0.0381	0.0410	1427.73	4.54	0.0379
Top-10	AD1×60	0.0610	1247.46	4.05	0.0430	0.0534	1224.28	3.97	0.0419	0.0480	1225.32	3.97	0.0421
QuadAttacK1×60	0.9800	1161.60	3.75	0.0356	0.9778	1163.31	3.76	0.0358	0.9750	1168.52	3.78	0.0358
QuadAttacK1×30	0.2000	1076.08	3.41	0.0278	0.1958	1067.14	3.38	0.0275	0.1920	1062.29	3.36	0.0273
CW9×60	0.0390	1000.92	3.24	0.0360	0.0334	1000.35	3.23	0.0352	0.0300	987.21	3.19	0.0350
AD9×60	0.1250	812.31	2.71	0.0356	0.1122	829.99	2.76	0.0356	0.1000	819.51	2.73	0.0350
QuadAttacK9×60	0.9990	546.66	1.95	0.0294	0.9978	543.50	1.95	0.0296	0.9950	542.95	1.95	0.0298
QuadAttacK9×30	0.4410	1019.14	3.25	0.0274	0.4232	1033.34	3.29	0.0277	0.4090	1027.87	3.27	0.0275
Top-5	CW1×30	0.0730	924.23	2.94	0.0266	0.0670	913.38	2.91	0.0265	0.0620	903.37	2.88	0.0263
AD1×30	0.4830	1010.38	3.20	0.0271	0.4640	1016.17	3.22	0.0272	0.4400	1019.77	3.23	0.0273
QuadAttacK1×30	0.8250	849.16	2.72	0.0246	0.8068	843.14	2.71	0.0244	0.8000	846.60	2.72	0.0245
CW9×30	0.2310	909.93	2.91	0.0268	0.2204	902.41	2.88	0.0266	0.2160	898.71	2.87	0.0264
AD9×30	0.7510	858.41	2.78	0.0267	0.7270	836.38	2.71	0.0264	0.7080	836.42	2.72	0.0265
QuadAttacK9×30	0.9550	592.60	2.00	0.0229	0.9528	579.32	1.96	0.0227	0.9500	573.48	1.94	0.0226
Top-1	CW1×30	0.9990	417.62	1.39	0.0149	0.9976	415.49	1.38	0.0148	0.9970	410.32	1.36	0.0147
AD1×30	1.0000	407.16	1.37	0.0158	0.9982	404.24	1.36	0.0157	0.9970	397.79	1.34	0.0156
QuadAttacK1×30	0.9960	294.88	1.08	0.0153	0.9936	295.00	1.08	0.0153	0.9900	297.33	1.09	0.0154
Table 1: Comparisons under the ordered top-  $K$  targeted attack protocol using randomly selected and ordered  $K$  targets (GT exclusive) in ImageNet using four popular models (ResNet-50, DenseNet-121, ViT-B and DEiT-S). The  ${\mathrm{{CW}}}^{K}$  and AD methods are proposed in [Zhang and Wu, 2020]. We test  $9 \times  {30}$  for  $K = 5$  ,and  $9 \times  \{ {30},{60}\}$  for  $K = {10}$  . For each protocol (e.g.,top-20) and each budget (e.g.,  $1 \times  {60}$  ),if an attack method (e.g.,  ${\mathrm{{CW}}}^{K}$  or AD) is not listed, it means that it fails completely, i.e., zero ASR, and thus is omitted in the table for clarity.
Qualitative Results. We show more examples in Appendix B. From those, we note that for our QuadAttac  $K$ , when the target classes deviate significantly from the original predicted classes, we often observe a perturbation that achieves the prescribed top-  $K$  targets without a substantial margin between each of the top-  $K$  targets. This outcome reflects the desirable effect of our approach, as the primary objective of the ordered top-  $K$  attack is to enforce a specific class order rather than optimizing for class probability differences. Our method's strength lies in its ability to handle such scenarios without relying on explicit assumptions about the distances between classes. By prioritizing the order constraints, our QuadAttac  $K$  offers a robust solution that aligns with the fundamental goal of enforcing class order in adversarial attacks.
5 Limitations of Our QuadAttacK
There are two main limitations that worth further exploring. Our proposed QuadAttac  $K$  is specifically designed for clear-box attack setting, which makes it not directly applicable to opaque-box attacks. The attacks learned by our QuadAttack  $K$  are not easily transferable between different networks, as they are specifically optimized in the feature embedding space for the target model. Exploring the transferability of attacks and developing more generalizable strategies across various networks could be an intriguing direction for future research. In addition, our QuadAttac  $K$  entails solving a QP at each iteration, which introduces additional computational overhead compared to methods like  $\mathrm{CW}^K$  and AD [Zhang and Wu, 2020]. For example, for ResNet-50, we observed an average QuadAttac  $K$  performs 2.47 attack iterations per second whereas AD performs 32.02 iterations per second (a factor of 12.96). For ViT-B, QuadAtta  $K$  performs 2.96 attack iterations per second whereas AD performs 11.86 iterations per second (a factor of 4). We note that as the target model becomes larger, the adversarial loss constitutes a smaller fraction of total runtime thus the ratio tends toward one. Further, we note that quicker attack iterations of QuadAttac  $K$  on ViT-B which indicate our QP solver converges faster on ViT-B attacks. To address the overhead of our QuadAttac  $K$ , we will explore and compare how the QP solver could be adjusted to initialize the QP solver at the previous iteration's solution to nearly eradicate the cost of the QP solver in future work.
Our proposed QuadAttac  $K$  method showcases the effectiveness of utilizing QP techniques in the challenging domain of learning ordered top-  $K$  clear-box targeted adversarial attacks. The underlying QP formulation offers opportunities for exploring other applications beyond adversarial attacks. For instance, it could be leveraged to design new loss functions going beyond the traditional cross-entropy loss or the label smoothing variant [Szegedy et al., 2015], and thus jointly optimizing accuracy and robustness. We can enforce semantically meaningful class orders in training a network from scratch, thus allowing for the incorporation of explicit constraints in neural network predictions and potentially resulting in a more interpretable and controlled decision-making process.
Potential Negative Societal Impact. As discussed in the introduction, there are some potential scenarios in practice for which the proposed ordered top- $K$  adversarial attacks may be risky if applied. However, since we focus on clear-box attacks, they are less directly applicable in practice compared to opaque-box attacks, which makes the concern less serious.
This paper presents a quadratic programming (QP) based method for learning ordered top-  $K$  clearbox targeted attacks. By formulating the task as a constrained optimization problem, we demonstrate the capability to achieve successful attacks with larger values of  $K$  ( $K > 10$ ) compared to previous methods. The proposed QuadAttac  $K$  is tested in the ImageNet-1k classification using ResNet-50 and DenseNet-121, and ViT-B and DEiT-S. It successfully pushes the boundary of successful ordered top-  $K$  attacks from  $K = 10$  up to  $K = 20$  at a cheap budget ( $1 \times 60$ ) and further improves attack success rates for  $K = 5$  for all tested models, while retaining the performance for  $K = 1$ . The promising results highlight the potential of QP and constrained optimization as powerful tools opening new avenues for research in adversarial attacks and beyond.