GSE: Group-wise Sparse and Explainable Adversarial Attacks
Authors: Shpresim Sadiku
Moritz Wagner
Sebastian Pokutta
Venue: ICLR 2025 Poster (2025)
Keywords: Sparse Adversarial Attack
Quasinorm Regularization
Nesterov Accelerated Gradient
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: Sparse adversarial attacks fool deep neural networks (DNNs) through minimal pixel perturbations, often regularized by the $\ell_0$ norm. Recent efforts have replaced this norm with a structural sparsity regularizer, such as the nuclear group norm, to craft group-wise sparse adversarial attacks. The resulting perturbations are thus explainable and hold significant practical relevance, shedding light on an even greater vulnerability of DNNs. However, crafting such attacks poses an optimization challenge, as it involves computing norms for groups of pixels within a non-convex objective. We address this by presenting a two-phase algorithm that generates group-wise sparse attacks within semantically meaningful areas of an image. Initially, we optimize a quasinorm adversarial loss using the $1/2$-quasinorm proximal operator tailored for non-convex programming. Subsequently, the algorithm transitions to a projected Nesterov's accelerated gradient descent with $2$-norm regularization applied to perturbation magnitudes. Rigorous evaluations on CIFAR-10 and ImageNet datasets demonstrate a remarkable increase in group-wise sparsity, e.g., $50.9\%$ on CIFAR-10 and $38.4\%$ on ImageNet (average case, targeted attack). This performance improvement is accompanied by significantly faster computation times, improved interpretability, and a $100\%$ attack success rate.

Published as a conference paper at ICLR 2025
GSE: GROUP-WISE SPARSE AND EXPLAINABLE ADVERSARIAL ATTACKS
Shpresim Sadiku 1.2 Moritz Wagner & Sebastian Pokutta!
Department for Al in Society, Science, and Technology. Zuse Institute Berlin, Germany 2 Institute of Mathematics, Technische Universität Berlin, Germany (sadiku, wagner, pokutta| ii.de
ABSTRACT
Sparse adversarial attacks fool deep neural networks (DNNs) through minimal pixel perturbations, often regularized by the Eu norm. Recent efforts have replaced this norm with a structural sparsity regularizer, such as the nuclear group norm, craft group-wise sparse adversarial attacks. The resulting perturbations are thus explainable and hold significant practical relevance, shedding light on an even greater vulnerability of DNNs. However, crafting such attacks poses an optimization challenge, as it involves computing norms for groups of pixels within non-convex objective. We address this by presenting two-phase algorithm that generates group-wise sparse attacks within semantically meaningful areas of an im- age. Initially, we optimize a quasinorm adversarial loss using the 1/2- quasinomn proximal operator tailored for non-convex programming. Subsequently, the al- gorithm transitions to projected Nesterov's accelerated gradient descent with 2 2-norm regularization applied to perturbation magnitudes. Rigorous evaluations on CIFAR- 10 and ImageNet datasets demonstrate a remarkable increase in group- wise sparsity, e.g., 50.9% on CIFAR-10 and 38.4% on ImageNet (average case, targeted attack). This performance improvement is accompanied by significantly faster computation times, improved explainability, and 100% attack success rate.
INTRODUCTION
Deep neural networks (DNNs) are susceptible to adversarial attacks, where input perturbations deceive the network into producing incorrect predictions (Carlini & Wagner, 2017; Athalye et al., 2018; Zhou et al., 2020; Zhang et al., 2020). These attacks pose serious security risks in real-world systems and raise questions about the robustness of neural classifiers (Stutz al., 2019). Investigating adversarial attacks is crucial for diagnosing and strengthening DNN vulnerabilities, especially in areas where such attacks have proven effective, including image classification (Chen et al., 2020; Li et al., 2020), image captioning (Xu et al., 2019b), image retrieval (Bai et al., 2020; Feng et al., 2020), question answering (Liu et al., 2020a), autonomous driving (Liu ct al., 2019), automatic checkout (Liu et al., 2020b), face recognition (Dong et al., 2019), face detection (Li et al., 2019), etc.
While many methods for crafting adversarial examples focus on lp neighbourhoods with 2 1, recent research has explored the intriguing case of p leading to sparse adversarial attacks. The prevailing approaches for generating sparse adversarial attacks involve solving formuuaaeee problems, employing greedy single-pixel selection (Su al., 2019), local search techniques (Narodytska & Kasiviswanathan, 2016), utilizing evolutionary algorithms (Croce & Hein, 2019), or relaxing tu via the & ball and applying various algorithms handle these structures (Carlini & Wagner, 2017; Modas et al., 2019). However, most of these methods only minimize the number of modified pixels and do not constrain the location and the magnitude of the changed pixels. The perturbed pixels can thus exhibit substantial variations in intensity or colour compared to their surroundings, rendering them easily visible (Su et al., 2019). This has motivated the necessity of imposing structure to sparse adversarial attacks by generating group-wise sparse perturbations that are targeted to the main objective in the image (Xu et al., 2019a; Zhu et al., 2021; Imtiaz et al., 2022; Kazemi et al., 2023). Fig. 1 illustrates successful group-wiss wise sparse adversarial examples generated by our proposed algorithm (GSE). This way the generated perturbations are also explainable, i.e., they perturb semantically meaningful pixels in the images, thus enhancing human interpretability.

---

Published as a conference paper at ICLR 2025
Unlike traditional attacks that appear noise humans but features to DNNs (Ilyas et al., 2019), this approach bridges the gap between human perception and machine interpretation.
Contributions. We devise a two-phase ap- proach for creating group-wisg sparse adversarial attacks. First, we employ non-convex regulariza- tion select pixels for perturbation, leveraging combination of the proximal gradient method from (Li & Lin, 2015) and novel proximity-basee pixel selection technique. Then, we apply Nesterov's s accelerated gradient descent (NAG) on the cho- sen pixel coordinates to complete the attack. Our GSE (Group-wise Sparse and Explainable) at- tacks outperform state-of-the- (SOTA) methods on CIFAR-10 10 and ImageNet datasets, requiring sig- nificantly fewer perturbations. We achieve 50.9% increase in group-wise sparsity on CIFAR-10 and 38.4% increase on ImageNet (average case, tar- geted attack), all while maintaining 100% attack success rate. 3 Through quantitative assessment of the alignment between perturbations and salient image regions, we underscore the value of group- wise sparse perturbations for explainability analysis. Specifically, our GSE attacks provide superior explainability over SOTA techniques in both group-wise sparse and traditional sparse attack domains.
Original
GSE perturbed Changed pixels
Figure 1: Adversarial attacks generated by our algorithm. The top row depicts targeted attack of target label "water bottle", and the bottom row depicts untargeted attack.
1.1 RELATED WORK
Recent works have introduced methods for generating group-wise sparse and explainable adversarial attacks. StrAttack (Xu et al., 2019a) represents structured sparse and explainable adversarial attack, relying on the alternating direction method of multipliers (ADMM). It enforces group-wise sparsity through dynamic sliding mask designed to extract spatial structures from the image. Similarly, SAPF (Fan et al., 2020) leverages f, Box ADMM for integer programming to jointly optimize binary selection factors, continuous perturbation magnitudes of pixels, and image sub-regions. FWnucl- group (Kazemi et al., 2023), abbreviated as FWnucl, is another structured sparse adversarial attack. quantifies the proximity of perturbations to benign images by utilizing the nuclear group norm, Wolfe
capitalizing on the convexity of nuclear group norm balls through the application of (FW) optimization scheme (Frank Wolfe, 1956). Homotopy- AAtack (Zhu et al., 2021) is a sparse adversarial attack that operates based on the non monotone accelerated proximal gradient algorithm (nmAPG) (Li & Lin, 2015). can incorporate group-wise sparsity by segmenting the image pixels using the SLIC superpixel algorithm and applying regularization using the resulting 2, 0~"norm". We empirically compare our approach to the aforementioned attacks.
New research combines adversarial examples and model explanations, merging key concepts from both areas. On datasets like MNIST (LeCun et al., 1998), (Ignatiev et al., 2019) illustrates hitting set duality between adversarial examples and model explanations, while (Xu et al., 2019a) shows the correspondence of attack perturbations with discriminative image features. Our attack strategy perturbs regions neighbouring already perturbed pixels, resulting in shift of the most susceptible pixels of an image due to our initial sparse perturbations. We conduct empirical analysis to examine the overlap between sparse perturbations in enhancing explainability, we also incorporate SOTA sparse adversarial attacks (Modas et al., 2019; Croce & Hein, 2019) into our experiments.
attacks and salient image regions. To highlight the crucial role of group-wise
ADVERSARIAL ATTACK FORMULATION
Let X [Imn: Imax] Mx represent feasible images, where M and N are the image dimensions (height and width) and C' is the number of color channels. Let X be benign image with label I e N. and E N be a target label, where t + I. Additionally, let L X' x N + R be a classification loss function, such as the cross-entropy loss, tailored for given classifier C. We introduce distortion
2

---

Published as a conference paper at ICLR 2025
Algorithm I Forward-Backwar Splitting Attack
Require: Image E X. target label t, loss function L. sparsity parameter À > 0, step sizes dx, number of iterations K
1: Initialize w (0)
f- 0.
2: for f- 0,-.., K - do
3:
(x(++1) +- ProXoLAll-11 (w)(t) az V (i) L(x w(()
[Definition in Eq. (3).)
4: end for return io (k)
function D MxxxC + R20. The goal of a targeted adversarial attack find an image Wadv to which C assigns the target label and that is in close proximity to according to the function D. In summary, formulating targeted adversarial example for the input can be framed
min WER MXNXX
C(x w, 1) + XD(w),
where À is a regularization parameter. The untargeted adversarial attack formulation can be found in Appendix A. Note that Eq. (I) is general framework, and a specific distortion function D must be defined to generate adversarial examples practice.
2.1 QUA-INUAN REGULARIZATION
Sparse adversarial attacks can be generated using quasinorm-regulane where the distortion function in Eq. (1) is set to ((.) ;= -11 11 leading to the optimization problem
methods (Wang et al., 2021),
min XXXXXX
C(x + w, w.t) t) + A 1
(2)
for 0 < p 1. Here
|u; 1/ is only quasinorm since subadditivity is not satisfied
for p 1. Once Eq. (2) is solved, yielding i E arg min w L(x + æn, t) + >/| [|l the adversarial example is given by zadv = clipx (x w). To obtain i we employ the Borward-backwarn splitting algorithm (Li & Lin, 2015), as detailed in Algorithm 1. In their work. (Cao et al., 2013)
derive a closed-form solution for the proximal operator of 11
prox X (w) == min
lly
w + lylp
(3)
VERMENNG 2A
for = J. Given that [p is separable, by (Beck, 2017, Theorem 6.6) it sufficient to deduce the characterization of 11-11 in Eq. (3) when MNC 1. Fach component is thus given by
2m
2022 (w;)
) ss)),
(w)) = 3
1 + cos
(4)
3
3
where
wi 3
((2A) = 5/4
(22(w))) = arccos
4 (2A) S=
|ws] > ((2)). (5)
While the present solution to Eq. (2) porp= can generate highly sparse adversarial perturbations, these perturbations tend be of large magnitude, making them easily perceptible (Fan et al., 2020). Moreover, this approach does not guarantee that the perturbations will affect the most critical pixels in the image. Our primary objective is to generate group-wiss sparse adversarial attacks that are of low magnitude and targeted at the most important regions of the image.
2.2 GROUP-WISE SPARSE ADVERSARIAL ATTACKS OF Low MAGNITUDE
We propose a two-phase method to generate meaningful group-wise sparse adversarial examples with minimal &2 norm perturbation, and enhanced explainability natural byproduct (see Sec. 3.4.2).
Step Determine which pixel coordinates to perturb by tuning coefficients X. This step finds the most relevant group-wise sparse pixels to perturb by combining the 122-qusiioomm regularization

---

Published as a conference paper at ICLR 2025
of Sec. 2.1 with novel heuristic approach X. Instead of single X, consider vector of tradeoff parameters À E R-20 MXNC for the 1/2-quasinorn regularization term, allowing to adjust R20
each entry individually. Due to Eq. (4), we can formally define the proximal operator to vector N XC of tradeoff parameters R 20
prox I
i.j.c =
prox A 1e
(2))
In the first & iterations, constituting Step I, reduce Ai.je for pixels located proximity already perturbed pixels (Eq. (10)), thereby making them more susceptible to perturbation.
AdjustLambda. After computing iterate (h( by forward-bace backward splitting with Nesterov momentum (line in Algorithm 2), we update (1)) by first building a mask
m = sign Σ
1 (R)
[0, 10,11MMXN,
hive
to identify the perturbed pixels. Next, we perform 2D convolution m using square Gaussian blur kernel K IR"x" with appropriate padding, yielding a matrix
M = m + K E [0, M|M
(8)
where entries with indices close to non-zero entries of m are non-zero. Appendix B properly defines this operation. From the blurred perturbation mask M, we compute matrix M E RRMN using
M is +1, 1, if + O,
M
ij
q,
else,
for 0 < q S 1. Finally, we increase (decrease) the tradeoff parameters for pixels situated far from (close to) those previously perturbed by computing tradeoff parameters
1++1) Aad
where i E {l,..., M) and j E N}. Aii
(10)
M
We thus expand regions with reduced tradeoff parameters specified is iterations, identifying (k) the most relevant group-wiss sparse pixels at coordinates (i,j), where Xig. is lower than the initial
value A.j-e. Unlike existing methods, ours operates independently of predefined structures like pixel partitions. This first step acts only as heuristic to select the key group-wise sparse pixels, with the proper optimization problem formulated and solved over these selected coordinates in the next step.
Step 2: Solve a low magnitude adversarial attack problem only over the selected coordinates. In the remaining iterations, algorithm formulates simplified optimization problem over the pixel coordinates selected in Step given by
min L(x + w. t) + p||l||2.
(11)
weV
where μ 0 (same for all pixels) is tradeoff parameter controlling &2 -orm perturbation magnitude. The subspace V is defined as
(aengi (
( A.g.ee MXNxC
(12)
spanned by standard unit vectors Cij.e. The projection onto V operates as
{0r [iijer if ef EV, otherwise.
PP (w)),
(13)
Thus, the projection Py out entries not in V while leaving the others unchanged. We apply projected Nesterov's accelerated gradient descent (NAG) to solve Eq. (11), enabling generation of meaningful group-wise sparse perturbations of low magnitude. In the next iterations, perturbations
only affect pixels at coordinates (i.j) where (k) less than the initial X. For most perturbed pixels,
4

---

Published as a conference paper at ICLR 2025
Algorithm 2 GSE: Group-Wir Wiise Sparse and Explainable Attack Require: Image X. target label loss function L, regularization parameters X, 0, step size
numbers of iterations k, K, sequence Otk.
1: Initialize w()) <- 0, ( <- A1, define f(w) = L(x w,,) ul/2l122
2: for e 0,... ...;,
do
3: (((++)) + prox 1-13 (w) -o with) -v
(1(
(1((41)) t- (1 an an (1+) + (K)
5: ((++1)= Ad Adjjst
end for
7: for k,.,,
do
8: (x(+1)) t (k) - oV w(t) (f(w)(())
(k+1) - Pv (11-ai) an) (t)) + on (k)
[Definition Eq. (13).)
10: end for
11:
return i w (K)
all channels will be affected, Cije E V across all channels This process is succinetly outlined in Algorithm 2, where we use a sequence or as in (Nesterov, 1983)
1 3x+1
8o 0 3
4.%-1) Og
3x)
(14)
In our tests, we initially perform a section search find the maximum where ( * Another section search then determines the appropriate À for successful attack. The projected NAG in Algorithm 2 (solving Eq. (11)) converges as NAG solving an unconstrained problem, since the projection Pv acts only within subspace V (see Appendix C for proof).
3 EXPERIMENTS
We demonstrate the effectiveness of our proposed GSE attack for crafting group-wise sparse and explainable adversarial perturbations. After outlining experimental setup and defining the relevant comparing metrics, Sec. 3.4 compares our approach with multiple previous SOTA group-wise sparse adversarial attacks. Additionally, Sec. 3.4 covers ablation studies regarding the explainability of such attacks, visualizations, empirical time costs, and success against adversarially trained networks.
3.1 DATASETS
We experiment on CIFAR-10 (Krizhevsky et al., 2009) and ImageNet (Deng et al., 2009) datasets, analyzing DNNs 10k randomly selected images from both validation sets. For the classifier C' on CIFAR-10, we train a ResNet20 model (He et al., 2016) for 600 epochs using stochastic gradient descent, with initial learning rate of 0.01, reduced by factor of 10 after 100, 250, and 500 epochs. We set the weight decay to 10 momentum to 0.9, and batch size to 512. For ImageNet, we employ ResNet50 (He al., 2016) and more robust transformer model, VIT B 16 (Dosovitskiy et al., 2020), both with default weights from the torchvision library. All tests are conducted on a machine with an NVIDIA A40 GPU, and our codes, 10k image indices from the ImageNet validation dataset, and target labels for targeted ImageNet tests are available at https://github.com
http:///twwbioooe/geeemrrrr///// wagnermoritz/GSE.
3.2 EVALUATION METRICS
Consider n images (=1),... ..., (n)) and the corresponding perturbations ...,, w()), where (+,), (1) + (0) E X. Among these, let m. S n denote the number of successfully generated adver- sarial examples (+) + w Then, the attack success rate (ASR) is simply defined as ASR m./n. Assume that the first m, adversarial examples are the successful ones. We compute the average number changed pixels (ACP) via
ACP
m Ilo.
(15)
m, MN
5

---

Published as a conference paper at ICLR 2025
Table 1: Our attack Homotopy-Attack and SAPF ResNet20 classifier for CIFAR-10. Perturbations for every attack were computed for all images sequentially. Due to the extensive computation time of Atttak,yy-Attckk, we tested on a limited sample size of 100.
Uniargeted
Targeted
Atlack
ASR
ACP
ANC
8
d3.0
Time
ASR
ACP
ANC
8g
dg.0
Time
GSE (Ours)
100%
42.5
1.88
0.76
180
2,93s
100%
107
2.56
1.13
301
4,08
Homotopp
100%
55.3
2.78
0.64
256
499c
100%
113
4.27
1.05
394
754s
SAPP
100%
87.3
4,59
0.41
324
250s
100%
109
4.87
0.78
346
2776
Table 2: Untargeted attacks on ResNet20 classifier for CIFAR-I0, and ResNet50 and ViT ___ classifiers for ImageNet. Tested on 10k images of each dataset.
Attack
ASR
ACP
ANC
82
d2.0
GSB (Ours)
100%
41.7
1.66
0.80
177
CIFAR-I1 10 ResNet20
StrAllack
100%
118
7.50
1.02
428
94.6%%
460
594
ImageNet ResNet50
GSB (Ours)
100%
1629
8.42
1.50
3428
StAttack
100%
7265
15.3
2.31
11693
FWnool
47.4%
13760
3.79
1.81
16345
ImageNet
GSB (Ours)
100%
941
5.11
1.95
1964
VIT VTT_B_1
StrAllack
100%
10.8
2.03
8152
57.9%
3.04
where the perturbation masks (*) defined in Eq. (7). We utilize the ACP instead of the O-norm since all tested group-wise sparse attacks minimize the ACP. To determine the number of perturbed pixel clusters in (x + (()), we create mask (i) as in Eq. (7) and treat it as a graph where adjacent 1-entries are connected nodes. The number of clusters in the perturbation is equal to the number disjoint connected subgraphs, which we determine by depth-first search. Averaging this number over all successful examples gives us the average number of clusters (ANC).
The value | for a perturbation w. as suggested in (Zhu et al., 2022) heavily relies on the pixel partitioning method. Instead, assess the group-wise sparsity of perturbation by considering all np by np pixel patches of an image, rather than only a subset resulting from partitioning. Let w E R MxC overlapping np by np patches in w. Then define
np < N, and let G = [G..... G be a set containing the index sets of all
d2 = 1i |w ll + 0, i = 1.,,..,k)
(16)
Let x and w represent a vectorized image and its corresponding perturbation in R4, respectively. We measure the explainability of perturbations using the interpretability score (IS) (Xu et al., 2019a), derived from the adversarial saliency map (ASM) (Papernot et al., 2016b). For an image æ of true class and target class ASM(æ, L,L) IRd indicates the importance of each feature for classification. The IS is then defined as
IS, xz, 1,1) | 1,1) σ will
[1,
i[|SMMa, 1,t)); > v, (0 otherwise,
1,x,,,0)=
(17)
where v is some percentile of the entries of ASM(2, I,t. Note that, when IS x, I,t) approaches 1, the perturbation primarily targets pixels crucial for the class prediction of the model. For visual representation of salient image regions, we use the class activation map (CAM) (Zhou et al., 2016). Recall that CAM identifies class-specific discriminative image regions, aiding in visually explaining adversarial perturbations. See Appendix D for more details on ASM, IS, and CAM.
We evaluate all attacks on these metrics in the untargeted and in the targeted setting. For CIFAR-IU 10, the targeted attacks are performed with respect to each wrong label. For the evaluation of the attacks on ImageNet, we choose ten target labels for each image by randomly choosing ten distinct numbers a1 .... 010 E .1.... 999} and defining the target labels t; for image with the true label by t; = + a; mod 1000. In the targeted setting, as suggested in (Fan et al., 2020), we give three versions of each metric: best, average, and worst case.

---

Published as a conference paper at ICLR 2025
Table 3: Targgted attacks performed ResNet20 classifier for CIFAR-10, 10, and ResNer50 and ViT B_16 classifiers for ImageNet. Tested on 1k images from each dataset, 9 target labels for CIFAR-10 and 10 target labels for ImageNet.
Average
Attack
ASR
ACP
ANC
E2
d2.0
ASR
ACP
ANC
Eq
d2.0
ASR
ACP
ANC
E2
da.0
CHEAR-10 RosNec2o
GSE (Ours)
100%%
29.6
1.06
0.68
137
100%
86.3
1.76
1.13
262
100%
162
15.9
1.37
399
FWWuuct
100%
283
1.18
1.48
515
85.8%
373
2.52
2.54
564
40.5%
495
4,27
3.36
609
ImageNet
(Qurs)
100%
3516
2.16
5967
100%
243
16724
100%
3.1
29538
StrABack
100%
6579
7.18
2445
9K30
100%
15071
18.0
3.77
20221
100%
39088
13.1
611
34768
PWancc
31.1%
9897
3.81
2,02
11295
1.36%
19356
7.58
3.17
20591
0.0%
NAA
N/A
NGA
NIA
InsageNer VIT 16
GSE (Qurs)
100%
916
3,36
2.30
1782
100%
2667
7.72
2,87
4571
100%
5930
14.3
3,60
9228
StrAbackk
100%
3550
733
2.04
3963
100
S129
330
13349
100%
10047
3.88
N/A
(a) ImageNet ViT B_16
(b) CIFAR- 10 ResNet20
IS
IS
0.6
0.6
0.4
0.4
50
60
70
80
90
50
60
80
90
GSB (Ours)
StrAttack
FWnucl
PGD, + Sparse-RS - SAPF
Figure 2: IS vs. percentile v/ for targeted versions of GSE vs. five other attacks. Evaluated on an ImageNet ViT B 16 classifier (a), and CIFAR- 10 ResNet20 classifier (b). Tested on Ik images from each dataset, target labels for CIFAR-10 and 10 target labels for ImageNet.
3.3 ATTACK CONFIGURATIONS
To find hyperparameters 9. o, μt and i of our algorithm, we run a grid search where ACP + ANC is the objective and ASR 1.0 the constraint. The exact hyperparameters Regarding StrAttack, we modify the authors' implementation to be compatible with PyTorch, em- ploying the parameters recommended in (Xu et al., 2019a), specifically those from Appendix F. For FWnucl, we implement the nuclear group norm attack in Py Torch, setting = 5. We adjust the implementation of Homotopy-Atuee and use their recommended parameter settings. For SAPF, we use hyperparameters from (Fan et al., 2020) and choose the sparsity parameter to minimize perturbed pixels while retaining a success rate of 100%. We run all the attacks for a total of 200 iterations.
be found in Appendix D.
to support group-wise sparsity following (Zhu et al., 2021)
3.4 RESULTS
As shown in Tab. I, our method significantly outperforms the Homotopy-Attack and SAPF in both targeted and untargeted attacks on CIFAR-10. While Homotopy-Attac and SAPF surpass our method only slightly in the 2-norm perturbation magnitude, this metric is of secondary importance in the group-wise sparse attack setting. In contrast, our method excels in increasing the overall sparsity and group-wise sparsity, all while substantially reducing the cluster count and the computation time. Due to Homotopy-Attack much slower speed and inability to process batches of images in parallel, we couldn't 't replicate SAPF's ImageNet results
exclude it from further experiments. Additionally, due to floating-por -oint overflow during the ADMM update, we also exclude SAPF. We proceed with the more recent FWnucl and StrAttack in further tests.

---

Published as a conference paper at ICLR 2025
GSE (Ours)
StrAliack
FWnuel
Original
Figure 3: Visual comparison of successful untargeted adversarial instances generated by attack, StrAttack, and FWnuel. Adversarial examples are shown in the top row, perturbed pixels highlighted in red in the middle row, and the perturbations in the bottom row. The target model is ResNet50. Perturbations are enhanced for visibility.
3.4.1 EMPIRICAL PERFORMANCE
In Tab. we present untargeted attack results on CIFAR-10 10 and ImageNet datasets. Notably, our method and StrAttack attain a 100% ASR in both cases. Furthermore, our algorithm significantly outperforms other attacks terms of ACP. Specifically, our algorithm achieves an average sparsity of 4.1% CIFAR-I0 and 0.5% on ImageNet when attacking ResNet50 classifier. Additionally, our method demonstrates exceptionally high group-wise sparsity, with an increase of 70.2% on 11 and 70.7% on ImageNet when attacking ResNet50 classifier, outperforming the current SOTA.
The results for targeted attacks are presented in Tab. 3, where our method and StrAttack achieve perfect ASR in both cases. However, nucll results in 0% worst-case ASR on the ImageNet dataset indicating no worst-case results for FWnuel on ImageNet. Our algorithm yields the sparsest perturbations, changing on average only 8.4% of the pixels CIFAR-10 images and 13.4% of the pixels in ImageNet images when attacking a ResNet50 classifier. Moreover, our method achieves remarkable group-wise sparsity, with significant decrease of d2 by 50.9% on CIFAR-IO and 20% on ImageNet when attacking ResNet50 classi- fier, while maintaining the lowest magnitude of attacks measured by the 2- norm. While GSE is outperformed by a SOTA attack (FWnucl) only the number of clusters for ImageNet, this remains insignificant considering FWnucl's high ACP and low ASR compared to method. Furthermore, replicating experiments with a ViT B 16 classi- fier in Tab. 2 and Tab. 3 demonstrates our algo- rithm's 's substantial margin over SOTA, achieving 73.8% (55.6%) increase in sparsity and 76% (38.4%) in group-wise sparsity in the untargeted (targeted) setting, while also attaining the low- est perturbation norm. Additional results can be found in Appendix E.
Original
GSE example
GSE Pecturbazion
3.4.2 EXPLAINABILITY
Figure 2 illustrates the IS metric for the targeted attacks across various percentiles of ASM scores for samples from the CIFAR-10 and ImageNet datasets. Notably, the figure highlights that our method consistently achieves higher IS scores compared to other group-wise sparse attacks, es- pecially for higher percentiles v. This shows that
Figure Targeted adversarial examples gener- ated by GSE. The target is "airship" for the first two rows, and "golf cart" for the last two rows. The attacked model is a VGG19. Perturbations are enhanced for visibility.
8

---

Published as a conference paper at ICLR 2025
Table 4: Comparison of empirical attack computation time per image. In every experiment, all attacks utilize a batch size of 100 images.
Untargeted
Targeted
CIFAR-10
ImugeNet
CIFAR-
ImugeNNet
Attack
ResNet20
ResNet50
ViI B 16
ResNet20
ResNet50
ViT_B_
(Ouns)
3.18s
7.05%
4.42s
10.3s
StrArtack
0.97%
15.2s
33.66
1.28s
18.5s
34.2s
FWauel
0.256
9.93s
26.08
0.32s
11.68
26.2s
Table Comparison of group-wise sparse adversarial attacks for an adversarially trained ResNet50 ImageNet classifier. Tested on 10k ImageNet instances.
Atlack
ASR
ACP
ANC
f2
d2.0
ImaesNet
(Ours)
20990
ResNet50
FWmuel
26542
25956
the perturbations generated by GSE are more focused on the most salient regions of the image. To emphasize group-wise sparsity's 's pivotal role in enhancing explainability, we include SOTA sparse adversarial attacks like PGD, (Croce & Hein, 2019) and Sparse-RS (Croce et al., 2022), all of which are outperformed by the group-wise sparse attack techniques considered. See Appendix E.2 for additional results.
We display the visualizations for untargeted group-wise sparse adversarial examples in Fig. 3, while Fig. 4 presents those for targeted group-wise sparse adversarial examples. Using the CAM technique (Zhou et al., 2016), we demonstrate the alignment between our algorithm's perturbations and local- ized, class-specific discriminative regions within the images. The generated perturbations effectively encompass the most discriminative areas of the objects, a testament to our algorithm's impressive achievement of explainability. In the perturbation depictions, unperturbed pixels are shown in grey since the perturbations are not required to be non- non-negative.
3.4.3 SPEED COMPARISON
Tab. 4 summarizes the runtime performance of our algorithm vs. SOTA methods. Notably, GSE exhibits significantly faster performance compared to both FWnucl and StrAttack. This speed advantage stems partially from the method used to enforce group-wisg wise sparsity. While StrAttack calculates the Euclidean norm of each pixel group in every iteration and integrates it as regularization using ADMM, FWnuel computes solution for nuclear group-norm LMO in each iteration. In contrast, our attack initially computes a solution for the 1/2 1/2-quasinorm proximal operator in the first & iterations. Subsequently, the attack transitions to projected NAG with l2 - regularization, which is less computationally costly than the methods employed by both StrAttack and FWnucl.
3.4.4 GSE AGAINST ADVERSARIALLY TRAINED NETWORKS
In this section, we present further results on the performance of GSE against an adversarially trained DNN, following the method outlined in (Madry et al., 2018), a standard approach for improving DNN robustness to adversarial attacks. Tab. 5 shows the results of group-wis sparse attacks on an adversarially trained ResNet50, using PGD projected onto a 2 nonorm ball of radius from MadryLab'ss Robustness package (Engstrom et al., 2019), tested on the ImageNet dataset. Overall, GSE shows superior tradeoffs, achieving competitive accuracy while altering the fewest pixels (ACP), maintaining favorable ratio of perturbed pixels (ACP) to clusters (ANC), and recording the lowest d2,0- Although FWnuel slightly outperforms GSE in ANC, this is due to its excessive number of perturbed pixels (ACP). StrAttack only marginally surpasses GSE in attack success rate (ASR) and l2 formm.. These results suggest that GSE generates perturbations that adversarially robust models struggle to defend against effectively.

---

Published as a conference paper at ICLR 2025
4 CONCLUSION
We introduced "GSE", a novel algorithm for generating group-wise sparse and explainable adversarial attacks. Our approach is rooted in proximal gradient methods for non-convex programming, featuring additional control over changed pixels, and the use of projected NAG technique to solve optimization problems. Extensive experiments validate that GSE excels producing group- group-wise sparse adversarial perturbations, all while simultaneously exhibiting the highest level of sparsity and the shortest computation time. Moreover, GSE excels over existing approaches in terms of quantitative metrics for explainability and offers transparency for visualizing the vulnerabilities inherent in DNNs. This endeavour not only establishes a new benchmark for the research community to evaluate the robustness of deep learning algorithms but also suggests simple defense strategy: employing the adversarial examples generated by GSE in adversarial training (Madry et al., 2018). 8). For more sophisticated solutions, advocate further exploration. We anticipate adverse ethical implications future societal consequences from our research.
ACKNOWLEDGEMEETT
This research was partially supported by the Deutsche Forschungsgemeinscaatt (DFG, German Research Foundation) as part of Germany's Excellence Strategy through the Berlin Mathemat- ies Research Center MATH+ (EXC-2046/1, Project ID): 390685689) and the Research Campus MODAL funded by the German Federal Ministry of Education and Research (BMBF grant number 05M14ZAM).
REFERENCES
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pp. 284-293. PMLR, 2018.
Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang. Targeted attack for deep hashing based retrieval. In Computer Ecion-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part 16, pp. 618-634. Springer, 2020.
Amir Beck. First-order methods in optimization. SIAM, 2017.
Wenfei Cao, Jian Sun, and Zongben Xu. Fast image deconvolution using closed-fore thresholding for- mulas of lq (q= 12, 23) regularization. Journal of visual communication and image representation, 24(1):31-41 2013.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Weilun Chen, Zhaoxiang Zhang, Xiaolin Hu, and Baoyuan Wu. Boosting decision-based black-box adversarial attacks with random sign flip. In European Conference on Computer Vision, pp. 276-293. Springer, 2020.
Francesco Croce and Matthias Hein. Sparse and imperceivable adversarial attacks. Proceedings of the IEFE/CVF International Conference on Computer Vision, pp. 4732 2019.
Francesco Croce, Maksym Andriushchenko, Naman Singh, Nicolas Flammarion, and Matthias Hein. Sparse-rs: versatile framework for query-efficient sparse black-box adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 6437-6445, 2022.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient Recisionnbbsee black-box adversarial attacks on face recognition. proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 77 1714-7722, 2019.
10

---

Published as a conference paper at ICLR 2025
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010. / /929, 2020.
Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019. URL https: //tpttgttttttt//tt///te/ com Maw.yaaabarobusteeeee...
Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang. Mingyang Li, Zhifeng Li, and Yujiu Yang. Sparse adversarial attack via perturbation factorization. In Proceedings of European Conference on Computer Vision, pp. 35-50. Springer, 2020.
Yan Feng, Bin Chen, Tao Dai, and Shu-Tao Xia. Adversarial attack on deep product quantization network for image retrieval. In Proceedings of the AAAI conference on Artificial Intelligence, volume 34, pp. 10786-10793, 2020.
Marguerite Frank and Philip Wolfe. An algorithm for quadratic programming. Naval Research Logisties Quarterly, 3, 1956.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Alexey Ignatiev, Nina Narodytska, and Joao Marques- Silva. On relating explanations and adversarial examples. Advances in neural information processing systems, 32, 2019.
Andrew Ilass Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
Tooba Imtiaz, Morgan Kohler, Jared Miller, Zifeng Wang. Mario Sznaier, Octavia Camps, and Jennifer Dy. Saif: Sparse adversarial and interpretable attack framework. arXiv preprint ar ar2iv:221..07495. 2022.
Ehsan Kazemi, Thomas Kerdreux, and Liqiang Wang. Minimally distorted structured adversarial attacks. International Journal of Computer Vision, 131(1):160- 176, 2023.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. University of Toronto, 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. brasient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):228--2324 1998.
Huan Li and Zhouchen Lin. Accelerated proximal gradient methods for nonconvex programming. In Advances in neural information processing systems, pp. 379-387, 2015.
Yiming Li, Baoyuan Wu, Yan Feng, Yanbo Fan, Yong Jiang, Zhifeng Li, and Shutao Xia. Toward adversarial robustness via semi-supervised robust training. arXiv preprint 2iti:20003069774 2020.
Yuezun Li, Xin Yang, Baoyuan Wu, and Siwei Lyu. Hiding faces in plain sight: Disrupting ai face
synthesis with adversarial perturbations. arXiv preprint arXiv:1906. 09288, 2019.
Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pp. 1028-1035. 2019.
Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen Maybank. and Dacheng Tao. Spatiotemporal attacks for embodied agents. In Computer EittonEECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XVII 16, pp. 122-138. Springer, 2020a.
Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. Bias-based universal adversarial patch attack for automatic cutck-out. In Computer EssionEECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIII 16, pp. 395 410. Springer, 2020b.
11

---

Published as a conference paper at ICLR 2025
Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao, Zheng Zhang, Li Dong, et al. Swin transformer v2: Scaling up capacity and resolution. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 12009-12019 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations (ICLR), 2018.
Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Sparsefool: a few pixels make a big difference. In Proceedings of the IEEE/CVF conference on computer vision and paltern recognition, pp. 9087-9096, 2019.
Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv: 2016.
Yurii Nesterov. A method for solving the convex programming problem with convergence rate (2) Proceedings of the USSR Academy of Sciences, 269, 1983.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint 16Xiv:1605.0720 2016a.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) P), pp. 372-387. IEEE, 2016b.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2015.
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generaliza- tion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 6976-6987, 2019.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828-88) 841, 2019.
Hao Wang, Xiangyu Yang, and Xin Deng- A hybrid first-order method for nonconvex ba-ball constrained optimization. arXiv preprint arXiv:2 104.04400, 2021.
Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yo Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. Structured adversarial attack: Towards general implementation and better interpretabiliity. In International Conference on Learning Representations, 2019a.
Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen, and Wei Liu. Exact adversarial attack to image captioning via structured output learning with latent variables. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4135 4414, 2019b.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint 17 2016.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. International conference on machine learning, pp. 11278-11222 1187.. PMLR, 2020.
Bolei Zhou, Aditya Khosla, Agata Lapedriza, Aude Oliva, and Antonio Torralba. Learning deep features for discriminative localization. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2921-2929. 2016.
Hang Zhou, Dongdong Chen, Jing Liao, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Weiming Zhang, Gang Hua, and Nenghai Yu. Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10356-10365, 2020.
12

---

Published as a conference paper at ICLR 2025
Mingkang Zhu, Tianlong Chen, and Zhangyang Wang. Sparse and imperceptible adversarial attack via a homotopy algorithm. In International Conference on Machine Learning, pp. PMLR, 2021.
APPENDIX
A UNTARGETED ADVERSARIAL ATTACK FORMULATION
We easily modify Eq. (1) generate untargeted adversarial attacks by maximizing the loss C with respect to the true label
max M MXXXG
L(x + ww,1 - >D(w),
(18)
where À > 0 a regularization parameter.
B GAUSSIAN BLUR KERNEL
Given m E {0. 10.1) and the square Gaussian blur kernel K E R=xn the convolution matrix m * * E [0, 10 is defined via
(m K
Σ
Σ K K4t4+114241 Mitkjth
where â = 1 [.] is the floor function, and n is an odd number.
In other words, Gaussian Blur kernel a weighted mean the surrounding pixels that gives more weight to the pixel near the current pixel.
Setting M = m * and computing the matrix M E TR MxN as in Eq. (9) via
M ij +
if M, + 0,
Mij
(19)
4
else,
for 0 < I 1, means we increase the tradeoff parameters Eq. (10) for pixels with a distance greater than [ from any perturbed pixels.
C EQUIVALENCE OF PROJECTED NAG IN ALGORITHM TO NAG OF UNCONSTRAINED PROBLEMS
Here show that the projected NAG in Algorithm 2 has the same properties NAG solving an unconstrained problem (Eq. (25)), and thus converges as such.
Proof. Consider MNC, where our image æ E [miin- Imax]" 1d is vectorized. Let denote the set (k) that encompasses indices corresponding entries with > A.y. X after k iterations. Also, let m = μ d. With these considerations, we can formulate the optimization problem in Eq. (11), which arises following iteration k. as
min C(x + w. t) + 1||20|12
weRd
(20)
Au
where A E {0, 1m has rows
O...., 0.1, 0 O,... II
(21)
1 times
d-1 limes
13

---

Published as a conference paper at ICLR 2025
We can eliminate the equality constraints using the nullspace method. Let H Rd be orthogonal matrix and m an upper triangular matrix, obtained by QR-decomposition of i.e.
HA = R
(22)
Further let = 2)T, where YT Ikm contains the first m rows of H and Z E [R Because orthogonal matrix H possesses full rank, both Y and Z also exhibit full rank. Hence can uniquely write any w E Rd as
wyy w
w = wu, + Zw, H
(23)
with wy E m w2 Rddm In partieular, for any wo ker we have
0 = Aw = AH uyy
(R (RT,0) 0)
my
= R Wy.
(24)
W2=
w
Given Eqs. (21) and (22), we can establish that both A and R possess rank m. Consequently, we can represent any w E ker as Zw,, where w, Rd-m. Denoting the w, simply by z, we can formulate an unconstrained problem equivalent to Eq. (20)
min =ER"-m
L(x Zz,t) + P Z
(25)
Setting f(w) L(x + w.t) + 2 and F(z) fZZz) get from the update step of NAG
#k+11
7zk+1
Z - an)) -2( -VF(((())) + am
- -oV
(1 -a+) (w)(k) oZ2 V v(( ak
(w oZ2 T (21))
(26)
-oPv(VS(Ent (V]((((()))) (1 - -ax) (kn(k) a
+ ak un (K-1) 0 Pv (V
= Pv (11 ax) (k) oV (Vo + as (k-1)) - (V
where the last equality holds since (k) (k- V. Thus, the projected NAG in Algorithm 2 shares the properties of NAG solving the unconstrained problem in Eq. (25), ensuring its convergence. C
D EXPLANATION OF ASM, IS, AND CAM EVALUATION METRICS
We provide further details on the ASM, IS, and CAM metrics as outlined Sec. 3.2 of the paper.
Consider vectorized image [Umin: maxx] d with true label I and target label L. Let ((x) represent the logits of classifier. The udversarial saliency map (ASM) (Papernot et al., 2016b; Xu al., 2019a) is defined as follows
Lst) [2((x):
(7(z),
Ox, 1s((),
Ox, OZ(z),
(27)
==11 iE fl,...... d)
87(x);
S
0 or dx. s =0
dx,
The metric ASM(2, (,t) E IRS provides measure of importance for each pixel. It is worth noting that higher ASM value signifies greater pixel significance. We compute binary mask B(x, E (0, 1)dd by
[1, [ASM(xx ()); > >;
B(x, 1, f]]]
(28)
o, otherwise,
where v some percentile the entries of (a, Given an adversarial perturbation w E Rd can now compute the interpretability score (IS) as
B (r. 1, @ w w/l2
(Sw x. 1,t)
(29)
1
14

---

Published as a conference paper at ICLR 2025
Note that when IS(,, ([w,,,,,7 I.t, approaches the perturbation primarily targets pixels crucial for the class prediction of the model. Conversely, IS scores nearing zero do not lend themselves to meaningful interpretation based on ASM scores.
Let be a convolutional neural network classifier and fx(i.j] ] be the activation of the unit at the coordinates (i.j) in the last convolutional layer of C evaluated at Then, using global average pooling after the last convolutional layer, the input to the softmax corresponding to label is
Σ W
feli, 7
Σ w f. RJJ
where w/. are the weights corresponding the label for unit Since w indicate the importance of Eng fali.j] for class I, the class activation map (CAM) (Zhou et al., 2016) is defined by
[CMM] Σ mffalii..
and directly indicates the importance of activation at (i,j) for the classification of as class (. To make the comparison of CAM; and easier, the resulting class activation map is upscaled to the size of æ using bicubic interpolation.
D.I HYPERPARAMETERS OF THE GSE ALGORITIM
To find q, o, na, and k, we run a grid search where ACP + ANC the objective and ASR 1.0 constraint. Specifically, for CIFAR- 10, we set = 0.25, a = 0.005, μز = 1, and 30, while for ImageNet, we use 0.9, o = 0.05, μ = 0.1, and i = 50. Due to the significant efficiency of our attack compared to other group-wise sparse attacks, we easily run grid search find appropriate hyperparameters when working with different datasets. The grid search code used to find the hyperparameters for CIFAR-I0 and ImageNet attached in https://github.com/ www.:///wwwwwwwwwwwowoo....o
E ADDITIONAL EXPERIMENTS
E. EMPIRICAL PERFORMANCE
In this section, present untargeted and targeted attack results the CIFAR-10 dataset (Krizhevsky ct al., 2009) using a WideResNet classifier (Zagoruyko Komodakis, 2016) and ImageNet dataset (Deng et al., 2009) using VGG19 classifier (Simonyan & Zisserman, 2015). Additionally, include results on the NIPS2017 dataset (available at ht wwggle com/ compet. titititte ions/ nips- 1117-effese againe nst a of the same dimensionality (299 x 299 x 3) as the ImageNet dataset, on which we test the attacks against VGG19 (Simonyan & Zisserman, 2015) and ResNet50 (He al., 2016) classifier. The results in Tab. 6 and Tab. reinforce the findings of Sec. 3.4.1, highlighting GSE's ability to produce SOTA group-wiss wise sparse adversarial attacks.
comprising 1K images
Table 6: Untargeted attacks on a WideResNet classifier for CIFAR-10, VGG19 classifier for ImageNet, and VGG19 and ResNet50 classifiers for NIPS2017. Tested on 10k images from the CIFAR-10 dataset, 10k images from the ImageNet dataset, and Ik images from the NIPS2017 dataset.
Attack
ASR
ACP
ANC
Fg
dg.0
CIEAR-10 WilcKesNet
GSE (Quss)
100%
73.1
1.53
0.71
329
PWomal
57.6%
303
1.87
2.28
438
SAPF
100%
95.1
3.9
0.51
2912
TmaneeNe
GSE (Oun))
SHAtBack
100%
100%
$13.9
3035
5.43
8.57
1-28
1.63
5130
I8SS
NIPS2017 VUG19
GSE (Cuuss)
100%
973
6.65
1.49
2254
FWmmel
90.15
6099
2.35
2.71
770)
NIPS2017
Reshet50
StAllack
PWimel
(Cluns)
100%
48.25
8011
14571
5.01
17
2.79
1:27
13177
17086
15

---

Published as a conference paper at ICLR 2025
Table 7: Targeted attacks performed WideResNet classifier for CIFAR-10, 10, VGG19 classifier for ImageNet, and VGG19 and ResNet50 classifiers for NIPS2017. Tested on 1k images from each dataset, target labels for CIFAR-I0 and 10 target labels for ImageNet and NIPS2017.
Best case
Average CARe
Worst case
Attack
ANC
ACP
F22
42.0
42.0
CIAAR- WideRes Not
GSE (Quss)
StrABack
100%
100%
49.8
61:7
2.32
1.84
01.22
0150
244
141
84.8%
196
112
0.21
1.45
0.81
1.63
431
238
93.1%
85.255
234
2.71
11.3
3.01
1.25
STV
388
SAPF
100
85.3
1.97
01.45
223
94.8%
91.9
3.61
0.91
278
75.3%
101
6.25
1.36
371
ImageeNet VOG1S
StrAma
100 %
4385
6.11
2,88
7011
100%
11568
16.3
3.59
17564
100%
21852
29.8
5.16
304ST
PWinucl
56
4612
1.51
2,50
6973
18.3%
9134
2.53
3.65
12050
0.0%
N/A
NA
NIA
NIA
NIPS2017
GSE (Qurs)
100%
2155
5.96
2.78
4617
100%
6339
15.4
3.44
11384
100%
15541
25.2
4.19
21581
Amammack
100%
4197
2/45
5647
100%
11326
18.5
3.66
17332
100%
21018
34.1
5.38
50103
N/A
GSE (Qurs)
100%
3585
6.31
2.51
569N
100%
9127
16.2
2.87
15704
100%
20247
27.5
3.13
26574
ResN2550
FWouel
30.2%
9612
2.62
12315
11.8%
11512
8.02
3.69
19493
0.0%
N/A
NA
1S
GSE (Ours)
StrAttack
0.6
FWnucl
PGD,
Sparse-RS
0.4
50
60
70
80
90
2/
Figure 5: IS vs. percentile v for targeted versions of GSE vs. four other attacks. Evaluated on an ImageNet VGG19 classifier. Tested Ik images and 10 target labels for ImageNet.
E.2 EXPLAINARILITY
Fig. 5 reinforces the findings of Sec. 3.4.2, demonstrating GSE's consistently higher IS scores compared to both SOTA group-wise sparse and SOTA sparse attacks, while using a VGG19 classifier (Simonyan & Zisserman, 2015) on ImageNet. This underscores that GSE-generated perturbations more focused on the most salient regions of the image.
E.3 TRANSFERABILITY
An intriguing application is evaluating the transferability performance (Papernot et al., 2016a) of various group-wise sparse attacks in the black-box setting, assessing whether attack maintains high ASR when targeting a different model. From Tab. 8, our GSE attack demonstrates transferability on par with SOTA group-wise sparse methods, outperforming StrAttack the lower-triangular case and FWnuel in the diagonal case, while achieving strong balance between in-model and out-model performance. The additional model, Swin- -2-BB, is sourced from (Liu al., 2022).
Table 8: Transferability of targeted attacks on ImageNet.
Attack
Attacked Model
ResNett0
Swin-V2.
VGG19
ResNe:50
100%
5.15%
15.4%
GSE
Swin-V2-D
8.61%
90.85
18.3%
VGG19
5,01%
4,25%
100%
RecNe:50
100%
5.27%
18.1%
SmAAtcck
100%
4.12%
FWoudl
Swin-V2-R
10.3%
$4.9%
19.3%
VGG19
9.6 9.62%
6.059%
97.5%
16

---

Published as a conference paper at ICLR 2025
Table 9: Ablation study on ie for GSE. Tested on with 1,000 samples from the ImageNet dataset and ResNet50 classifier. All values of k lead attack success rate of 100%.
1427
1519
1462
1433
d2.0
3529
3559
3442
3387
3356
3265
3048
2814
2773
2656
1.44
1.42
1.41
1.39
1.43
1.41
1.42
1.40
1.43
1.44
E.4 ABLATION STUDY ON k
We conduct an ablation study on & evaluate the impact of Step GSE attack performance, as shown in Tab. 9. We see that à is inversely correlated with the number of clusters (ANC) and group sparsity (d2,o), anticipated. No significant correlations with other metries were observed.
17


Reviews:
[{"review_id": "pfIMv2kF0c", "reviewer": "Reviewer_Z1qQ", "summary": "In this paper, the authors propose a two-stage approach for generating group-wise sparse and explainable adversarial examples. To enhance the attack performance, they introduce 1/2-quasinorm regularization and sparse hyperparameter tuning methods to select key group-wise sparse pixels. After that, the coordinate and magnitude of these selected pixels are further refined using Nesterov’s Accelerated Gradient Descent (NAG) to produce the sparse adversarial example. Experiments on multiple CNN and ViT networks using the CIFAR and ImageNet benchmark datasets demonstrate the effectiveness and efficiency of the proposed group-wise sparse and explainable attack compared to baseline sparse attack methods.", "questions": "1. How does the proposed coefficient tuning strategy perform in terms of attack effectiveness when combined with different sparsity-inducing regularizations, such as L0-norm, L1-norm, and 1/2-quasinorm?\n\n2. Could the authors provide additional details on how Eq. 4 is derived from Eq. 3? Additionally, could the authors explain why the Lp-norm (p=1/2) is considered a separable function?\n\n3. Compared to other sparse attacks (e.g., StrAttack, Homotopy-Attack) that provide a clear mathematical formulation of group sparsity, could the authors offer additional details on how sparse pixels in the adversarial example are grouped during the two-phase perturbation training process?\n\n4. How does the performance of other sparse attacks, using their default iteration settings, compare to that of the proposed GSE attack in this paper? \n\n5. What is the transferability performance of different sparse attacks in the black-box setting? Does the proposed GSE attack still achieve a higher ASR?", "limitations": "", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Compared to existing methods that use L0 or L1 regularization, this paper presents a sparse adversarial attack based on 1/2-quasinorm regularization. Building on this, an effective heuristic approach for tuning the regularization hyperparameter is introduced to select the most important pixels.\n\n2. For the selected pixels, a projected Nesterov’s accelerated gradient descent algorithm is introduced to solve the L2-norm constrained problem, thereby ensuring low-magnitude sparse adversarial examples.\n\n3. Experimental results conducted on multiple white-box models in both targeted and untargeted attack settings demonstrate that the proposed GSE method achieves better attack effectiveness and efficiency compared to other sparse attack methods.", "weaknesses": "1. The motivation behind the proposed 1/2-quasinorm regularization is not clearly explained. Compared to existing L0- or L1-norm based sparse attacks, what advantages does 1/2-quasinorm regularization offer for crafting sparse adversarial examples? Additionally, why not consider combining L0- or L1-norm based regularization with the proposed coefficient tuning strategy?\n\n2. The derivation between Eq. 3 and Eq. 4 appears problematic, as it should rely on separable proximal functions. However, unlike the L1-norm, the Lp-norm is not a separable function, particularly when p=1/2. \n\n3. The authors claim to introduce a group-wise sparse attack. However, Sections 2.1-2.2 lack a clear mathematical description of how the selected sparse pixels are grouped, resulting in ambiguity regarding the concept of group-wise sparse attack.\n\n4. The evaluation of attack performance lacks comprehensiveness. For example, while sparse attacks are applied to white-box models, their transferability in a black-box attack setting is not considered, which is arguably a more practical scenario. Additionally, all attacks are performed using 200 iterations, which is inconsistent with the settings used in previous sparse attack methods.\n\n5. The evaluation metrics are not clearly explained. First, since different sparse attack methods may generate distinct sets of successful adversarial examples when ASR is below 100%, the ACP metric defined in Eq. 15 becomes difficult to compare across methods. Second, while Eq. 16 introduces the d_{2,0} metric, the definition of “overlapped patches” is not provided, adding to the ambiguity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LcsbJEn6Cs", "reviewer": "Reviewer_8hSx", "summary": "This paper presents a novel sparse attack method named GSE (Group-wise Sparse and Explainable), designed to generate structured adversarial attacks against deep neural networks (DNNs).\n\nThe GSE algorithm emphasizes group-wise sparse attacks, meaning the perturbations are strategically grouped within semantically meaningful regions of the image, rather than being scattered randomly.\n\n**Limitations in Previous Work:** Prior methods primarily focus on minimizing the number of altered pixels without imposing constraints on their location or intensity. Consequently, these modified pixels often show considerable variations in color or intensity relative to their surroundings, making the alterations more noticeable. This highlights the need for structured, group-wise sparse perturbations that better target key areas of the image. However, I feel this motivation is somewhat broad, as it applies to all group-based adversarial attacks.\n\n**Two-Phase Approach to Solving the Optimization Problem:**\n- **Step 1:** This phase identifies the pixels most vulnerable to perturbation. It employs a non-convex regularization approach using the 1/2-quasinorm, allowing for individual tuning of tradeoff parameters (\\(\\lambda\\)) for each pixel. The algorithm iteratively reduces these parameters for pixels close to those already perturbed, making them more susceptible to further modification. I believe this strategy prevents further updates on perturbed pixels, effectively addressing issues with high-intensity or conspicuous changes. However, the authors assert that this step primarily reduces the number of pixels that need alteration—a claim that seems misaligned with the method’s description, in my view.\n   - This step can be achieved through a heuristic adjustment of \\(\\lambda\\), with individualized settings for each pixel.\n  \n- **Step 2:** This phase constructs a low-magnitude adversarial attack by optimizing an objective function over the pixels chosen in Step 1. The objective includes the classification loss and a penalty term to control the magnitude of perturbation. The algorithm employs projected Nesterov's Accelerated Gradient (NAG) descent to efficiently solve this refined problem.\n\nThe authors claim that the proposed method achieves both effective attack performance and, importantly, enhanced explainability.", "questions": "1. Why is it necessary for adversarial attacks to be explainable? More specifically, why should the attacks follow a particular structure? Insights from the shortcut-learning paper suggest that DNNs may learn features differently than humans. Is the structure of group-based attacks intended to align more closely with human interpretation?\n2. What are the benefits of explainable attacks compared to non- or less-explainable ones?\n3. Could the authors explain in greater detail why the proposed method outperforms previous attacks in terms of speed (Table 1)? Were consistent parameter settings used across methods, such as the number of iterations \\(\\hat{k}\\) and \\(K\\)? In my opinion, the most time-intensive steps are the gradient calculations in lines 3 and 8 of Algorithm 2, which would likely be similar in duration to other methods if using the same number of iterations.\n4. The authors compare their method with four baselines (Homotopy, SAPF, StrAttack, FWnucl) but only provide results for Homotopy and SAPF in Table 1. Could the authors explain this choice?\n5. In lines 149–152, the authors mention, “this approach does not guarantee that the perturbations will affect the most critical pixels in the image.” How do they define or identify these “most critical pixels”? Based on which metric?\n6. I am interested in the interpretability score of Grad-CAM or CAM techniques.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "•\tThe proposed method appears to be faster than previous approaches.\n\n•\tThe number of perturbed pixels is also fewer compared to prior work, which, as the authors claim, might contribute to better explainability.", "weaknesses": "- **Writing Quality:** Several areas need improvement.\n  - **Flow of the Paper:** Despite multiple readings, the main limitations of previous work that this paper aims to address remain unclear. Specifically, the introduction (lines 45-53) outlines the motivation for group-wise sparse attacks in general, but it doesn't clearly articulate the specific issue that this paper seeks to tackle.\n  - **Detail in Section 2.2:** This section is overly detailed but lacks sufficient explanation to help readers understand how (1) it identifies a smaller set of suitable pixels and (2) achieves lower perturbation magnitudes. Additionally, the AdjustLambda algorithm would benefit from a standalone paragraph with clear notation to help readers follow the paper more easily.\n  - **Confusing Notations:** Some notations are inconsistent and confusing. For instance, in Section 3.2, `n` represents both the number of images and the size of a patch (n by n pixels), while `m` refers to both the mask and the first `m` adversarial examples (line 256).\n\n- **Evaluation Metrics:** The evaluation metrics are somewhat questionable. Specifically, in Section 3.2, the authors propose using Attack Success Rate (ASR) = m/n, where `n` is the total number of images. However, it would be more appropriate for `n` to represent the number of correctly classified images by a classifier. The use of the IS score is also questionable. More specifically, the IS score show the alignment between the Adversarial Saliency MAP (ASM) and the perturbation w, generated by attacks. However, the ASM is calculated based on the gradient of the prediction loss w.r.t. true label. Therefore, based on insight from the Short-cut learning paper, if the model based on the imperceptible (and non-sensible feature) to make the prediction, the ASM map is align with this feature instead of the human perspective or human explainability. \n- **Interpretability Technique:** Grad-CAM is generally a more advanced method than CAM, raising questions about its suitability for comparison.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GlAbFdZyXt", "reviewer": "Reviewer_PeSc", "summary": "This paper introduces a novel approach for generating sparse adversarial perturbations targeting deep neural networks (DNNs). GSE achieves higher group-wise sparsity than state-of-the-art (SOTA) methods, allowing for fewer, yet targeted pixel modifications. This results in minimal visible changes while effectively fooling the DNNs.", "questions": "See weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-organized and written. The problem setup, objectives, and contributions are articulated in a way that is accessible to readers.\n2. The GSE framework achieves high levels of sparsity and group-wise organization in perturbations, making it a valuable tool for evaluating and improving the robustness of DNNs.", "weaknesses": "1. The GSE method’s effectiveness seems sensitive to specific hyperparameters.\n2. The authors search the hyperparameters only for their method. This may not be fair to other methods. I think the authors should search the hyperparameters for all methods.\n3. An ablation study on $\\hat{k}$ should be given since the first phase will highly affect the performance.\n4. The experiments only have two datasets. The performance on more datasets is required.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oNsJfv8hzL", "reviewer": "Reviewer_BmUW", "summary": "The paper introduces GSE (Group-wise Sparse and Explainable Adversarial Attacks), a novel method for generating sparse adversarial attacks on Deep Neural Networks (DNNs). These attacks aim to perturb semantically meaningful regions of an image, making the attacks more explainable. The authors propose a two-phase algorithm to generate such group-wise sparse adversarial examples: The first phase utilizes 1/2-quasinorm regularization to select the most critical pixels for perturbation using a proximal operator. The second phase applies a projected Nesterov’s accelerated gradient descent to fine-tune perturbations in targeted regions, minimizing their magnitude while maintaining effectiveness. The approach is evaluated on CIFAR-10 and ImageNet datasets, demonstrating significant improvements in group-wise sparsity and explainability while achieving a high attack success rate and reduced time consumption.", "questions": "1. In Phase Two, why did you choose to use gradient computation instead of applying a proximal operator update for the $\\ell_2$ norm? Would using a proximal operator provide any computational or optimization benefits, especially regarding convergence and perturbation magnitude control?\n\n2. The paper mentions that a grid search was used to select hyperparameters. How sensitive are the results to these hyperparameters? Could slight variations in the hyperparameters significantly impact the effectiveness, sparsity, or explainability of the adversarial attacks?\n\n3. I noticed that in Equation 9 and 10, the update for the blurred perturbation mask causes the tradeoff parameters to decrease more slowly than they increase. Could you explain the rationale behind this design choice? How does the asymmetry in the speed of adjustment affect the performance and explainability of the generated adversarial examples?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The methodology is well-formulated, and the proposed two-phase approach is sound. Rigorous experiments demonstrate the efficacy of the method, comparing it with SOTA adversarial attacks.\n\n2. The paper is well-structured, with clear explanations of the algorithms.", "weaknesses": "1. The paper relies on grid search for selecting hyperparameters, but there is no detailed analysis of how sensitive the method’s performance is to these choices.\n\n2. The rationale for the specific update mechanism in Equation 9, where tradeoff parameters decrease slower than they increase, is not fully explained. It would be helpful to understand how this impacts the selection of critical regions for perturbation and whether a more symmetric adjustment could improve results.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)