Generating Adversarial Examples with Task Oriented Multi-Objective Optimization
Authors: Anh Tuan Bui
Trung Le
He Zhao
Quan Hung Tran
Paul Montague
Dinh Phung
Venue: Submitted to ICLR 2023 (2023)
Keywords: Multi-Objective Optimization
Adversarial Machine Learning

Abstract: Deep learning models, even the-state-of-the-art ones, are highly vulnerable to adversarial examples. Adversarial training is one of the most efficient methods to improve the model's robustness. The key factor for the success of adversarial training is the capability to generate qualified and divergent adversarial examples which satisfy some objectives/goals (e.g., finding adversarial examples that maximize the model losses for simultaneously attacking multiple models). Therefore, multi-objective optimization (MOO) is a natural tool for adversarial example generation, where we search adversarial examples simultaneously maximizing some objectives/goals. However, we observe that a naive application of MOO tends to maximize all objectives/goals equally, without caring if an objective/goal has been achieved yet. This leads to useless effort to further improve the goal-achieved tasks, while putting less focus on the goal-unachieved tasks. In this paper, we propose \emph{Task Oriented MOO} to address this issue, in the context where we can explicitly define the goal achievement for a task. Our principle is to only maintain the goal-achieved tasks, while letting the optimizer spend more effort on improving the goal-unachieved tasks. We conduct comprehensive experiments for our Task Oriented MOO on various adversarial example generation schemes. The experimental results firmly demonstrate the merit of our proposed approach.

Under review as a conference paper at ICLR 2023
GENERATING ADVERSARIAL EXAMPLES WITH TASK ORIENTED MULTI-OBJECTIVE OPTIMIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Deep learning models, even the-state-of-the- ones, are highly vulnerable to adversarial examples. Adversarial training is one the most efficient methods to improve the model's robustness. The key factor for the success of adversarial training is the capability to generate qualified and divergent adversarial examples which satisfy some objectives/goals (e.g., finding adversarial examples that maxi- mize the model losses for simultaneously attacking multiple models). Therefore, multi-objective optimization (MOO) is natural tool for adversarial example gen- eration to achieve multiple objectives/goals simultancously. However, we observe that naive application of MOO tends to maximize all objectives/goals equally, without caring if an objective/goal has been achieved yet. This leads to useless effort to further improve the goal-achieved tasks, while putting less focus on the goal-unachin unachieved tasks. In this paper, we propose Task Oriented MOO to address this issue, the context where we can explicitly define the goal achievement for a task. Our principle is to only maintain the goal-achieved tasks, while letting the optimizer spend more effort on improving the goal- coal-unachieved tasks. We conduct comprchensive experiments for our Task Oriented MOO various adversarial example generation schemes. The experimental results firmly demonstrate the merit of our proposed approach.
INTRODUCTION
Deep neural networks are powerful models that achieve impressive performance across various domains such as bioinformatics (Spencer al., 2015), speech recognition (Hinton et al. 2012).
computer vision (He et al., (0016), and natural language processing (Vaswani et all] 2017). Despite achieving state-of-the-a performance, these models are extremely fragile, as one can easily craft small and imperceptible adversarial perturbations of input data to fool them, hence resulting in high misclassifications (Szegedy et al. 2014 Goodfellow et al., 2013). Accordingly, adversarial training (AT) (Madry al. 2018 Zhang et al. 2019) has been proven to be one of the most efficient approaches to strengthen model robustness (Athalye et al. 2018). AT requires challenging models with divergent and qualified adversarial examples (Madry al. 2018 Zhang al., 2019 Bui et al.) 2021) so that the robustified models can defend against adversarial examples. Therefore, generating adversarial examples is an important research topic in Adversarial Machine Learning (AML). Several perturbation based attacks have been proposed, notably PGD (Madry et al. 2018 8), CW (Carlini Wagner 2017). and AutoAttack (Croce & Hein 2020). Most of them aim optimize a single objective/goal, e.g., maximizing the cross- cross-entropy (CE) loss w.r.t. the ground-trute label (Goodfellow al. 2015 Madry et 2018), maximizing the Kullback-Leibler (KL) divergence w.r.t. the predicted probabilities of benign example (Zhang et al. 2019), or minimizing a combination of perturbation Carlini & Wagner](2017)
size and predicted loss to a targeted class as
However, in many contexts, we need to find qualified adversarial examples satisfying multiple objectives/goals, e.g., finding an adversarial example that can attack simultaneously multiple models in an ensemble model (Pang et al. 2019 Bui et al. (021), finding an universal perturbation that can attack simultaneously multiple benign examples MMoosvvi-Dezfooo
et al. 2017). Obviously, these adversarial generations have nature of multi- multi-objective problem rather than single-objectivy one. Consequently, using single-objectin adversarial examples leads to a much less adversarial robustness in ensemble learning discussed in Section 4.2 and Appendix D.2

---

Under review as a conference paper at ICLR 2023
Multi-Objeecto Optimization (MOO) (Désidéri 2012) is optimization problem to find Pareto optimality that aims to optimize multiple objective functions. In a nutshell,, MOO is a natural tool for the aforementioned multi- multi-objective adversarial generations. However, direct and naive application of MOO to generating robust adversarial examples for multiple models or ensemble of transformations does not work satisfactorily (cf. Appendix E Concretely, it can be observed that the tasks are not optimized equally. The optimizing process focuses too much on one dominating task and can be trapped easily by it, hence leading to downgraded attack performances.
Intuitively, for multi-objective adversarial generations, we can explicitly investigate if an objective or a task achieves or fails to achieve its goal (e.g.. the current adversarial example can fool a model successfully or unsuccessfully in multiple models). To avoid some tasks dominating others during the optimization process, we can favour more the tasks that are failing and pay less attention to the tasks that are performing well. For example, in the context of attacking multiple models, we update an adversarial example x to favor the models that x has not attacked successfully yet, while trying to maintain the attack capability of x on the already successful models. In this way, we expect that no task really dominates others and all tasks can be updated equally to fulfill their goals.
Bearing this in mind, we propose new framework named TAsk Oriented Multi- Mujei-OOeective Optimization (TA-MOO) with multi-objecttive adversarial generations as the demonstrating ap- plications. Specifically, we learn weight vector (i.e., each dimension is the weight for task) lying on a simplex corresponding to all tasks. To favor the unsuccessful tasks while maintaining the success of the successful ones, propose geometry-based regularization term that represents the distance between the original simplex and a reduced simplex which involves the weight vectors for the currently unsuccessful tasks only. Furthermore, along with the original quadratic term of the standard MOO helping to improve all tasks, minimizing our geometry-based regularization term encourages the weights of the goal-achieved tasks be as small as possible, while inspiring those for the -nachheee ones to have a sum close to 1. By doing so, we aim to focus more on improving the boal-unachieved tasks, while still maintain the performance of goal-achieved tasks.
Most related work to ours is Wang et al. (2021), which considers the worst-case performance across all tasks. However, this original principle reduces the generalizability to other tasks. To mitigate this issue, specific regularization was proposed to balance all tasks' weights. Our work, which casts an adversarial generation task as a multi-objective optimization problem, conceptually different from that work, although both methods can be applied to similar tasks. Further discussion about relate work can be found in Appendix A
To summarize, our contributions in this work include: (C1) Ours is among the first works that views an adversarial generation task as multi-ohjective optimization problem and comprehensively study the issues when applying multi-objective optimization to tackle this adversarial generation task. (C2) To mitigate the shortcomings of the original MOO (Désidéri 2012] [Sener & Koltun| (018) when applying to multi-objective adversarial generation, we propose the TA-MOO framework which employs geometry-basee regularization term to favor the unsuccessful tasks, while trying to maintain the performance of the already successful tasks. (C3) We conduct comprehensive experiments for three adversarial generation tasks and one adversarial training task including: (i) attacking multiple models, (ii) learning universal perturbation, (iii) attacking over many data transformations, and (iv) adversarial training on ensemble learning setting. The experimental results show that our TA-MOO outperforms the basclines by wide margin on the three aforementioned adversarial generation tasks. More importantly, our adversary brings great benefit improving adversarial robustness.
2 BACKGROUND
We revisit the background of multi-objective optimization (MOO), which lays the foundation for our
task-oriented MOO in the sequel. Given multiple objective functions f (6) : [fi (6) ..... ...;,, fm (5)
where each fa RRd R. we aim to find the Pareto optimal solution that simultaneously maximizes all objective functions:
max f()) = (f1 (8), .-.., Fm (8)
While there are variety of MOO solvers (Miettinen) 2012 Ehrgott 2005), in this paper, we adapt from the mulli-gradicn descent algorithm (MGDA) that was proposed suitably for end-to-end learning by Désidéri (2012). Specifically, MGDA combines the gradients of individual objectives single
2

---

Under review as a conference paper at ICLR 2023
optimal direction that increases all objectives simultaneously. The optimal direction corresponds to the minimum-nom point that can be found by solving the quadratic programming problem:
w argmin w² Qw,
where Am = E ||||| = 13 is the m-simplex and Q R is the matrix with Qij
Vafi (6)" Vaf; (6). Finally, the solution of the problem 1 can be found iteratively with each update step = 8 + 7g where g is the combined gradient g = _i=1 w, Vaf' (6) and > is a sufficiently small learning rate. Furthermore, [ésidéér (2012) also proved that by using an appropriate learning rate at each step, we reach the Pareto optimality point d" at which there exist w E Am such that E we Vali (6*)
OUR PROPOSED METHOD
3.1 TASK ORIENTED MULTI- OPTIMIZATION
We now present our TAsk Oriented Multi-Objective Optimization (TA-MOO), We consider the MOO problem in (1) where each task Te (i I,..,, m) corresponds to the objective function fo (6) (i = 1, 1.....77 m.) Additionally, assume that given a task Tr we can explicitly observe if this task has currently achieved its goal (e.g., the current adversaria example can fool successfully the model fi), which named goal-achieved task. We also name task that has not achieved its goal goal-unachieved task. Different from the standard MOO, which equally pays equal attention to all tasks, our TA-MOO focuses on improving the currently goal-unachieved tasks, while trying to maintain the performance of the goal-achieved tasks. By this principle, we expect all tasks would be equally improved to simultaneously achieve their goals.
To be more precise, we depart from dg and consecutively update in L steps obtain the sequence 51, 62,..., 5n that approaches the optimal solution. Considering the t-th step (i.c., < t S L), we currently have ò, and need to update goals already and denote them as Tı, T2, .... To without the loss of generalization. Here we note that the list of achl-vchieved tasks empty if = and the list of goal-unachieved tasks is empty m. Specifically, to find 8 we first solve the following optimization problem (OP):
obtain d.+1- We examine the tasks that have achieved their
"" -argmin WA..
[w Qw + Al (w))
(3)
where Q Rmxm with Qig Vali (6,)² Valy (6.), À > 0 is trade-off parameter, and Ω (w) is regularization term to let the weights focus more on the coal-unachheved tasks. We next compute the combined gradient gi and update 6 as:
91
w Vsfi (6:) and 6.41 = 8, + 7gh-
The OP in 3 consists of two terms. The first term w" Qw ensures that all tasks are improving, while the second term Ω (w) serves the regularization to restrict the goal-achieved tasks Ti, ..., by setting the corresponding weights w1.... W. as small as possible.
Before getting into the details of the regularization, w E Am. we parameterize w = softmax (a) with a E R" and solve the OP in (3) using gradient descent. In what follows, discuss proposed geometry- regularization term Ω (w).
emphasize that impose the constraint
Simplex-based regularization. Let S, = {.3 [ == E CRT
Σm 3, = 1} be sim- plex w.r.t. the goal-umen saalhunacheeved tasks and S = {0.} x S2 be the extended simplex, where 0, is the s-dimensional vector of all zeros. We define the regularization term 52 (w) as the distance from w to the extended simplex S: a (w)) d (w, S) min.res ||w ---mma π
Because S is a compact and convex set and ||wl π 12 is a differentiable and convex function, the optimization problem in (4) has unique global minimizer 52 (w) ||w projs (w=] where the projection projs (w) is defined as
projs (w) = argmin+es 1| - π 1
The following lemma shows us how to find the projection projs (w) and evaluate Ω (w..
3

---

Under review as a conference paper at ICLR 2023
Lemma 1. Sorting Wa+1:m into Ug-1:mm such that Mo+1 2 us+2 2 ... um Defining p
max {s + i m u4 + i-s E1-Ej=st1 uz) > 0.. Denoting y = 2/ Ei us). the
projection projs (w) can be computed as
isiss
projs (w)) = max (ws + 7,03
otherwise
Furthermore, the regularization Q (w) has the form:
2 (w) = w Σ
(w; max (w; + 7, 03)2
(5)
1=++1
With further algebraic manipulations, 9 (w) can be significantly simplified as shown Theorem Theorem 1. The regularization Q (w) has the following closed-form:
]
1
Ω (w)
W/3
(6)
1=s+1
The proof of Lemma and Theorem can be found in Appendix B.I Evidently, the regularization term in Eq. 6 in Theorem encourages the weights wi:s associated with the goal-achieved tasks to be as small as possible and the weights 30e41imassociate with the goal-unachieved tasks to move closer the simplex Sy (i.e., E w, closer 1).
Parameterized TA-MOO. Algorithm|D
Algorihmmssmmmaizee summarizes the key steps of our TA-MOO. We use gradient descent to find solution for the in steps and at each iteration we solve the OP in 3 in K steps using gradient descent solver with the parameterization = softmax (a:). To reduce computational cost, at each iteration we reuse the previous solution a and use a few steps K (i.e., K S 10) to get new solution. We then compute the combined gradient It and finally update ò, to d,41 using the combined gradient Ir (or sign(gt) the case of L norm). The projecting operation in step 13 is to project 5 to valid space specifying to applications that introduce hereon.
Algorithm Pseudocode for Parameterized TA-MOO.
Input: Multi-objective functions f1.m (8). 8's solver with L update steps and learning rate n/s- w's Gradient Descent Solver (GD) with K update steps and learning rate The and variable a. The softmax function denotes by a. Tradeoff parameter A.
Output: The optimal solution 8"
Initialize &n (e.g., 5n
(((-c,)))
2: Initialize ao [a0]
==1 with aó 1/m.
3: for = 0 to I. do
4: Collect list of tasks' gradients (V)f((6:))==
5: Compute Q with Qú Vafi (8.)² Vafy (8.). Initialize a++1 = K do
6:
7:
for k
8:
Compute [(a++1) = ((a41)) TQ Xl((()))1))
9:
Update a++1 = a++1 The V v.L(o)+)). end for
10:
11:
Compute the combined gradient = Σm o(a4+1.) (8)). Update 8141 8, + 189t-
12:
13:
Project 6c+1 to a valid space (specific to domain, e.g., ||||| - e).
14:
end for
15:
Output 8* =
3.2 APPLICATIONS IN ADVERSARIAL GENERATION
Although TA-MOO is a general framework, we this paper focus on its applications in adversarial generation. Following Wang al. (001), we consider three tasks of generating adversarial examples.
4

---

Under review as a conference paper at ICLR 2023
Generating adversarial examples for ensemble model. Considering an ensemble classifier with multiple classification models h1, hg..... hm. where h2 (z) E AM = E R ||||| 1 = 1) with the number of classes M. Given a data sample æ, aim is to find adversarial example ot = x: + 5 that can successfully attack all the models. Specifically, we consider a set of tasks each of which, Tr, is about whether x: + ö can successfully attack model h;, defined as:
I |rrgmx by (r + k,k) v)
where y is the ground truth label of x; is the indicator function and h, (x. k-) returns the probability to predict the class k. To find perturbation that can attack successfully all models, we solve the following multi-objective optimization problem:
max 6:I
[S1 (6) :.., (o)],
where fi (6) (h4 (a + +8) y) with the loss function & which could be the cross-entropy (CE) loss (Madry et al. 2018), 8), the Kullback-Leible (KL) loss (Zhang et al. 2019), or the Carlini- Wagner (CW)
loss (Carlini & Wagner 2017).
Generating universal perturbations. Considering a single classification model h with h (x) E AM and batch of data samples æ 22 TB. we would like find a perturbation 8 with ||8|| S e such that ,; = I3 + 6, = 1, .... B, are adversarial examples. We define the task Ti as finding the adversarial example x² = x; + 8 for data sample zy. For each task Ti we can define its goal as finding successfully the adversarial example a²:
T {argmax (xf, At) # argmax (14, k)]
To find the perturbation ò, we solve the following multi-objective optimization problem:
max [f1 (6) ;.., f' (0)], 5:
where (6) = e (h (zf), 31) 8 (h (z, + 5) y1) with yi the ground-truth label of 2;.
Generating adversarial examples against transformations. Considering single classification model h and m categories of data transformation Pi.m (e.g., rotation, lighting, and translation). Our goal is to find adversarial attack that is robust to these data transformations. Specifically, given benign example v, we would like to learn a perturbation 6 with || I e that can successfully attack the model after any transformation t ~ P, is applied. To formulate as an MOO problem, we consider the task Ti as finding the adversarial example xę = f. (z + 5) with t; ~ P.. For each task T. we can define the goal finding successfully the adversarial example x?:
pargmax1gesaa
(xq, k) A argmax (zr, k.)
To find the perturbation ò, we solve the following multi-objective optimization problem:
max [J1 (6) ,..., fm (0)], 6:1MA|S
where (8) E,, pp, (z ())))))))))))) with y the ground-truth label of a.
4 EXPERIMENTS
In this section, we provide extensive experiments across four settings: (i) generating adversarial examples for ensemble of models (ENS, Sec (ii) generating universal perturbation (UNI, See
(iii) generating robust adversarial examples against Ensemble of Transformations (EoT, Sec and (iv) adversarial training for ensemble of models (AT, Sec The details of each setting
can be found in Appendix C
General settings. Through our experiments, we use six common architectures for the classifier including ResNet18 (He et al., 2016), VGG16 (Simonyan & Zisserman 2014). GoogLeNet (Szegedy et al. 2015), EfficientNet (Tan & Le 2019), MobileNet Howard et al. (2017), and WideResNet Zagoruyko & Komodakis (2016) with the implementation We evaluate on the full testing set of
5

---

Under review as a conference paper at ICLR 2023
two benchmark datasets which are CIFARIO and CIFAR100 (Krizhessky et al. 2009). We observed that the attack performance is saturated with standard training models. Therefore, to make the job of adversaries more challenging, we use Adversarial Training with PGD-AT (aadry et al. 2018 to robustify the models and use these robust models as the victim models in our experiments.
Evaluation metrics. We use three metrics to evaluate the attack performance including (i) A-AII: the Attack Success Rate (ASR) when an adversarial example can achieve goals in all tasks. This is consid- ered as the most important metric indicate how well one method can achieve in all tasks; A-Ag: the average Attack Success Rate over all tasks which indicate the average attacking performance; (A-i) f= Attack Success Rate in each individual task. For reading comprehension purposes, if necessary the highest/second highest performance in each experimental setting is highlighted in Bold/Underline and the most important metric(s) emphasized in blue color.
Baseline methods. We compare our method with the Uniform strategy which assigns the same weight for all tasks and the MinMax method (Wang et al., (02T) which examines only the worst- case performance across all tasks. To increase the generality to other tasks, MinMax requires regularization to balance between the average and the worst-case performance. We use the same attack setting for all methods: the attack is the Lo untargeted attack with 100 steps, step size 1/5 2/255 and perturbation limitation c = 8/255. The GD solver in TA-MOO uses 10 steps with learning rate Tw 0.005. Further detail can be found in Appendix C
4.1 ADVERSARIAL EXAMPLES FOR ENSEMBLE OF MODELS (ENS)
Experimental setting. In our experiment, we use an ensemble of four adversarially trained models: ResNet18, VGGI6, GoogLeNet, and EfficientNet. The architecture is the same for both the CIFARIO and CIFAR100 datasets except for the last layer which corresponds with the number of classes in each dataset. The final output of the ensemble is an average of the probability outputs (i.e., output of the softmax layer). We use three different losses as an object for generating adversarial examples including CE (Madry et al. 2018), KI. (Zhang et al. 2019), and CW (Carlini & Wagner 2017).
Results 1: TA-MOO achieves the best performance. Table shows the results of attacking the ensemble model the CIFAR1O and CIFARIOM 100 datasets. It can be seen that TA-MOO significantly outperforms the baselines and achieves the best performance in all the settings. For example, the improvement over the Uniform strategy is around 10% on both datasets with the CE loss. Comparing to the MinMax method, the biggest improvement is around 3% for CIFAR10 10 with CW loss and the lowest one is around 0.6% with the KL loss. The improvement can be observed in all the settings, showing the generality of the proposed method.
When does not MOO work? can be observed that MOO falls behind all other methods, even compared with the Uniform strategy. Our hypothesis for the failure of MOO is that in the original setting with an ensemble of diverse architectures (i.e., ResNet18, VGG16, GoogLeNet, and EfficientNet) there is one task that dominates the others and makes MOO become trapped (i.e., focusing on improving the dominant task). To verify our hypothesis, we measure the gradient norm [[)]l corresponding to each model and the final weight w of 1000 samples and report the results in Table It can be seen that the EfficientNet has a much lower gradient strength, therefore, it has a much higher weight. This explains the highest ASR observed in EfficientNet and the large gap of 19% (56.11 1% in EfficientNet and 37.05% in GoogLeNet). To further confirm our hypothesis, we provide an additional experiment on non-diverse ensemble model which consists of individual ResNet18 models. It can be observed that in the non-diverse setting, the gradient strengths are more balanced across models, indicating that no task dominates others. As a result, MOO shows its effectiveness by outperforming the Uniform strategy by 4.3% in A-AII.
Results 2:
2
Results 3: The importance of the Task- fask-Oriented regularization. It can be observed from Table 2 that in the diverse setting, TA-MOO has much lower gap (4%) between the highest ASR (53.4% at EfficientNet) and the lowest one (49.29% 29% at GoogLeNee) compared to MOO ( (19%). Moreover, while the ASR of EfficientNet is lower by 2.7%, the ASRs of all other architectures have been improved considerably (i.e., 12% in GoogLeNet). This improvement shows the importance of the Task-Oriented regularization, which helps to avoid being trapped by one dominating task, as happened in MOO. For the non-diverse setting, when no task dominates others, TA-MOO still shows its effectiveness when improving the ASR in all tasks by around 5%. The significant improvement can be observed in all settings (except the setting on EfficientNet with the CIFAR1O dataset) as shown in Table and demonstrates the generality of the Trik-Orie regularization.

---

Under review as a conference paper at ICLR 2023
Table 1: Evaluation Attacking Ensemble model on the CIFARIO and CIFARI00 datasets.
CW
CE
KL
A-All
A-Avg
A-All
A-Avg
A-All
A-Avg
Uniform
26.37
41.13
28.21
48.34
17.44
32.85
MinMax
27.53
41.20
35.75
51.56
19.97
33.13
CIFARIO
MOO
18.87
34.24
25.16
44.76
15.69
29.54
TA-MOO
30.65
40.41
38.01
51.10
20.56
31.42
Uniform
52.82
67.39
55,86
72.62
38.57
54.88
MinMax
54.96
66.92
63.70
75.44
40.67
53.83
CIFARI00
MOO
51.16
65.87
58.17
73.19
39.18
53.44
TA-MOO
55.73
67.02
64.89
75.85
41.97
53.76
Table 2: Attacking Ensemble model with diverse
V-VGG16, G-GoogLeNet, E- E-fficientNeet] and non-diverse set ND=(4 ResNets). }. w represents the final w of MOO (mean + std). V [+)il represents the gradient norm of each model (mean std).
A-All
A-Avg
R/R1
V/R2
G/R3
E/R4
[Vaf((0)
7.15 + 6.87
4.29 = 4.64
7.35 + 7.21
0.98 + 0.72
D
w
0.15 + 0.14
0.17 +.013
0.15 + 0.14
0.53 0.29
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
[V))
8.41 8.22
6.68 6.95
7.36 + 6.03
5.67
6.09
ND
0.23 + 0.21
0.24
0.23 + 0.19
0.30 + 0.21
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
Results 4: TA-MOO achieves the best transferability on a diverse set of ensembles.
Table the SAR-All metric of transferred adversarial examples crafted from source ensemble (RME) on attacking target ensembles (c.g.. RMEVW is an ensemble of models). higher number indicates higher success rate of attacking target model, therefore, also implies higher transferability of adversarial examples. It can be seen that our TA-MOO adversary achieves the highest attacking performance over the Uniform strategy. Our method also achieves the highest transferability regardless diversity of target ensemble. More specifically,
the whitebox attack setting, with huge gap of 9.24% success rate
target models such as REV, MEV, and RMEV, where members in the source ensemble (RME) are also in the target ensemble, our TA-MOO significantly outperforms the Uniform strategy, with the highest improvement is 5.19% observed on target model RMEV. On the target models EVW and MVW which are less similar to the source model, our method still outperforms the Uniform strategy by 1.46% and 1.65% The superior performance of our adversary on the transferability shows another benefit of using multi multi-objective optimization in generating adversarial examples. By reaching the intersection of all members' adversarial regions, our adversary is capable to generate common vulnerable pattern architectures, therefore, increasing the transferability of adversarial examples. More discussion can be found in Appendix D.I
input image shared across
4.2 ADVERSARIAL TRAINING WITH TA-MOO FOR ENSEMBLE OF MODELS (ENS)
We conduct adversarial training with adversarial examples generated by MOO and TA-MOO attacks to verify the quality of these adversarial examples and report results on Table The detailed setting and more experimental results can be found in Appendix D.2 Result 1: Reducing transferability. can be seen that the SAR-AIl of MOO-AT and TA-MOO-A are much lower than that on other methods. More specifically, the gap of SAR-AIl between PGD-AT and TA-MOO-AT is (5.33%) 6.13% on the (non) diverse setting. The lower SAR-All indicating that adversarial examples are harder transfer among ensemble members the TA-MOO-AT model than on the PGD-AT model.
D.2

---

Under review as a conference paper at ICLR 2023
Table Evaluation on the Transferability of adversarial examples. Each cell (row-ith, column-jth) reports SAR (higher is better) of adversarial examples from the same source architecture (RME) with an adversary at row-ith attack an ensemble at column-jth. Each architecture has been denoted by symbols such as R: R8sNet18, M: MobileNet, E: EfficientNet, V: VGGI6, W: WideResNet. For examples, RME represents for an ensemble ResNet18, 8, MobileNet and EfficientNet.
RME
RVW
EVW
MVW
REV
MEV
RMEV
RMEVW
Uniform
31.73
25.03
22.13
22.73
29.50
28.44
26.95
20.50
MinMax
40.01
23.75
22.39
23.34
32.57
32.75
31.85
21.99
MOO
35.20
24.25
22.94
23.76
30.65
32.28
29.49
21.77
TA-MOO
40.97
25.13
23.59
24.38
33.00
33.05
32.14
23.04
Table 4: Robustness evaluation of Adversarial Training methods on the CIFARIO dataset. RME represents an ensemble of ResNet18 (R), MobileNet (M) and EfficientNet E), while MobiX3 repre- sents an ensemble of three MobileNets. NAT and ADV measure the natural accuracy and the robust accuracy against PGD-Linf attack (tthe higher the better). Other metrics measure the success attack rate (SAR) of adversarial examples generated by the same PGD-Linf attack on fooling each single member and all members of the ensemble (Lthe lower the better).
MobiX3
RME
NAT
ADV1
A-All
A-Avgl
NATT
ADV1
A-All,
A-Avgl
PGD-AT
80.43
32.78
54.34
73,89
86.52
37.36
49.01
69.75
MinMax-AT
79.01
37.28
50.28
66.77
83.16
40.40
46.91
65.73
MOO-AT
79.38
33.04
46.28
74.36
82.04
37.48
45.24
70.11
TA-MOO-AT
79.22
38.22
48.21
67.83
82.59
41.32
43.68
65.09
Result Producing more robust single members. The comparison of average SAR shows that adversarial training with TA-MOO produces more robust single models than PGD-AT does. More specifically, the average robust accuracy (measured by 100% A-Avg) of TA-MOO-AT is 32. 17%, an improvement of 6.06% over PGD-AT in the non-diverse setting, while there is improvement of 4.66% the diverse setting. Result 3: Adversarial training with TA-MOO achieves the best robustness. More specifically, the non-divese setting. TA-MOO-AT achives 38.22% robust accuracy, an improvement of 1% over MinMax-AT and 5.44% over standard PGD-AT. On the diverse setting, the improvement over MinMax-AY AT and PGD-AT are 0.9% and 4%, respectively. The root of the improvement is the ability to generate stronger adversarial examples in the the sense that they challenge not only the entire ensemble model but also all single members. These adversarial examples lie in the joint insecure region of members (i.c., the low confidence region of multiple classes), therefore, making the decision boundaries more separate. As a result, adversarial training with TA-MOO produces more robust single models (i.e., lower SAR-Avg) and significantly reduces the transferability of adversarial examples among members (i.e., lower SAR-AlI). These two conditions explain the best ensemble adversarial robustness achieved by TA-MOO.
4.3 UNIVERSAL PERTURBATION (UNI)
Experimental setting. We follow the experimental setup in Wang et al. 2021 where the full test (10k images) randomly divided into equal-size groups (K images per group). The comparison has been conducted on the CIAAR10 and CIFAR100 datasets, with an adversarially trained ResNet18 model and CW loss. We observed that the ASR-All was mostly zero, indicating that is difficult to generate general perturbation for all data points. Therefore, in Table 5 we use ASR-Avg compare the performances of the methods. More experiments on VGG16 and EfffccintNett models can be found in Appendix D.3
Results. Table showws the evaluation of generating universal perturbations on the CIFARIO and CIFAR 100 datasets, respectively. K represents the number of images that are using the same perturbation. The larger the value of K, the harder is to generate a universal perturbation that can be applied successfully to all images. It can be seen that with small number of tasks (i.e., K=4), MOO and TA-MOO achieve lower performance than the MinMax method. However, with a large number of tasks (i.e, K 2 8), MOO and TA-MOO show their effectiveness and achieve the
8

---

Under review as a conference paper at ICLR 2023
Table 5: Evaluation of generating Universal Perturbation on the CIFARIO and CIFARIO0 datasets.
CIFARIO
CIFAR100
K=4
K=8
K=12
K=16
K=20
K=4
K=8
K=12
K=16
K=20
Uniform 37.52
30.34
27.41
25.52
24.31
65.40
58.99
55.33
53.02
51.49
MinMax
50.13
33.68
20.46
15.74
14.73
74.73
62.29
52.05
45.26
42.33
MOO
43.80
35.92
31.41
28.75
26.83
69.35
62.72
57.72
54.12
52.25
TA-MOO
48.00
39.31
34.96
31.84
30.12
72.74
68.06
62.33
57.48
54.12
Table Robust adversarial examples against transformations evaluation. I: Identity, H: Horizontal flip. V: Vertical flip, C: Center crop, G: Adjust gamma, B: Adjust brightness, R: Rotation.
A-All
A-Avg
I
H
V
G
B
R
Uniform
25.98
55.33
44.85
41.58
82.90
72.56
45.92
49.59
49.93
MinMax
30.54
52.20
43.31
41.59
78.80
64.83
44.38
46.53
45.97
C10
MOO
21.25
49.81
36.23
33.93
87.47
71.05
37.68
40.21
42.12
TA-MOO
31.10
55.26
44.15
41.86
85.19
71.86
45.53
48.70
49.54
Uniform
56.19
76.23
70.43
69.01
87.66
87.36
71,40
74.25
73.47
MinMax
59.75
75.72
70.13
69.26
87.45
86.03
71.54
73.30
72.32
C100
MOO
53.17
74.21
66.96
65.68
89.16
87.03
68.49
71.11
71.06
TA-MOO
60.88
76.71
70.43
69.37
89.11
87.95
71.70
74.73
73.69
best performance. More specifically, on the CIFARIO dataset, the improvements of MOO over the Uniform strategy are 5.6%, 4%, 3.2%, and 2.5% with K 8, K 12, K 16, and K 20, respectively. On the same setting, TA-MOO significantly improves MOO by around 4% in all the K settings and consistently achieves the best performance. Unlike the ENS setting, in the UNI setting, MOO consistently achieves better performance than the Uniform strategy This improvement can be explained by the fact that in the UNI setting with the task dominates the others. There will be case (a group) when one sample is extremely close to/far from the decision boundary, and hence casier/harder fool. However, in the entire test set with large number of groups, the issue of dominating tasks is lessened.
architecture and data transformation, no
4.4 ROBUST ADVERSARIAL EXAMPLES AGAINST TRANSFORMATIONS (EoT)
Results. Ta the evaluation the CIFARIO and CIFAR100 datasets with common data transformations. It can be observed that (i) MOO has a lower performance than the baselines, (ii) the Task Oriented regularization significantly boosts the performance, and (iii) our TA-MOO method achieves the best performance on both settings and outperforms the MinMax method 0.6% and 1.1% in the CIFARIO and the CIFAR 100 experiments, respectively. The low performance of MOO in observation (i) is again caused by the issue of one task dominating others. In the EoT setting, it is because of the V-vertical flip transformation shown in Table Observation (ii) provides another piece of evidence to support the effectiveness of the Task Dask-Oriented regularization for MOO. This regularization boosts the ASRs all the tasks (except V the dominant onc), increases the average ASR by 5.45% and 2.5% in the CIFARIO and CIFARI00 experiments, respectively.
5 CONCLUSION
In this paper, we propose Task Oriented Multi-Objeetive Optimization (TA-MOO), with specific applications to adversarial generation tasks. develop a geometry-based regularization term to favor the goal-unachieved tasks, while trying maintain the the goal-achieved tasks. We conduct comprehensive experiments to showcase the merit of our proposed approach on generating adver- sarial examples and adversarial training. On the other hand, there acknowledged limitations of our method such as weaknesses of the gradient- based solver and lacking theory on algorithm's 's convergence which might be target for future works.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274-283, 2018. D
Emil Björnson and Eduard Jorswieck. Optimal resource allocation in coordinated multi-cell systems.
Now Publishers Inc. 2013. E.
Emil Bjornson, Eduard Axel Jorswieck, Mérouane Debbah, and Bjorn Ottersten. Multiobjective signal processing optimization: The way to balance conflicting metrics in 5g systems. IEEE Signal
Processing Magazine, 446)::14-3,, 2014. E.3
Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. Cambridge university press, 2004. A
Wieland Brendel, Jonas Rauber, Matthias Kümmerer, Ivan Ustyuzhaninov, and Matthias Bethge. Accurate, reliable and fast robustness evaluation. In Advances Neural Information Processing Systems, pp. 12861- 12861-12871, 2019. D.7
Anh Bui, Trung Le, He Zhao, Paul Montague, Olivier Vel, Tamas Abraham, and Dinh Phung. Improving adversarial robustness by enforcing local and global compactness. arXiv preprint arXiv:2007.05123,, 2020. A
Anh Tuan Bui, Trung Le, He Zhao, Paul Montague, Olivier de Vel, Tamas Abraham, and Dinh Phung. Improving ensemble robustness by collaboratively promoting and demoting adversarial robustness. In Proceedings of the AAAI Conference on Artificial Intellience, volume 35, pp. 6831-68399
2021. 1
Rafael Caballero, Lourdes Rey, Francisco Ruiz, and Mercedes González. An algorithmic package for the resolution and analysis of convex multiple objective problems. Multiple criteria decision making, pp. 275-284. Springer, 1997. E.3
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017. 3.2
D.7
Carlos A Coello Coello. comprehensive survey of evolutionary-basel multiobjective optimization techniques. Knowledge and Information systems, 1(3):269-308, 1999, E.3
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee free attacks. arXiv preprint arXiv:2003.016900 2020.
D.7
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag. Edoardo Debenedetti. Nicolas Flam- marion, Mung Chiang. Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021. URL https://openrewt wew. ew. new.ne///// forum??rm
SSKZPJCE 7B
D.8
Kalyanmoy Deb. Multi-objective optimisation using evolutionary algorithms: an introduction. In Multi-objective evolutionary optimisation for product design and manufacturing, pp. 3-34. Springer, 2011
E.3
Jean-Antoine Désidéri. Multiple-gradien descent algorithm (mgda) for multiobjective optimization. Comptes Rendus Mathematique, 350(5-6):313-33 318, 2012. T
Shangchen Du, Shan You, Xiaojie Li, Jianlong Wu, Fei Wang. Chen Qian, and Changshui Zhang. Adaptive ensemble knowledge distillation in gradient space. Advances in Neural Information Processing Systems, 33, 2020. A
Agree to disagree:
Matthias Ehrgott. Multicriteria optimization, volume 491. Springer Science & Business Media, 2005.
10

---

Under review as a conference paper at ICLR 2023
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on
Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9. 2015, Conference Track Proceedings, 2015. URI. httpttttp:///ttee
orgo / / 412 6572
A
Pengxin Guo, Yuancheng Xu, Baijiong Lin, and Yu Zhang. Multi-task adversarial attack. arXiv preprint 1rXiv:2011.09824 2020. A
Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
G. Hinton, L. Deng, D. Yu, G. E. Dahl, A. Mohamed, N. Jaitly, A. Senior, V. Vanhoucke, P. Nguyen, N. Sainath, and B. Kingsbury. Deep neural networks for acoustic modeling speech recognition: The shared views of four research groups. IEEE Signal Processing Magazine, 29(6):82-97, 2012.
Andrew Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint M.Xiv:1704.0461.1 2017.
Alex Krizhevsky et Learning multiple layers of features from tiny images. 2009,
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 12. Chapman and Hall/CRC, 2018. A
Xi Lin, Hui-Ling Zhen, Zhenhua Li, Qing-Fu Zhang, and Sam Kwong. Pareto multi-task learning. Advances in neural information processing systems, 32, 2019. A
Bo Liu, Xingchao Liu, Xiaojie Jin, Peter Stone, and Qiang Liu. Conffict-averse gradient descent for multi-task learning. Advances in Neural Information Processing Systems, 34:18878-18890, 2021a.
E.5
Qiang Liu and Dilin Wang. Stein variational gradient descent: A general purpose bayesian inference algorithm. Advances in neural information processing systems, 29, 2016. A
Xingehao Liu, Xin Tong, and Qiang Liu. Profiling pareto front with multi-objective stein variational
gradient descent. Advances in Neural Information Processing Systems, 34, 2021 A
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. International Conference on Learning Representations, 2018.
3.2
D.7
Debabrata Mahapatra and Vaibhav Rajan. Multi-task learning with user preferences: Gradient descent with controlled ascent in pareto optimization. In International Conference on Machine Learning, pp. 6597-6607. PMLR, 2020. A
Kaisa Miettinen. Nonlinear multiobjective optimization, volume 12. Springer Science & Business Media, 2012. 2
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765-1773, 2017. A
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 1970-4977 PMLR, 09-15 Jun 2019. A
Haoxuan Qiu, Yanhui Du, and Tianliang Lu. The framework of cross-domain and model adversarial attack against deepfake. Future Internet, 14(2):46, 2022. A
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversari- ally robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533-3545, 2020.
D.8
11

---

Under review as a conference paper at ICLR 2023
Ozan Sener and Vladlen Koltun. Multi-task learning
optimization. Advances in B.2
neural information processing systems, 31, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.
4
M. Spencer, J. Eickholt, and J. Cheng. deep learning network approach to ab initio protein secondary structure prediction. JEEF/ACM Trans. Comput. Biol. Bioinformatics, 12(1):103-112
January 2015. ISSN 1545-5963, !
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL sttt:://artie org/abs 1312
6199 I
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1-9, 2015.
C
Mingxing Tan and Quoe Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference machine learning, pp. 6105-6114 PMLR, 2019. C
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-6008, 2017.
Jingkang Wang, Tianyun Zhang, Sijia Liu, Pin- Yu Chen, Jiacen Xu, Makan Fardad, and Bo Li. Ad- versarial attack generation empowered by min-max optimization. Advances in Neural Information Processing Systems, 34, 2021.
I 3.2 4.3
Weiran Wang and Miguel A Garreira-Perpinte Projection onto the probability simplex: An efficient algorithm with simple proof, and application. arXiv preprint arXiv:1309.154: 2013. B.
Eric Wong, Leslie Rice, and Zico Kolter. Fast better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2019. D.8
Feiyang Ye, Baijiong Lin, Zhixiong Yue, Pengxin Guo, Qiao Xiao, and Yu Zhang. Multi-objective meta learning. Advances in Neural Information Processing Systems, 34, 2021.
Tianhe Yu, Saurabh Kumar, Abhishek Gupta, Sergey Levine, Karol Hausman, and Chelsea Finn. Gradient surgery for multi-task learning. Advances in Neural Information Processing Systems, 33: 5824-5836, 2020. A E.5
S. Zagoruyko and N. Komodakis. Wide residual networks. arXiv preprint 1605,0:16050001000 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings Machine Learning Research, pp. 7472-7482, 2019.
12

---

Under review as a conference paper at ICLR 2023
APPENDIX
The Appendix provides technical and experimental details as well as auxiliary aspects to complement the main paper. Briefly, contains the following:
Appendix
Discussion on related work.
Appendix
Detailed proof and an illustration of our methods.
Appendix
Detailed description of experimental settings.
Appendix D.I
Additional experiments transferability of adversarial examples in the
ENS setting.
Appendix D.2
Additional experiments on adversarial training with our methods.
Appendix D3
Additional experiments on the UNI setting.
Appendix D.4
Additional experiments on the EoT setting.
Appendix D.5
Additional comparison on speed of generating adversarial examples.
Appendix D.6
Additional experiments on sensitivity hyper-parameters.
Appendix D.7
Additional comparison with standard attacks on attacking performance.
Appendix
D
Additional experiments attacking the ImageNet dataset.
Appendix
E.
Additional discussions the dominating issue and when MOO can work.
Appendix
A summarary on the importance of Task-Orieeted regularization.
Appendix
E.3
Discussion on the limitation of MOO solver.
Appendix
Discussion on correlation between the objective loss and attack performance.
Appendix
Additional experiments with multi-task learning methods.
Appendix
E.6
Discussion on the conflicting between gradients in the adversarial generation
task.
Appendix
E.7
Discussion the convergence of our methods.
Appendix
E.8
Additional experiments with MOO with different initializations.
A
RELATED WORK
Multi-Objective Optimization for multi-task learning. (Désidéri 2012)
proposed multi-
gradient descent algorithm for multi-objective optimization (MOO) which opens the door for the applications of MOO in machine learning and deep learning. Inspired by Désidéri (2012). MOO
has been applied in multi-task learning (MTL) (Sener & Koltun 2018 Mahapatra & Rajan 2020).
few-shot learning Ye et al. 202T), and knowledge distillation (Du al.] 2020). Specifically, the work Sener & Koltun (018) viewed multi-task learning multi- culli-oobjective optimization problem, where a task network consists
shared feature extractor and a task-specific predictor. The work of Mahapatra & Rajan (020) developed mundient-basede multi-objective MTI. algorithm to find solution that satisfies the user preferences. The work of Lf et al.) (2019) proposed Pareto MTI. to find set of well-distributed Pareto solutions which represent different trade-off's among different tasks. Recently, the work of Liu et al.) (2021b) leveraged MOO with Stein Variational Gradient Descent (Liu & Wang 2016) to diversify the solutions of MOO. Additionally, the work of Ye et al. (2021) proposed a bi-level MOO which can applied to few-shot learning. Finally, the work of Du al. 2020) applied MOO enable knowledge distillation from multiple teachers.
Generating adversarial examples with single-objective and multi-objective optimizations. Generating qualified adversarial examples is crucial for adversarial training (Madry et al., 2018 Zhang et al. 2019). Many perturbation based attacks have been proposed, notably FGSM (Goodfellow et al. 2015), PGD (adry et al. 2018), TRADES (Zhang et al. 2019), CW (Carlini Wagner 2017). BIM (urakin al. 2018), and AutoAttack (Croce & Hein 2020 Most adversarial attacks aim
to maximize a single objective, e.g., maximizing the cross cross-cntropy (CE) loss w.r.t. the ground-truth label (Madry al. 2018), maximizing the Kullback-Leibler (KI.) divergence w.r.t. the predicted
13

---

Under review as a conference paper at ICLR 2023
probabilities of a benign example (Zhang et al. 2019), maximizing the CW loss (Carlini & Wagner 2017). However, in some contexts, we need to generate adversarial examples maximizing multiple objectives or goals, e.g.. attacking multiple models (Pang et al., 2019: Bui et al. 2020 or finding universal perturbations (Moosavi-Dezfooll et al. 2017).
To this end, the work of Wang et al. (2021) examined the worst-case scenario by casting the problem of interest as a min-max problem for finding the weight of each task. However, this principle leads to
a problem of lacking generality in other tasks. To mitigate the issue, Wangg et al. (2021) proposed
a regularization to strike a balance between the average and the worst-case performance. The final optimization was formulated as follow:
K Σ
max min 8: WEAm
wi +
7 21 1/K
1=1
Where fi) is the victim model's loss (i.e., cross entropy loss or KL. divergence) and ? >> O is the regularization parameter. The authors used the bisection method (Boyd et al.] 2004) with project gradient descent for the inner minimization and project gradient ascent for the outer maximization. There are several major differences in comparison to MOO and TA-MOO methods: (i) In principle. MinMax considers the worst-case performance only while our methods improve performance of all tasks simultaneously. (ii) MinMax weighs the tasks' losses to find the minimal weighted sum loss in its inner minimization, however, as discussed in Section E.4 the higher weighted loss does not directly imply the higher success rate in attacking multi-tasks simultaneously. In contrast, our methods use multi-gradient descent algorithm (Deb) 2011) in order to increase losses of all tasks simultaneously. (iii The original principle of MinMax leads to the biasing problem to the worst-case task. The above regularization has been used to mitigate the issue, however, it considers all tasks equally. In contrast, our TA-MOO takes aooallcchivemmet status of each task into account and focuses more on the goal-unachieved tasks.
Recently, Guo et al. (2020) proposed a multi-task adversarial attack and demonstrated on the universal perturbation problem. However, while Wang et al. (2021) and ours be classified as iterative optimization-basee attack. Guo et al. (2020) requires a generative model in order to generate adversar- ial examples. While this line of attack is faster than optimization-based attacks at the inference phase, it requires to train generator on several tasks beforehand. Due to the difference in setting, we do not compare with that work in this paper. More recently, Qiu et al. (2022) proposed a framework to attack a generative Deepfake model using the multi- grattiigrrientt descent algorithm in their backpropagation step. While their method also use the multi-objective optimization for generating adversarial examples, there are several major differences to ours. Firstly, their method aims for generative Deepfake model while our method aims for the standard classification problem which is the most common and important setting in AML. Secondly, we conduct comprehensive experiments to show that direct and naive application of MOO to adversarial generation tasks does not work satisfactorily because of the gradient dominating problem. Most importantly, we propose the TA-MOO method which employs a geometry-basee based regularization term to favor the unsuccessful tasks, while trying to maintain the performance of the already successful tasks. We have conducted extensive experiments to show that our TA-MOO consistently achieves the best attacking performance across different settings. We also conducted additional experiments with SOTA multi-task learning methods which are PCGrad ( Yu et al. 2020) and CAGrad (Liu et al. 2021a) in Appendix E.S] Compared to these methods, our TA-MOO still achieves the best attack performance thanks to the Task Oriented regularization.
B
FURTHER DETAILS OF THE PROPOSED METHOD
B. PROOFS
Lemma 1. Sorting Ws+1am into Uy such that Us+1 2 Us+2 2 2 Um- Defining p =
max { 8 s+11 S S m : u4 + i-s (1 Ej=sti Ug) > 0 Denoting 7 = 7 Ei Ui). the
1
projection projs (w) can be computed as
i 8 otherwise
projs (w), max (w, + 7,0}
Furthermore, the regularization Ω (wx) has the form:
14

---

Under review as a conference paper at ICLR 2023
Ω (w)
Σ
(w, max (w; + + 7))
(5)
x=st1
Proof. The proof is based on Wang & Carreira- Perpinán (2033) with modifications. We need to solve the following OP:
min
w n 2
s.t. 2
| = 1.
We note that #1 .T The OP of interest reduces to
min
(m
w;)
To+1om
i=8+1
0
Σ a111 1=++1
Using the Karush- Marush-Kuhn-Tie Kuhn-Tucker (KKT) theorem, construct the following Lagrange function:
C (). = 2 imst1
1
Σ (me - - -7
Σ
T
Σ
B
ima+1
Setting the derivative w.r.t. n; zeros and using the KKT conditions, obtain:
T2 W/
B, = 0, Vi = 1...,
=1
#=
B 0, म 0,8 0, +1,, 1,...,m.
n, 0, B, 0, hence म; w; + > 0. Otherwise, if n. 0. wi + r -3; S Therefore, Ws+1mm has the same order as 7s+1:m and we can arrange them as:
1s ns ... 2 TT -p == Tm 0.
U,+1 = W,+1 2 U,+2 Ws+2 2 2 Up = Wp 2 up = -wp-1 2 2... 2 um = Wm 2
appears that Ei Ti De Fi
Diset
(wi + Ei w; + (p - 8) 7-
Hence, we gain p-s > ++1 Wi
1
Di ui) We now prove that
p-s
max + +lssis
m: ui 1 Σ
E/z041 Uj
> 0).
For i p, we have
Up +
1
--
Σ
uj
Up + = wp + > 0.
15

---

Under review as a conference paper at ICLR 2023
For i < p. we have
1
+
1
Mj
(i- + 1 -
Uj
i
j=s+1
j=st1
1
(i 8) yu +
Σ
Wi
j=++1
j=st1
p-1
(1 8) um +
Σ
(Ty - ws)
-=++1
j=++1
1
(i 9) (w) + 7) +
T
-=
p-1
1
(i T +
Σ
Tly >0.
3 jmi+1
For i > P. we have
U1 +- 8
Uj
1
(i 8)1; + 1
Σ Uj
8
1=++1
j=st1
p-1
1
(i 8) m
Σ
Tj
Σ wj
j=8+1
j=0+1
p-1
(i w) +
Σ
(IT - wwy)
Σ
ww
==8+1
==p
(i u0 + (p 8 -1)7
Σ W/
jmp
1
(0 - 1)(2s; + 7) +
Σ
(wi w;)
S 0.
j=p
Therefore, p max (s 1+11ii5
m: m: + 1 1 Ej u1) > 0).
Finally, we also have
1-8
T; max(w; + 7, 0}, i s 1,... m and n, = 0,i I,....
Theorem 1. The regularization Ω (w) has the following closed-form:
2
Ω Q(w)=
W
2
1
1 1-3
Σ
m
Wi
(6)
m s
1=s+1
1
Proof. Recall p = max { + 1 m : u1 + 8-8
(1-E)
(1
Σj=ott u₁ > 0). Therefore, p == m
because we have
Um
1
1
Σ
m
Uj
Wm
1
Σ
m
Wi
wm +
Σ W m 8 > 0.
m-
m 8
jms+1
j j=s+1
It follows that
1
Σ
m
Uj
1- Σ
m
wi 2 0.
m
8
m
s
i=s+1
i=++1
16

---

Under review as a conference paper at ICLR 2023
V Jmoo
Imoo
flitt
4/2
4f2
V/f
V/2
Figure 1: Visualization of standard MOO and TA-MOO solutions in a scenario of goal-achieved tasks (V 2 and 2 goal-unachieved tasks (V 21,2) (left) MOO; (middle) MOO on the set of goal-unachieved tasks only: (right) TA-MOO with a solution focuses more on the goal-unachieved tasks.
so mmax (w; + 7, = w; + otherwise
1 isiss
projs (w);
8
m
(ww)
W
+
(w,
max (w; + +2,
i=s-1
m
+
W + (m - 8)7?
1=8-1
i=1
2
m
W
+
Wi
m
8
i=s+1
B.2 ILLUSTRATIONS OF HOw MOO AND TA-MOO WORK
Figure illustrates solutions of MOO and TA-MOO in a scenario of 2 goal-achieved tasks (with corresponding gradients fft22) and goal-unachieved tasks (with corresponding gradients V f112)) As illustrated in the left figure, with standard MOO method, where all the tasks' gradients have been considered regardless their status and the solution associated with the minimal norm is the perpendicular vector as suggested by geometry (Sener & Koltun 2018). If considering the goal- unachieved tasks only as in the middle case, the MOO solution is the edge case. However, this extreme strategy ignores all the goal-achieved tasks which might lead to the instability. The Task Oriented regularization strikes a balance between the two aforementioned strategies as illustrated in the right figure. The method focuses more on improving the goal-unachieved tasks while spend less effort to maintain the goal-achieved tasks. With À = 0 the TA-MOO optimal solution is equivalent to the standard MOO optimal solution while becomes the MOO solution in the case of the coal-unachieved tasks only when X- + C0.
C EXPERIMENTAL SETTINGS
General settings. Through our experiments, we use six common architectures including ResNet18 18 (He al. 2016), V6G16 (Simonyan & Zisserman 2014), GoogLeNet (Szegedy et al., 2015).
EfficientNet (BO) (Tan & Le 2019). MobileNet Howarrd Howard et al. (2017). ) and WideResNer (with depth 34 and widen factor 10) Zagoruyko & Komodakis (2016) with the implementation of https //github. com/ kuanglinn wwannnguu/pyre wwwpytttrhhcc..... saarch-cifee cifar We evaluate on the full testing set (10k) of two benchmark datasets which are CIFARTO and CIFARTON 100 (Krizhevsky et al. 2009). More specifically, the two datasets have 50k training images and 10k testing images, respectively. with the same image resolution of 32 x 32 x However, while the CIFARIO dataset has 10 classes, the CIFARIO 100 dataset has 100 classes and fewer images per class. Therefore, in general, attack a CIFAR 100 model than a CIFAR1O one as shown in Table 7 We observed that the attack performance is saturated with standard training models. Therefore, to make the job of adversaries more challenging, we use Adversarial Training with PGD-AT (Madry et al.] 2018) to robustify the the models and use these robust models victim models in our experiments. Specifically,
adversary is easier to
17

---

Under review as a conference paper at ICLR 2023
Table 7: Robustness performance of models in the experiments
CIFARIO
CIFARTOO
Nat-Acc
Adv-Acc
Nat-Acc
Adv-Acc
ResNet18
86.47
42.14
59.64
18.62
VGG16
84.24
40.88
55.27
16.41
GoogLeNet 88.26
41.26
63.10
19.16
EfficientNet
74.52
41.36
57.67
19.90
MobileNet 76.52
31.12
WideResNet 88.13
48.62
SGD optimizer (momentum 0.9 and weight decay 5 x 10-4) and Cosine Annealing Scheduler to adjust the learning rate with an initial value of 0.1 and train model in 200 epochs as suggested in the implementation above. We use PGD-AT Loo (Madry et al. 2018) with the same setting for both CIFARIO and CIFARIO 100 datasets, i.e., perturbation limitation 8/255, k 20 steps, and step size 17 = 2/255.
Method settings. In this work, we evaluate all methods the untargeted attack setting with Leo norm. The attack parameters the same among methods, i.e., number of attack steps 100, attack budget e = 8/255 and step size 17 = 2/255. In our method, we use K=10 to update the weight in each step with learning rate The 0.005. Tradcoff parameter X = 100 in all experiments. In MinMax (Wang et al. 2021). ), we use the same 3 for all settings and use the authors' implementation
Attacking ensemble model settings. In our experiment, we use an ensemble of four adversarially trained models: ResNet18, VGGI6, GoogLeNet, and EfficientNet. The architecture the same for both the CIFAR10 and CIFAR10 100 datasets except for the last layer which corresponds with the number of classes in each dataset. The final output of the ensemble an average of the probability outputs (i.c., output of the softmax layer). We use three different losses object for generating divergence
adversarial examples including Cross Entropy (CE) (Madry et al. (2018),
(KL) Zhang et al. 2019). and CW loss (Carlini & Wagner 2017).
Universal perturbation settings. We follow the experimental setup in Wang et al. (2021), such that the full test (10k images) is randomly divided into equal-size groups (K images per group). The comparison has been conducted on the CIFAR10 and CIFARIO0 100 datasets, and CW loss. We use adversarial trained ResNet18, VGG16 and EfficientNet base models. We observed that the ASR-AIl was mostly zero, indicating that it is difficult to generate general perturbation for all data points. Therefore, we use ASR-Avg to compare the performances of the methods.
Robust adversarial examples against transformations settings. In experiment, use 7 common data transformations including I-Identity, H-Horizontal flip. V- V-Vertical flip, C-Center crop, B-Adjust brightness, R-Rotttonn, and G-Adjust gamma. The parameter setting for each transformation has been shown in Table 8 In the deterministic setting, a transformation has been fixed with one specific parameter, e.g., center cropping with scale of 0.6 adjusting brightness with factor of 1.3. While in the stochastic setting, a transformation has been uniformly sampled from its family, e.g., center cropping with random scale in range (0.6, 1.0) or adjusting brightness with a random factor in range (1.0. 1.3). The experiment has been conducted on adversarially trained ResNet 8 model with the CW loss.
18

---

Under review as a conference paper at ICLR 2023
Table 8: Data transformation setting. U represents uniform sampling function and p represents probability to excuse a transformation (e.g.. flipping).
Deterministic
Stochastic Identity
Identity
Identity
Horizontal flip
p 1
0.5
Vertical flip
p = 1
p 0.5
Center crop
scale = 0.6
scale U 1.0)
Adjust brightness
factor 1.3
factor (1.00,1.3)
Rotation
angle 10
angle U'(110,
Adjust gamma
gamma 1.3
gamma (0.77
D ADDITIONAL EXPERIMENTS
D.I TRANSFERABILITY OF ADVERSARIAL. EXAMPLES IN THE ENS SETTING
We conduct an additional experiment evaluate the transferability of our adversarial examples. We use an ensemble (RME) of three models: ResNet18, MobileNet, and EfficientNet as a source model and apply different adversaries to generate adversarial examples to this ensemble. We then use these adversarial examples to attack other ensemble architectures (target models), for example, RMEVW is an ensemble of models including ResNet18, MobileNet, EfficientNet, VGG16 and WideResNet. Table/9repone the SAR-All metric of transferred adversarial examples, where a higher number indicates higher success rate of attacking target model, therefore, also implies higher transferability of adversarial examples. The first column (heading RME) shows SAR-All when adversarial examples attack the source model (i.e., the whitebox attack setting).
The Uniform strategy achieves the lowest transferability. It can be observed from Table Table9thht the Uniform strategy achieves the lowest SAR in the whitebox attack setting. This strategy also has the lowest transferability in attacking other ensembles (except ensemble RVW).
MinMax's transferability drops on dissimilar target models. While MinMax achieves the recond-best performance in the whitebox attack setting, its adversarial examples have low trans- ferability when target models are different from the source model. For example, in the target model RVW where there is only one member of the target model from the source model (RME) (i.e., R or ResNet18), 18), MinMax achieves a 23.75% success rate which is lower than the Uniform strategy by 1.28%. Similar observation can be observed on target models EVW and MVW, where MinMax outperforms the Uniform strategy by just 0.2% and 0.6%, respectively.
TA-MOO achieves the highest transferability on a diverse set of ensembles Our TA-MOO adversary achieves the highest attacking performance the whitebox attack setting, with huge gap of 9.24% success rate over the Uniform strategy. Our method also achieves the highest transferability regardless diversity of target ensemble. More specifically, on target models such as REV, MEV, and RMEV, where members in the source ensemble (RME) are also in the target ensemble, our TA-MOO significantly outperforms the Uniform strategy, with the highest improvement is 5.19% observed on target model RMEV. On the target models EVW and MVW which are less similar to the source model, our method still outperforms the Uniform strategy by 1.46% and 1.65%. The superior performance of our ad adversary on the transferability shows another benefit of using multi-objective optimization in generating adversarial examples. By reaching the intersection of all members' adversarial regions, input image shared across
adversary is capable to generate common vulnerable pattern architectures, therefore, increasing the transfcrability of adversarial examples.
D.2 ADVERSARIAL TRAINING WITH TA-MOO
Setting. We conduct adversarial training with adversarial examples generated by MOO and TA- MOO attacks to verify the quality of these adversarial examples. We choose an ensemble of 3 MobileNet architectures (non-diverse set) and ensemble of 3 different architectures including
19

---

Under review as a conference paper at ICLR 2023
Table Evaluation on the Transferability of adversarial examples. Each cell (row-ith, column-jth) reports SAR (higher is better) of adversarial examples from the same source architecture (RME) with an adversary at row-ith attack an ensemble at column-jth. Each architecture has been denoted by symbols such as R: ResNet18, M: MobileNet, E: EfficientNet, V: VGGI6. W: WideResNet. For examples, RME represents for an ensemble of ResNet18, MobileNet and EfficientNet. The highest/second highest performance is highlighted in Bold/Underling The table is copied from Table
in the main paper for reading comprchension purpose.
RME
RVW
EVW
MVW
REV
MEV
RMEV
RMEVW
Uniform
31.73
25.03
22.13
22.73
29.50
28.44
26.95
20.50
MinMax
40.01
23.75
22.39
23.34
32.57
32.75
31.85
21.99
MOO
35.20
24.25
22.94
23.76
30.65
32.28
29.49
21.77
TA-MOO
40.97
25.13
23.59
24.38
33.00
33.05
32.14
23.04
ResNet18, MobileNet and EfficientNet (diverse set). To evaluate the adversarial robustness, we compare natural accuracy (NAT) and robust accuracy (ADV) against PGD-Linf attack of these adversarial training methods (the higher the better). We also measure the success attack rate (SAR) of adversarial examples generated by the same PGD-Linf attack on fooling each single member and all members of the ensemble (the lower the better). We use k = 10, 8/255, 1) 2/255 for adversarial training and PGD-Linf with k = 20, e = 8/255, = 2/255 for robustness evaluation. We use SGD optimizer with momentum 0.9 and weight decay 5e-4. Initial learning rate is 0.1 with Cosine Annealing scheduler and train on 100 epochs.
Result 1. Reducing transferability. It can be seen that the SAR-All All of MOO-AT and TA-MOO-AT are much lower than that on other methods. More specifically, the gap of SAR-All between PGD-AT and TA-MOO-AY is (5.33%) 6.13% on the (non) diverse setting. The lower SAR-All indicating that adversarial examples are harder to transfer among ensemble members on the TA-MOO-AT model than on the PGD-AT model.
Result 2. Producing more robust single members. The comparison of average SAR shows that adversarial training with TA-MOO produces more robust single models than PGD-AT does. More specifically, the average robust accuracy (measured by 100% A-Avg) of TA-MOO-AT is 32.17%, an improvement of 6.06% over PGD-AT in the non-diverse setting, while there is an improvement of 4.66% in the diverse setting.
Result 3. Adversarial training with TA-MOO achieves the best robustness. More specifically, on the non-divese setting, TA-MOO-AT achives 38.22% robust accuracy, an improvement of 1 1% over Min and 5.44% over standard PGD-AT. On the diverse setting, the improvement over MinMax-AT and PGD-AT are 0.9% and 4%, respectively. The root of the improvement is the ability generate stronger adversarial examples the the sense that they can challenge not only the entire ensemble model but also all single members. These adversarial examples lie in the joint insecure region of members (i.e., the low confidence region of multiple classes), therefore, making the decision boundaries more separate. As a result, adversarial training with TA-MOO produces more robust single models (i.e.. lower SAR-Avg) and significantly reduces the transferability of adversarial examples among members (i.e., lower SAR-All). These two conditions explain the best ensemble adversarial robustness achieved by TA-MOO.
D.3 UNIVERSAL PERTURBATION (UNI)
Additional experimental results. In addition to the experiments on ResNet18 as reported in Table 5. we would like to provide additional experimental results on two other adversarial trained models VGG16 and EfficientNet as shown in Table II It can be seen that, TA-MOO consistently achieves the best attacking performance on ResNet18 and VGG16, on both CIFAR10 and CIFAR datasets,
with K 2 8.
20

---

Under review as a conference paper at ICLR 2023
Table 10: Robustness evaluation of Adversarial Training methods on the CIFARIO dataset. RME represents ensemble of ResNet18 (R), MobileNet (M) and EfficientNet E), while MobiX3 rep- resents an ensemble three MobileNets. NAT and ADV measure the natural accuracy and the robust accuracy against PGD-Linf attack (hehe higher the better). Other metrics measure the success attack rate (SAR) adversarial examples generated by the same PGD-Linf attack on fooling each single member and all members of the ensemble (Jthe lower the better). The highest/second highest robustness is highlighted Gold/Underline.... The most important metric is emphasized in blue.
Arch
NAT
ADVT
A-AII
A-Avgl
R/M14
M/M2,
E/M3.
PGD-AT
MobiX3
80.43
32.78
54.34
73.89
76.17
74.35
71.14
MinMax-AT
MobiX3
79.01
37.28
50.28
66.77
65.27
70.27
64.78
MOO-AT
MobiX3
79.38
33.04
46.28
74.36
71.25
74.53
77.29
TA-MOO-AT
MobiX3
79.22
38.22
48.21
67.83
68.04
67.37
68.07
PGD-AT
RME
86.52
37.36
49.01
69.75
65.81
75.24
68.21
MinMax-AT
RME
83.16
40.40
46.91
65.73
65.22
68.28
63.70
MOO -AT
RME
82.04
37.48
45.24
70.11
69.00
75.43
65.90
TA-MOO-AT
RME
82.59
41.32
43.68
65.09
63.77
68.98
62.51
40
PGD-AT
PGD-AT
40
35
TA-MOO-AT
30
Robust Acc (%)
20
Robust
25
20
10
15:
10
20
30
40
50
60
70
80
40
50
60
70
80
Natural Acc (%)
Natural Acc (%)
(a) MobiX3
(b) RME
Figure Comparison progress three adversarial training methods. The bigger marker size represents the later epoch. Each point represents the natural accuracy and robust accuracy against PGD-Linf attack on the testing set.
Table 11: Evaluation of generating Universal Perturbation on the CIFARIO and CIFARI00 datasets. R: ResNet18, V: VGG16, EfficientNet.
CIFARIO
CIFAR 100
K=4
K=8
K=12
K=16
K=20
K=4
K=8
K=12
K=16
K=20
Uniform
37.52
30.34
27.41
25.52
24.31
65.40
58.99
55.33
53.02
51.49
MinMax
50.13
33.68
20.46
15.74
14.73
74.73
62.29
52.05
45.26
42.33
R
MOO
43.80
35.92
31.41
28.75
26.83
69.35
62.72
57.72
54.12
52.25
TA-MOO
48.00
39.31
34.96
31.84
30.12
72.74
68.06
62.33
57.48
54.12
Uniform
37.76
30.81
27.49
25.94
24.46
66.87
61.49
58.53
56.29
$4.98
MinMax
47.96
30.88
20.20
16.93
16.25
78.58
69.14
58.85
51.81
48.09
V
MOO
43.04
34.56
30.07
27.43
25.42
73.46
66.51
61.28
57.88
56.09
TA-MOO
46.58
38.33
32.32
29.16
26.56
75.57
71.86
67.22
62.99
59.19
Uniform
44.86
39.03
36.37
34.65
33.49
67.55
60.99
57.35
54.84
53.57
MinMax
44.47
32.96
27.01
26.47
69.69
$7.99
50.93
45,59
43.87
E
MOO
45.31
39.28
36.44
34.72
33.51
66.68
59.69
54.95
53.20
$1.43
TA-MOO
46.74
37.95
33.95
31.71
30.41
70.40
63.78
58.17
53.26
50.66
21

---

Under review as a conference paper at ICLR 2023
Table 12: Evaluation of generating Universal Perturbation (K=8) on the CIFARIO dataset with ResNet18 architecture and MOO method. (Ti represents value for each task (i.e., sample in a group). w1/w² represents the weight of the first/second group of K samples, while w represents the the statistic of weight over all groups (tean &|V /I gradient norm of the first/second group of K samples, while (VVo(( represents the statistic of gradient norm over all groups (mean-tstd). Io/I1 represents the indicator function for successful (1) or unsuccessful (0) task, while I represents the the statistic of successful rate over all groups
represents the
Ti
T2
T3
Ta
Ts
Ta
Ts
1.15el
3,45e-5
1997-2
1.26c-4
1.27c0
1.04e11
1.0ce 0.0257
9.91c0
ud
0.0238
0.1861
0.1859
0.1861
0.1763
0.1862
0.0299
0
0
0
9.70e0
1.59g1
4.32e-4
4.27e-4
1.25el
6.23e-5
2.91e-5
6.17e-6
0.0341
0.0167
0.1854
0.1854
0.0222 1
0.1854 0
0.1854
0,1854
I
0
0
0
0
4.9326.63
4.23116.7
5.1847.42
3.8445.83
4.39:16.04
6.6627.64
4.82:17.48
5.25
w
0.12+0.08
0.14:0.09
0.12=0.08
0.13+:0.08
0.12:#0.09
0.10=0.08
0.14:0.11
0.11=0.08
0.38+0.49
0.28++0.46
0.36+0.48
0.32+00.88
0.38=#0.48
0.48=0.50
0.32+0047
0.40=0.49
Why does MOO work? As shown in Table 11 MOO consistently achieves better performance than the Uniform strategy (except for the setting with EfficientNet on the CIFAR 100 dataset). To find out the reason for the improvement, we investigate the gradient norm Vof(o) and weight w for the first, and second groups (as an example) and the average over 100 groups of the testset shown in Table 12 It can be seen that in the first and second groups, there are some tasks that have significantly low gradient strengths than other tasks. The gap of the strongest/weakest gradient strength can be magnitude of 10th indicating the domination of one task over others. While this issue can cause the failure in the ENS setting, however, in the UNI setting, the lowest gradient strengths in each group correspond to unsuccessful tasks (unsuccessful ad adversarial examples) and vice versa. Recall that we use the multi-gradient descent algorithm to solve MOO, which in principle assigns a higher weight for a weaker gradient vector. Therefore, in the UNI setting, while the dominating issue still exists, fortunately, the result still fits our desired weighting strategy (i.e., higher weight for an unsuccessful task and vice versa). Moreover, when there are large number of groups (i.e., 100 groups), the issue of dominating tasks is alleviated. The average gradient strength is more balanced as shown in Table 12 This explains the improvement of MOO over the Uniform strategy in the UNI setting.
D.4 ROBUST ADVERSARIAL EXAMPLES AGAINST TRANSFORMATIONS (EoT)
We observed that in EoT with the stochastic setting, adjusting gamma sometimes has the overflow issue resulting in an infinite gradient. Recall that our method using MGDA to solve MOO which relies the stability of gradient strengths. Therefore, in the case of having infinite gradients, learning weight w is unstable, resulting to lower performance in both MOO and TA-MOO.
To overcome the overllow issue, we allocate memory to cache the valid gradient of each task in the previous iteration and replace the infinite value in the current iteration with the valid one in the memory. The storage only requires tensor with the same shape the gradient (i.e., the exact size of the input), therefore, it does not increase the computation resource significantly. As shown in Table 13 this simple technique helps to improve performance of TA-MOO by 5.3% both the CIFAR 10 and CIFAR 100 datasets. also helps to improve performance of MOO by 0.8% and 4.8%, respectively. Finally, after overcoming the gradient issue, the TA-MOO achieves the best performance on the CIFARIOS dataset and the second best performance on the CIFAR 10 dataset (0.4% lower in ASR-AII but 0.8% higher in ASR-Avg when comparing to MinMax). This result provides additional evidence of the advantage of our method.
22

---

Under review as a conference paper at ICLR 2023
Table 13: Robust adversarial examples against transformations evaluation. The highest/second highest performance is highlighted in Bold/ hold//nnerllie. MOO* and TA-MOO* represent version with memory to overcome the infinite gradient issue the stochastic setting.
Deterministic
Stochastic A-All
A-All
A-Avg
A-Avg
Uniform
25.98
55.33
31.47
50.55
MinMax
30.54
52.20
33.35
49.44
MOO
21.25
49.81
26.97
43.84
C10
TA-MOO
31.10
55.26
28.26
45.67
MOO
27.79
45.91
TA-MOO"
32.96
50.27
Uniform
56.19
76.23
59.89
73.73
MinMax
59.75
75.72
61.30
73.59
MOO
53.17
74.21
54.96
69.26
C100
TA-MOO
60.88
76.71
56.23
69.91
MOO
58.79
72.81
TA-MOO"
61.54
74.07
Table 14: Robust adversarial examples against transformations evaluation. The highest/second highest performance is highlighted Bold/Underline. The most important metric emphasized blue color. MOO* and TA-MOO" represent version with memory to overcome the infinite gradient issue in the stochastic setting. Identity, H: Horizontal flip, V: Vertical flip, C: Center crop. G: Adjust gamma, B: Adjust brightness, R: Rotation.
A-All
A-Avg
I
H
V
C
R
Uniform
25.98
55.33
44.85
41.58
82.90
72.56
45.92
49.59
49.93
MinMax
30.54
52.20
43.31
41.59
78.80
64.83
44.38
46.53
45.97
D-C10
MOO
21.25
49.81
36.23
33.93
87.47
71.05
37.68
40.21
42.12
TA-MOO
31.10
55.26
44.15
41.86
85.19
71.86
45.53
48.70
49.54
Uniform
56.19
76.23
70.43
69.01
87.66
87.36
71.40
74.25
73.47
MinMax
59.75
75.72
70.13
69.26
87.45
86.03
71.54
73.30
72.32
D-C100
MOO
53.17
74.21
66.96
65.68
89.16
87.03
68.49
71.11
71.06
TA-MOO
60.88
76.71
70.43
69.37
89.11
87.95
71.70
74.73
73.69
Uniform
31.47
50.55
48.58
44.70
65.52
51.14
47.43
48.76
47.70
MinMax
33.35
49.44
47.35
44.45
62.78
51.75
46.32
47.13
46.34
MOO
26.97
43.84
40.62
38.45
57.65
48.55
40.41
40.71
40.47
S-C10
TA-MOO
28.26
45.67
42.80
39.66
61.98
47.92
41.80
43.01
42.54
MOO
27.79
45.91
42.43
39.65
62.11
51.44
41.62
42.21
41.92
TA-MOO
32.96
50.27
48.18
45.26
62.97
52.49
47.03
48.22
47.76
Uniform
59.89
73.73
73.19
71.15
79.73
74.81
72.05
73.10
72.10
MinMax
61.30
73.59
72.44
70.55
80.04
75.55
71.99
72.49
72.10
MOO
54.96
69.26
67.62
66.11
75.88
72.72
66.87
68.11
67.49
S-C100
TA-MOO
56.23
69.91
68.52
66.92
76.70
72.71
67.57
68.97
67.97
MOO
58.79
72.81
71.58
69.08
80.17
75.01
70.78
71.71
71.33
TA-MOO"
61.54
74.07
72.95
70.95
80.94
76.22
72.22
73.21
72.00
23

---

Under review as a conference paper at ICLR 2023
Table 15: Average time per sample for generating adversarial example. All experiments are measured on the CIFAR10 dataset, EoT and Uni are with ResNet18 architecture.
Ensemble (K-4)
BoT (K=7)
Uni@K=12
Uni
Uniform
640ms
350ms
1850ms
3030ms
MinMax
1540ms
610ms
1210ms
2080ms
MOO
1770ms
1130ms
5600ms
9280ms
TA-MOO
1960ms
1200ms
5870ms
9500ms
Table 16: Stability of experiments' evaluation on different random seeds. Experiment on the ENS setting, with an ensemble of 4 models: Resnet18, 8, VGG16, GoogleNet and EfficientNet.
A-All
A-A
E
Uniform
28.12 + 0.09
48.29 1 0.05
48.81
0.08
49.06
= 0.08
48.27 = 0.10
47.06 = 0.03
MOO
25.61 + 0.36
45.13 + 0.30
39.84 + 0.62
47.29 + 0.36
37.51
0.36
55.90 = 0.17
TA-MOO
37.56 0.32
51.15 0.21
49.37 0.15
52.80 = 0.45
48.98 0.25
53.24 0.13
D.5 GENERATING SPEED COMPARISON AND EXPERIMENTS' STABILITY
Generating Speed Comparison. Table 15 shows the average time to generate adversarial example in each setting. The results are measured on the CIFAR 10 dataset with ResNet18 architecture in the Ensemble of Transformations (EoT) and Universal Perturbation (Uni) settings. We Titan RTX 24GB for the ΕoT experiment and 4 Tesla V100 16GB each for the other experiments. It worth mentioning that our primary focus in this paper is showing the advantage of MOO and the Task-Oriented regularization in generating adversarial examples. Therefore, we did not try to optimize our implementation in terms of generating time.
Experiments' Stabilitty We conduct an experiment with 5 different random seeds to generate adversarial examples for the ENS setting to evaluate the stability experimental results on choosing of random seed. The experiment is the CIFARIO dataset, with ensemble of 4 architectures including ResNet18, VGG16, Leee, and EfficientNet. We report mean and variation values in methods. The
Table T6 It can be observed that there is slight variation in attack performances variation is small enough compared to the gap between methods (i.e., the biggest variation is 0.32% in SAR-All while the smallest gap 2.51 % between MOO and the Uniform approach), therefore, making the comparison still reliable.
D.6 SENSITIVITY TO SYPER-PPARAEER
In this section we provide an analytical experiment on the sensitivity our TA-MOO method to the tradeoff A. The study has been conducted with the ENS setting with CE loss and the BoT setting with deterministic transformations using ResNet18 architecture. All experiments are on the CIFARIO dataset. The value of À is changed from to 1000. It can be observed from Figure 3a (the ENS setting) that (i) increasing reduces the performance of dominated task (i.e., ASR on the EfficientNet decreases from 54.49% at À 1 to 53.40% at X 100) while increases performances of other tasks. In overall, significantly increases the ASR-All performance of the entire ensemble from 99.1 A to 38.01% performance in all tasks, resulting in a lower overall performance.
100. (ii) However, over-high (i.e., À 200) leads to the drop of
similar observation can be seen in the EoT setting in Figure The attack performance on the 50 to 83.67% at X 200. In contract, in the same range of À the overall performance increases from 32.85% 34.36%. The performances of all tasks decrease when using too large À (i.e., A > 200). Based on the result of this study, we choose À 100 in all the other experiments.
dominated task (V- (V-Vertcal flipping) decreases from 86. 11% at X
D.7 COMPARISON WITH STANDARD ATTACKS
We conducted an additional comparison the ENS setting further confirm the effectiveness of our method over standard adversarial attacks (which consider an entire ensemble as a single model). More specifically, we compare with AttoAt (Croce & Hein 2020), Brendel-Bethge attack (BB)
24

---

Under review as a conference paper at ICLR 2023
all
55
50
86
50
45
ASR V Vonly (%6)
FSR (%)
ASR (%)
40
84
40
35
30
0.0
0.5
1.0
1.5 (og1clA)
2.0
2.5
0.0
1.0
1.5 (0g:o(A)
2.0
2.5
3.0
(a) ENS setting
(b) EoT setting
Figure 3: Sensitivity to the parameter X.
Table 17: Attacking Ensemble model with a diverse set D=(R-ResNe118, V-VGG16, G-GoogLeNes E-EfficientNer) and non-diverse ND=(4 ResNets). ). Experiment the CIFARIO dataset with cross-entropy objective loss. The most important metric is emphasized blue.
A-AlI
A-Avg
R/R1
V/R2
G/R3
E/R4
PGD
28.21
48.34
48.89
49.08
48.38
47.03
CW
6.10
16.63
13.53
15.76
11.74
25.47
B&B
6.67
38.03
37.95
38.92
35.58
39.68
D
AutoAttack
30.71
45.49
48.32
45.83
47.25
40.56
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
PGD
28.17
48.75
51.94
45.55
54.15
43.34
CW
4.71
13.86
14.92
12.71
17.51
10.31
B&B
5.29
40.51
49.06
35.19
48.63
29.16
ND
AutoAttack
37.00
49.32
51.07
48.58
51.08
46.55
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
(Brendel et al. 2019), Carlini-Wagner attack (CW) (Carlini Wagner 2017). and PGD attack (Madry et 2018). For AutoAttack, we use the standard version which includes different attacks. For BB attack, initialized with the PGD attack with 20 steps. For CW attack, we the confidence factor to 1.0. We evaluate these attacks on 2 ensemble settings, diverse (D) ensemble set with 4 different architectures (ResNet18, VGG16, GoogLeNet, and EfficientNet) and a non-diverse (ND) ensemble set with 4 ResNet18 architectures.
can be seen from the Table 17 that our TA-MOO attack consistently achieves the best attack performance, with significant gap compared to the best standard attack. More specifically, our TA-MOO method achieves 38.01 (SAR-All metric) on the diverse ensemble set, while the second best attack is AutoAttack with 30.71% % (a gap of 7.3%). On the non-diverse set, the gap between our TA-MOO and AutoAttack is still notably large 4%. These standard attacks consider an entire ensemble as single model, i.e., aim to optimize single objective given single ensemble output. Therefore, they cannot guarantee a successful attack on each member.
25

---

Under review as a conference paper at ICLR 2023
Table 18: Evaluation attacking performance on the ImageNet dataset. RE/LE/TAR/UNTAR rep- resents Robust Ensemble/Less-Rooleee EnsembleeTarrgtte Attack/Untargette Attack, respectively. R18/R50/STD represents robust ResNet18, robust ResNet50 and standard ResNet50 pre-trained model, respectively. The most important metric is emphasized in blue.
A-All
A-Avg
R18/R18
R50/R50
R50/STD
RE-TAR
Uniform
29.58
39.38
42.50
32.22
43.42
MOO
29.66
39.73
42.86
32.32
44.00
TA-MOO
29.68
39.73
42.90
32.26
44.02
LE-TAR
Uniform
30.30
58.14
42.36
32.06
100.0
MOO
30.66
58.37
42.70
32.48
99.94
TA-MOO
30.68
58.25
42.54
32.36
99.86
RE-UNTAR
Uniform
48.58
60.11
64.22
51.72
64.38
MOO
48.68
60.20
64.30
51.82
64.48
TA-MOO
49.80
59.71
63.80
52.38
62.94
LE-UNTAR
Uniform
34.24
61.01
46.98
36.28
99.78
MOO
44.76
68.29
58.42
46.64
99.80
TA-MOO
49.46
70.74
61.26
51.14
99.82
D.8 ATTACKING THE IMAGENET DATASET
Experimental Setting. We conduct experiments on the ENS setting using the adversarial pre-
trained models the RobustBench (Croce et al.) 2021). We use two sets of ensemble to verify the importance of our task-oriented strategy. The first set is the robust ensemble (RE) set including 3 robust models: ResNet18 (model ID: Salman2020Do. R18 (Salman al.) 20200:
bust accuracy 25.32%), ResNet50 (model ID: Salman2020Do R50 (Salman et al. (2220) robust accuracy 34. (4) and ResNet50 (model ID: aong2020Fast (Wong al.) 2019), robust accuracy 26.24%). The second set is the less-robust ensemble (LE) which inc Includes models: ResNetl6 (model ID: Salman2020Do R18), ResNet50 (model ID: Salman2020Do R50) and the standard training ResNet50 (model ID: Standard R50, robust accuracy 0%). We use both targeted attack and untargeted attack settings, with 4/255 and the validation set to evaluate.
1/255 with 20 steps. We use 5000 images of
Experimental Results.
We report experimental results with different settings in Table 18 where RE/LE//AR//NTAL represents Robust Ensemblle/Less-Rontee
Ensemble/ Attack/Untar- geted Attack, respectively. It can be seen that, in the robust ensemble setting (RE-TAR and RE- UNTAR), our MOO achieves similar performance compared to the baseline, while TA-MOO has further improvement over MOO. The gap of SAR-All between TA-MOO and the uniform weighting strategy 0.1% % in the targeted attack setting (RE-TAR), while that in the untargeted attack setting is 1.2%. In the less-robuse ensemble setting (LE-TAR and LE-UNTARE the improvement of our methods over the baseline higher than the robust ensemble setting. With the gap SAR-AIl between TA-MOO and the uniform strategy is 0.38% with the targeted attack setting (LE-TAR), while the gap in the untargeted setting (LF-UNTAR) is 15.22% a significantly higher. While is acknowledged that the targeted attack more common protocol in attacking the ImageNet dataset (Athalye et al. 2018), however, we believe that our significant improvement on the untargeted attack still worth noting.
We conduct an additional experiment on the EoT setting with the ImageNet dataset and report result in Table 19 this experiment, we use the robust pretrained ResNet18 model (model ID: Salman2020Do R R18) as the victim model. We use the standard attack setting, i.e., targeted attack with = 4/255, = 1/255 with 20 steps. It can be seen that both MOO and TA-MOO could obtain a better attack performance than the uniform strategy. It is worth noting that, in the experiment on the CIFARIO/CIFARII 100 datasets (i.e., Table 6 in the main paper) the dominating issue of the vertical filliping exists and prevents MOO to obtain a better performance. In the ImageNet dataset, the dominating issue is less serious, therefore, explains the improvement of MOO and corroborates hypothesis the issue of dominating task.
26

---

Under review as a conference paper at ICLR 2023
Table 19: Evaluation on the EoT setting with the ImageNet dataset. The most important metric is emphasized in blue.
A-All
A-Avg
B
R
Uniform
31.52
46.59
41.12
40.98
67.42
41.60
43.26
41.82
49.96
MOO
31.92
47.19
41.92
41.78
67.64
42.10
43.66
42.74
50.48
TA-MOO
32.00
47.21
41.94
41.80
67.66
42.06
43.70
42.80
50.52
Table 20: Evaluation of Attacking Ensemble model on the CIFARIO (C10) and CIFAR 100 (C100)
datasets. The highest/second highest performance is highlighted in Bold/Underline. The table is copied from Table I in the main paper for reading comprehension purpose.
CW
CE
KL
A-All
A-Avg
A-All
A-Avg
A-AII
A-Avg
Uniform
26.37
41.13
28.21
48.34
17.44
32.85
MinMax
27.53
41.20
35.75
51.56
19.97
33.13
C10
MOO
18.87
34.24
25.16
44.76
15.69
29.54
TA-MOO
30.65
40.41
38.01
51.10
20.56
31.42
Uniform
52.82
67.39
55.86
72.62
38.57
54.88
MinMax
54.96
66.92
63.70
75.44
40.67
53,83
C100
MOO
51.16
65.87
58.17
73.19
39.18
53.44
TA-MOO
55.73
67.02
64.89
75.85
41.97
53.76
E ADDITIONAL DISCUSSIONS
E. WHEN DOES MOO WORK?
The dominating issue On one hand, there is the dominating issue that happens in all the three settings. The issue can be recognized by the gap of attack performance among tasks. For example. in Table (i.e., the ENS setting with the diverse ensemble and MOO method), the gap between highest ASR (at EfficientNet) and lowest ASR (at GoogLeNet) is 19%. In the EoT setting, the problem is even worse: The largest gap observed is 53.6% as shown in Table 14 (the highest ASR is 19% with Vertical flipping and the lowest ASR 34.54% with Horizontal flipping with MOO D-C10 setting). The dominating issue is also be recognized by the observation that significant small gradient strength of one task on comparison with other tasks' strength. For example, in Table
Table 21: Attacking Ensemble model with a diverse set ( V-VGG16, G-GoogLeNet, E. EfficientNet and non non-diverse set ND=(4 ResNets). w represents the final w of MOO (mean = std). & represents the gradient norm of each model (mean + std). The table is copied from Table in the main paper for reading comprehension purpose.
A-All
A-Avg
R/RI
V/R2
G/R3
E/R4
(V)ll
7.15 + 6.87
4.29 + 4.64
7.35 + 7.21
0.98 + 0.72
D
0.15 + 0.14
0.17
10.13
0.15 + 0.14
0.53 - 0.29
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
[V)
8.41 + 8.22
6.68+t 6.95
7.36 + 6.03
5.67 + 6.09
ND
w
0.23 + 0.21
0.24+0.11
0.23 + 0.19
0.30 0.21
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
27

---

Under review as a conference paper at ICLR 2023
21 it can be seen that the gradient strength corresponding the EfficientNet architecture (mean value is 0.98) is much lower than those of other architectures (mean values are at least 4.29). As the result, the weight corresponding to the EfficientNet architecture is much higher than those of others.
The root of the dominating issue can be the natural of the setting (i.c., as shown in Table 14 with the EoT setting, when the domination of the Vertical flipping task can be observed in all methods) or because of the MOO solver which is discussed in Section
Overcoming the dominating issue. On the other hand, if overcoming this issue, MOO can out- perform the Uniform strategy. For example, on attacking the non-diverse ensemble model (i.e., 4 ResNets) MOO surpasses the Uniform strategy by 4.3% and 3.5% in the ASR-All and ASR-Avg metrics, respectively. On generating universal perturbations, MOO outperforms the Uniform strategy in most of the settings. As discussed in Section D.4 simple memory caching trick can helps to overcome the infinite gradient issue and significantly boosts the performance of MOO TA-MOO. Therefore, we believe that developing technique to lessen the dominating issue might be potential extension to further improve the performance.
Balancing among goal-unachin -nachived tasks. We observed in the EoT setting, the dominating issue is strictly serious when gradients of some tasks are much weaker/stronger than others. It is because of the natural of the transformation operations, therefore, this issue happens regardless status of the tasks. In the set of goal-unachieved tasks' gradients can exist dominated one, resulting to a much higher weight of the dominated task. Therefore, order strike more balance among goal-unachice tasks, we apply an additional regularization which minimizes the entropy of goal-unachieved weights H(w) = Σn _ w; log w/- If all tasks have been achieved (i.e., s m) then the additional regularization will be ignored. This additional regularization helps to improve further 2% in the EoT setting.
E.2 IMPORTANCE OF THE TASK-ORIENTED REGULARIZATION.
In this discussion, we would like to provide more experimental results in the ENS and EoT settings to further emphasize the contribution of the Task-Oriented regularization. of each individual task in the ENS setting with three losses and the EoT setting with ResNet18 architecture and deterministic transformations. As shown in Figure 4a in the ENS setting, the MOO adversary produces much higher ASR on the EfficientNet architecture than other architectures with any losses. In contrast, the TA-MOO adversary has lower ASR the EfficcinttNet architecture but a much higher ASR on other architectures. Similar observation can be seen in Figure 4b such that the ASR corresponding to the V-flipping of MOO is slightly higher than that of TA-MOO, however, the ASR on other transformations of MOO is much lower than those of TA-MOO.
4 the ASR
E.3 MORE EFFICIENT MOO SOLVERS
Discussions on the weighted-sum method. One of the most common approaches to solve the MOO problem is the scalarizing method, which formulates single-objective optimization (SOO) such that the optimal solutions to the SOO problem are Pareto optimal solutions to the MOO problem. While this line of approach (e.g., weighted-sum method) suitable for end-to-end learning such as deep learning, there are several acknowledged weaknesses: (i) the choice of utility function has large impact on the computational complexity of the resulted SOO problem [Bjornson et al., 2014 Björnson & Jorswieck 2013); (ii) small change in weights may results in big changes in the combined objective (Caballero et al. 1997), and vice versa, a huge different weights may produce nearly similar result (Coello Coello, 1999); (iii) it does not work well in the case of non-convex
objective space (Deb) 2011).
One of the most common replacement for the weighted-sum method is the constraint method which is applicable to either convex or non-convex problem. Applying a more efficient MOO solver might be one of the potential extensions of this work.
Discussions the gradient descent solver. Inspired by Sener & Koltun (2018), in this paper use multi- -ulti--rrdient descent algorithm (Deb) 201T) as an MOO solver which casts the objectiveeee problem to single-objective problem. While Sener & Koltun (208)) used Wolle algorithm to
28

---

Under review as a conference paper at ICLR 2023
R-CE
MOO TA-MOO
Identity
MOO TA-MOO
50
80
V-CE
40
G-KL
H-Flip
Retation
30
10
V-KL
V-Flip
Brightness
E-CE
R-KL
Crop
Gamma
(a) ENS setting
(b) EoT setting
Figure 4: Comparison on the ASR of each individual task. R: ResNet18, V: VGG16, G: GoogLeNet,
E: EfficientNet. CE: Cross-entropy loss, KL: Kullback-Leibler divergence, CW: Carnili- Carnili-Wagner loss
project the weight into the desired simplex, we use parameterization with softmax instead. Although this technique is much faster than Frank- Wolfe algorithm, it has some weaknesses that will be addressed in our future work. More specifically, the GD solver with softmax parameterization cannot handle well the edge case which is the root of the dominating issue. The snippet code [E.3 provides a minimal example of quadratic optimization problem as similar in MGDA, where the goal is to find w* = argmin E ||.. The solver is the Gradient Solver with softmax parameterization. w.A..
With input, where none of elements dominates others, the solver works quite reasonable with the weights corresponding to first elements are equal and less than the last one (corresponding bigger strength). With input, where
> 91. the solver still works well where the minimal strength 91 0.1. However, with inputz. the solver fails to find good solution (which should be w [1, 0, 0, 0) given that input). It is worth noting that the main goal of this paper is to show the application of Multi-objective Optimization for generating adversarial examples and the impact of the Task-Oriented regularization. Therefore, while the issue of the gradient descent solver well recognized, we did not take effort to try with a better solver.
corresponding to
import torch import torch. nn. functional as import torch. optim as optim
input_1 [0.1, 0.1, 0.1, 0.1, 0.2] # normal case
input_2 [0.01, 0.1, 0.1, 0.1, 2c3] normal case
input_3 [0.001, 0. 0.002, 0.002, 0.002, 2e3] # dominating issue
init_alpha [0.2, 0.2, 0.2, 0.2, 0.21 g torch. (input
11 alpha torch tensor (init alpha, rqquires_grad-Tnus
12 opt aptim.30D [alphal, ir=1.0)
13
for step in range (20):
15
F.softmax (alpha, dim=0)
16
loss = torch. torch. (torch..sum sum + )
17
wtt.zeeroggrddj (oss.backward
opt.step()
20
print (1 stsppp= (), w=() format (step, w. dedeth () .uuppy )
21
22 Result with input
step-19, w- w-[0. 20344244 0. 0.244442 0. 20344244 0. 202444424 0. 1862302222
Result with input_ 2
29

---

Under review as a conference paper at ICLR 2023
25 step=19, w= w=19. 999982e-01 5. 582609e--07 5.582609e-07 5.582609e-07 0.1
26 Result with input_3
27 step=19, w- [0. 28042343 0 039888888 0. 23985888 0 039988888 0.]
Listing 1: Python example of the Gradient Solver with softmax parameterizatton
E,4 CORRELATION BETWEEN THE OBJECTIVE LOSS AND ATTACK PERFORMANCE.
It is broadly accepted that to fool model, feasible approach is maximizing the objective loss (i.c., CE, KI,, or CW loss), and the higher the loss, the higher the attack success rate. While it is true with the same architecture, we found that it does not hold when comparing different architectures. Figure 5 shows the adversarial loss and the attack success rate for each model in the ENS setting, With the CW loss as the adversarial objective, it can be observed that there a positive correlation between the loss value and the ASR, i.e., the higher the loss, the higher the ASR. For example, with the same adversarial examples, the adversarial loss on EfficientNet is the highest and so is ASR. However, there is no clear correlation observed when using CE and KI. losses. Therefore, the higher weighted loss does not directly imply a higher success rate for attacking an ensemble of different architectures. The MinMax method (Wang et al.] (021) which solely weighs the tasks' losses, therefore, does not always achieve a good performance in all the tasks.
E.5 ADDITIONAL EXPERIMENTS WITH MULTI-TASE LEARNING METHODS
is worth noting again that our work is the first to apply multi-ohjective optimization to the adversarial generation task for the classification problem. Therefore, the MOO approach should be considered our naive approach instead of a baseline to compare with. However, it is a worth research question that: Might better multi- multi-objective optimizations with specific constraint favor diverse Pareto solutions can improve performance in our setting? Therefore, in this section we would like to provide additional experiments with recent multi-task learning methods to explore how better constrained approaches can improve over the naive MOO. We applied two recent multi-task learning methods PCGrad Yu et al. (2020) and CAGrad Luu al. (202 with implementation from their official repositories into our adversarial generation task. For PCGrad we use the mean as the reduction mode. For CAGrad we use parameter a 0.5 and rescale
in their default setting. We experiment on attacking ensemble of models setting with two settings, a diverse set D with 4 different architectures including R- R-ResNet18, V-VGG16, GeGoogLeNet, E-EfficientNet and a non-diverse set ND with ResNet18 8 models.
can be seen from the Table 22 that in the diverse ensemble setting, the two additional methods significantly outperform the standard MOO method with the improvement gaps of SAR-AII around 3% and 5%, respectively. In the non-diverse ensemble setting, while PCGrad achieves a lower performance than the standard MOO method, CAGrad can outperform the MOO method with 2.7% improvement. The improvement on the diverse set of PCGrad and CAGrad over the standard MOO method is more noticeable than the non-diverse set. It can be explained by the fact that on the diverse set of model architectures, there is a huge difference in gradients among architectures, therefore, requires a better multi-task learning method to handle the constraint between tasks. On the other hand, on both ensemble settings, our TA-MOO still achieves the best performance, with a huge gap of (5.8%) 7.8% compared to the second best method on the (non) diverse setting. It is because our method can leverage a supervised signal from knowing whether a task is achieved or not focus on improving unsuccessful tasks. It a huge advantage compared to unsupervised multi-task learning methods as MOO, PCGrad, and CAGrad.
E.6 CONFLICTING BETWEEN GRADIENTS IN THE ADVERSARIAL GENERATION TASK
In multi-task learning setting, conflicting between gradient is the common issue to tackle with. More specifically, the gradients with respect to the (shared) model parameter of task fa and task fy can have a negative correlation (i.e., cosine similarity between Vaf 8) and (ef 5) is negative). However, in the adversarial generation task, we consider the gradient with respect to the input (e.g., Vo5(0,5) to update the adversarial examples. As explore through empirical experiments,
30

---

Under review as a conference paper at ICLR 2023
4700
(a) CW
(b)
Pocker moders albrrtaee
(c) KL
Figure 5: Loss (left fig) and ASR (right fig) of each task over all attack iterations with the MinMax method. model0/1/2/3 represents R/V/G/E architecture, respectively.
31

---

Under review as a conference paper at ICLR 2023
Table 22: Attacking Ensemble model with a diverse set D= V-VGGI6, G-GoogLeNet, E- E-EfficientNet) and non-diverse set ND=(4 ResNets).
A-All
A-Avg
R/R1
V/R2
G/R3
E/R4
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
PCGrad
28.25
48.28
48.81
49.03
48.13
47.14
D
CAGrad
30.23
48.34
47.03
48.22
45,92
52.20
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
PCGrad
28.30
48.75
52.02
45.42
54.35
43.21
ND
CAGrad
35.22
51.07
54.22
47.84
55.24
46.97
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
Table 23: Correlation between gradients of ensemble members ENS setting, Each cell (row-ith, column-jth) reports the cosine similarity (mean + std) between gradient Vofi(ō) of model ith and gradient V (5) of model jth (w.rt. the same input 5). The last f reports the gradient norm each model. R: ResNet18, V: VGGI6, E: EfficientNet, G: G-GoogLeNet.
V
G
E
R
1.00
0.34=0.15
0.44
0.35=0.19
V
0.3410.15
1.00=#.00
0.3611.19
0.41=0.22
G
0.44+10.17
0.36+0.19
1.00++.00
0.41=0.18
E
0.35++0.19
0.41+0.22
0.41
1.00=0.00
7.15 6.87
4.29 4
7.35 + 7.21
0.98 0.72
the issue that we to deal with is not the gradient confliction problem but the gradient domination problem. These gradients with respect to the inputs have positive correlation but also have huge difference in their strengths. this specific challenge, the standard MOO which solely relies on the gradient strengths calculated the weight for each task is strongly sensitive to the gradient domination problem and in some cases cannot lead to good solution as discussed in Appendix E.
To further support our hypothesis, we would like provide measurement on the cosine similarity between gradients on different ensemble members on the ENS setting in Table 23 Each cell (row-ith, column-jthh jth) of the Table reports the cosine similarity between gradient & (o) of model ith and gradient Vafz(5) of model jth (w.r.t. the same input 6). It can be seen that the gradients between different architectures has the positive correlation instead of negative correlation. On the other hand, shown in the last row, the gradient norm [6)] varies widely among architectures. While this observation is line with the widely accepted phenomenon about the transfcrability of adversarial examples, it also does support motivation to derive the TA-MOO method to improve the standard MOO.
E.7 DISCUSSION ON THE CONVERGENCE OF OUR METHODS
In multi-task learning, the gradient of each task is calculated with respect to the (shared) model parameter (e.g., (ef (8,8), Therefore, quantify the convergence of a multi-task learning method, we can measure the gradient norm of the comment gradient direction to quantify the convergence of the model. The gradient norm is expected be very small value when the model reaches to the Pareto optimality points. However, in adversarial generation problem, the gradient of each task is calculated with respect to the input (e.g., V (0, 8)). Therefore, unlike in the multi-task learning, there is different behavior of gradient in the adversarial generation task. To verify our hypothesis, we measure the gradient norm of the gradient over all attack iterations and visualize Figure 6 can be seen that the gradient norm of all attacks tends to converge to large value. It is worth noting that we use projected gradient descent with Iso all attacks. Therefore, in each attack iteration, the amount to update is not the gradient V (0, but the sign of scaling with step size n/8- However,
32

---

Under review as a conference paper at ICLR 2023
16
14
12
Uniform
10
PCGrad
CAGrad
8
MOO
6
TAMOO
4-
2
0
20
40
60
80
100
Figure 6: Norm of the gradient Vof(d) over attack iterations. Measure on the diverse set of the ENS setting, with CE loss.
there is still an interesting observation such that MOO and TA-MOO attack have much lower gradient norm than other attacks.
We would like propose simple alternative approach quantify the convergence of our method in the adversarial generation setting. More specifically, we leverage the advantage of the adversarial generation task such that we can access to the label audit whether the task is successful not. Therefore, simply measure the loss and the success attack rate over all attack iterations as shown Figure 7
First, would like to recall the definition of the Pareto optimality. Given objective func- the Pareto optimality 8 of the multi-objective optimization 8* = arrgaxx (()) if there no feasible solution such that is strictly better than in some tasks (i.e.,
tion f(ā) (5).
f((8') fi()) for some while equally good 8 in all other tasks (i.e., (8") = (8")). i). Bear this definition in mind, it can be seen from the loss progress of MOO attack in Figure 7 that (i) from iteration to around iteration 10th all the losses are increased quickly showing that the method optimize efficiently; (ii) after iteration 10th, the loss w.r.t. the EfficientNet model (i.e., model3 in the legend) continually increases while other losses continually decrease. Therefore, any solution after iteration 10th do not dominate each other indicating that the method reaches the Pareto front.
the other hand, can seen from Figure 7b that loss progress our TA-MOO more stable. TA-MOO also optimize the optimal point efficiently MOO does, however, after reaching the peak, the losses in tasks are more stable than those MOO. This observation indicates that the solutions after the peak point also in the Pareto front but can explain the stability of the success attack rate TA-MOO in Figure (7b Comparing across both MOO and TA-MOO their last iteration shows that while the loss (model3) in MOO is a bit higher than that in TA-MOO, these other losses w.r.t. V/G/E models in MOO lower than those in TA-MOO. This observation indicates that in term of losses, the solutions of MOO and TA-MOO do not dominate each other. However, the solution of TA-MOO is more stable and leads better final attacking performance.
concentrated than those in MOO.
the EfficientNet model
E.8 ADDITIONAL EXPERIMENTS WITH DIFFERENT INITIALIZATION FOR MOO
In our method, the default initialization for the weight w is 1/m equally for all tasks. Therefore, one raising valid concern is that Might better initialization help to boost the performance?. To answer
33

---

Under review as a conference paper at ICLR 2023
03
40
mudelt
model)
midelt
modett
300
80 100
80
30 180
(a) MOO
(b) TA-MOO
Figure 7: Loss (left fig) and SAR (right fig) of each task all attack iterations. model0/1/2/3 represents R/V/G/E architecture, respectively. The CW loss is used as the adversaries 's objective function.
Table 24: Attacking Ensemble model with a diverse set D=(R-ResNet18, V-VGG16, G-GoogLeNet, E-EfficientNet). MOO MOOA/BI A/B/C/D is MOO with initial weights from set A/B/C/D, respectively. denotes the learning rate to update for the weight w.
Th 5e-3
The 5e-5
The
1e-8
MOO
28.64
29.18
29.12
MOO
29.13
28.75
28.65
MOO
29.38
28.46
28.33
MOO
29.53
28.37
28.18
MOO
25.16
TA-MOO
38.01
this question, we first find the optimal initital weight by using the weight the last iteration when running MOO and TA-MOO attacks with the default initialization. For example, as shown in Figure 8a for the ENS setting with diverse architectures, the average weight that MOO assigns for model (set A), respectively. The average weights' distribution learned by TA-MOO is 19/00/255/0. 19/0.377 (set B), respectively. It is worth noting that, we consider each set of weights for each data sample separately, and the above weights are just the average over entire testing set (e.g.. 10K sample), while the full statistic (mean = std) of weights can be seen in Table 2. In order to make the experiment to be more comprehensive with diverse initializations, we two additional sets including set C=(0.22, 0.23, 0.22, 0.33] and D=[0.24, 0.25, 0.24, 0.27].
R/V/G/E converging to 0. 0.15/0.17/0 15/0.53
Given these above four weights sets A/B/C/D, we then init the standard MOO with one of these above sets and adjust the learning rate The with three options 5e-3, 5c-5, 1c-8 and report results in Table 24 The complete attacking progress can be seen in Figure 8 It can be seen from Table 24 that better initialization does help improve the performance of the standard MOO. The best setting the initialization with set D and 7r 5e-3 achieves 29.53% in A-All metric, 4.37% improvement over the default MOO initialization. It can be seen from the evolution of the weights in Figure Be that even initializing with the converged weights (i.e., set A) from the pre-running attack, the weight of each task does not stand still but converges to a different value. It is another different behavior in adversarial generation task compared to the multi-task learning problem. On the other hand, despite of the extensive tuning, the performance MOO is still far below the TA-MOO approach, with the gap of 8.48% in A-All metric.
34

---

Under review as a conference paper at ICLR 2023
0.375
0.50
0.310
0.525
0.300
0.275
0.200
model2
0.255
model
model3
affcct Fi0003
0000k terslion
(a) MOO
(b) TA-MOO
0.7
0.5
0.3
model
model
10
otock no-uice
01303 (erilio
(c) MMO0M with 1/u 5c-3
(d) MOO with 1/u 5c-3
0.45
00.35
3.30
modalo
0.30
modell
modall
0.25
modell
100
160
40
60
ottact Pheraticn
(e) MOOC with T/u
5e-3
(I) MOO with Y/o 5e-3
Figure 8: Weight (left fig) and SAR (right fig) of each task all attack iterations. model0/1/2/3 represents R/V/G/E architecture, respectively.
35


Reviews:
[{"review_id": "PEiFAGevlMe", "reviewer": "Reviewer_H7Re", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The other suggest to extend the multi-objective optimization (MOO) method. Their new proposed method is called Task Oriented MOO. They claim that naive MOO invest useless effort in trying to maximize already achieved goals, their method let the optimizer spend more effort on improving the goal-unachieved tasks. They formalize the adversarial generation task as a multi-objective optimization problem and apply their TA-MOO approach to the problem. The authors show comprehensive experiments in which their method is better than the current baseline.", "summary_of_the_review": "The paper is original and improves the baselines. The paper is written in high quality fashion.", "strength_and_weaknesses": "### Strength  \nThe paper is written in a clear and easy to follow fashion. The results seems to improve the baseline and the MOO method by a nice margin most of the time. The method and formulation, therefore, make sense to the adversarial generation task. The authors are the first to view the adversarial generation task as a MOO problem. The discussions and comprehensive experiment are clear and supporting the understanding of the method.\n\n### Weaknesses\nThe paper did not fully explained the evaluation metrics. Why does the A-All is the most important metric for this task?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "Eqg7nruNt9", "reviewer": "Reviewer_Fq8c", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes to use multi-objective optimization to generate adversarial examples for model ensembles, adversarial examples against several transformations, and universal adversarial perturbation. Specifically, by setting the different models in the ensemble as different objectives, it turns the problem into multi-objective optimization. To further improve the performance, a regularizer is then proposed to suppress the successful attack and encourage the unsuccessful attack. Extensive experiments have been done in several cases including generating adversarial examples for model ensembles, adversarial examples against several transformations, and universal adversarial perturbation to show the effectiveness of the proposed method. The experiment results show the proposed method could achieve a better performance compared to several baselines.", "summary_of_the_review": "The paper proposes to use multi-objective optimization to generate adversarial examples in several settings including model ensemble, universal perturbation, etc.  The experiment shows the proposed method could achieve good results in several settings. However,  as all the settings use the max as its ensemble, it is not clear whether the proposed method could be used in other ensemble cases.", "strength_and_weaknesses": "Pros:\n1. The paper is well-written and easy to follow.\n2. The experiment results show that the proposed method could achieve a good result in generating adversarial examples in several settings.\n\n\nCons:\n1. To my understanding, the proposed framework could only be applied into the ensemble that uses the max, min, and majority vote as its aggregation rule. It is not clear if the proposed method still works if the ensemble is taking the average of every model's output.\n2. The proposed settings are kind of similar to each other. A better setting will be generating adversarial examples with the different norms and proposing a defense to defend against several norms attacking at the same time. \n3. I am not quite sure if the novelty is strong or not since the proposed method just applies multi-objective optimization. Also, I am not sure whether the proposed regularizer is already proposed in the multi-objective optimization before or not.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "DQ4xwTEgg7", "reviewer": "Reviewer_aC9i", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a method for generating adversarial examples for satisfying multiple goals based on multi-objective optimisation (MOO). The paper can be classified into the family of adversarial attack algorithms. A multi-gradient decent algorithm is utilised to solve the optimisation problem by integrating all gradients w.r.t. different objectives into a single gradient direction, but the optimisation process of MOO always tends to treat all tasks equally. Therefore, a regularisation term is proposed to emphasise unachieved tasks while putting less weight on already satisfying tasks. The paper then gives four experiments, including adversarial attack and training over multiple models, universal perturbation, and adversarial attack over data transformations, to validate the utility of the proposed approach.", "summary_of_the_review": "See Section Strength And Weaknesses\n", "strength_and_weaknesses": "Strength:\n\n1. The proposed method is basically considering a generating attacks scenario where multiple domain losses are needed to be optimised together simultaneously. The insight behind the technique is to balance the weights of all tasks, and a regularizer is added to push greater weights on unsatisfied tasks.\n\n2. The paper is well-written, and the main idea is easy to follow.\n\n3. Comprehensive experiments show that the proposed method is better than the uniform case and minimax case.\n\n\nMain concerns:\n\n1. The novelty of such formulations is not clear to the reviewer. The main contribution claimed by the authors is that this is the first work that regards adversarial attacks as a multi-objective optimisation problem. But, there are some works in the literature which takes this formulation into consideration in adversarial example generation scenario (especially, e.g., [1], [2]).\n\n2. This problem and considered scenarios are similar in spirit to [2]. The proposed regularizer added to the optimisation objective function is a fairly basic and straightforward trick to weigh different domain losses. It cannot be considered a sufficient contribution for an ICLR paper.\n\n3. From the perspective of multi-objective optimisation theory, any analysis in terms of convergence and Pareto-optimal frontier is essential.\nReference \n\n[1] Qiu, H., Du, Y. and Lu, T., 2022. The Framework of Cross-Domain and Model Adversarial Attack against Deepfake. Future Internet, 14(2), p.46.\n\n[2] Wang, J., Zhang, T., Liu, S., Chen, P.Y., Xu, J., Fardad, M. and Li, B., 2021. Adversarial attack generation empowered by min-max optimization. Advances in Neural Information Processing Systems, 34, pp.16020-16033.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ApBB-wIU1hd", "reviewer": "Reviewer_g196", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work proposes a multi-objective optimization approach capable of dealing with objectives that converge at different rates. The authors then claim that three problems within the realm of generating adversarial examples can be cast as multi-objective optimization and apply the proposed Task Aware Multi-objective optimization (TA-MOO) algorithm for these problems. The main rationale behind TA-MOO is to augment the optimization problem to find a common descent direction within the standard multi gradient descent (MGD) with a regularization term that enforces the weights of the common descent direction to be larger for objectives with smaller losses (in the case of a problem of maximization of objectives). Experiments on two datasets, namely CIFAR-10 and CIFAR-100, considering the tasks of generating i- adversarial examples for an ensemble model, ii- universal perturbations, and iii- adversarial examples against transformations showed that TA-MOO outperformed the compared approaches in most of the cases.   ", "summary_of_the_review": "The main contributions of this work are casting problems related to generating adversarial perturbations as multi-objective optimization and proposing a gradient-based multi-objective algorithm to solve the aforementioned problems. In the current version of the manuscript, the the major limitations of the work are lack of motivation for the use of multi-objective optimization (i.e. why using multi-objective optimization for this problem?), and limited scope of experiments both in terms of baselines and aspects considered in the analysis. In my review, I raised questions and provided suggestions that could address some of the limitations. At this point, I believe this contribution is not yet ready to be considered for publication.", "strength_and_weaknesses": "Strengths:\n- The authors proposed a general multi-objective approach that showed promising results on three different (but related) problems related to adversarial examples generation;\n\n- The proposed algorithm, TA-MOO, has a mechanism to enforce the solutions of the multi-objective problem to focus on the central regions of the Pareto front, which is a desired feature in the case of the studied applications;\n\n- The experiments on generation of adversarial perturbations are broad in the sense that they account for different aspects of the considered problems. \n\n\nWeaknesses:\n\n- Lack of motivation for the contribution: one of the main claims of this work is “multi-objective optimization is a natural tool for adversarial example generation”, however, other than the fact that there are multiple objectives to be simultaneously satisfied, I am not able see why this is the case since there is no clear evidence that there is a tradeoff between the objectives when generating adversarial examples;\n\n- Limited evaluation: the main contribution of this work is proposing a variation of a gradient-based multi-objective optimization algorithm capable of dealing with objectives that converge at different rates. However, it is not clear to me whether the choice of problems for evaluation is in fact suffering from the issue TA-MOO is proposed to solve. Moreover, the experiments in the main paper do not analyze important aspects of the proposed algorithm, such as if it is able to reach Pareto stationary solutions in practical applications;  \n \n- Lack of strong baselines: I believe using unconstrained MGD (referred to in the manuscript as MOO) is not a fair choice of baseline in a case where it is known a priori that the desired solutions are in the central region of the Pareto front since MGD has no mechanism whatsoever to incorporate user preferences to guide the optimization. In the following section of the review I suggest stronger baselines to be considered. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject