Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian
Authors: Thomas Paniagua
Chinmay Savadikar
Tianfu Wu
Venue: ICML 2025 poster (2025)
Keywords: ordered top-K adversarial attack
deep neural networks
sequential quadratic programing
Primary area: deep_learning->robustness
TL;DR: Learning ordered top-K targeted attacks directly in the image space via sequential quadratic programming

Abstract: White-box targeted adversarial attacks reveal core vulnerabilities in Deep Neural Networks (DNNs), yet two key challenges persist: (i) How many target classes can be attacked simultaneously in a specified order, known as the *ordered top-$K$ attack* problem ($K \geq 1$)? (ii) How to compute the corresponding adversarial perturbations for a given benign image directly in the image space?
We address both by showing that *ordered top-$K$ perturbations can be learned via iteratively optimizing linear combinations of the $\underline{ri}ght\text{ } \underline{sing}ular$  vectors of the adversarial Jacobian*  (i.e., the logit-to-image Jacobian constrained by target ranking). These vectors span an orthogonal, informative subspace in the image domain.
We introduce **RisingAttacK**, a novel Sequential Quadratic Programming (SQP)-based method that exploits this structure. We propose a holistic figure-of-merits (FoM) metric combining attack success rates (ASRs) and $\ell_p$-norms ($p=1,2,\infty$).
Extensive experiments on ImageNet-1k across six ordered top-$K$ levels ($K=1, 5, 10, 15, 20, 25, 30$) and four models (ResNet-50, DenseNet-121, ViT-B, DEiT-B) show RisingAttacK consistently surpasses the state-of-the-art QuadAttacK.

Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian
Thomas Paniagua
Chinmay Savadikar' Tianfu Wu
Code: https:/ /ttp///gttttttttt http:////////dddeeettop.. attcck
Abstract
wards Artificial General Intelligence (AGI), Despite of the remarkable achievement, adversarial vulnerability (Szegedy et al., 2013; Goodfellow et al., 2014) remains the Achilles heel of all DNNs, particularly in computer vision, as re- vealed by white-box adversarial attacks, especially targeted white-box attacks (Carlini & Wagner, 2017) that can fool trained DNNs towards arbitrarily specified targets. With the access to network architectures and pretrained weights, white- box attacks can expose their deep vulnerabilities and test their robustness. In practice, white-box attacks are also used as surrogate models in learning transferrable black- box (Inkawhich al., 2019; Li al., 2020a; Naseer et al., 2021; Zhao et al., 2023; Fang al., 2024) and no-box (Li et al., 2020b) attacks. So, seeking more powerful white- box attacks will provide foundation both for learning po- tentially stronger black-box and no-box attacks. In this paper, we focus on learning white-box targeted attacks in ImageNet- 1k (Russakovsky et al., 2015) classification tasks.
White-box targeted adversarial attacks reveal core vulnerabilities in Deep Neural Networks (DNNs), yet two key challenges persist: (i) How many target classes can be attacked simultancously in a specified order, known as the ordered top-K attack problem (K 2 1)? (ii) How com- pute the corresponding adversarial perturbations for given benign image directly in the image space? We address both by showing that ordered top-K perturbations can be learned via itera- tively optimizing linear combinations of the right singular vectors of the adversarial Jacobian (i.e.. the logit-to-image Jacobian constrained by target ranking). These vectors span orthogonal, infor- mative subspace in the image domain. We intro- duce RisingA ttacK, a novel Sequential Quadratic Programming (SQP)-based method that exploits this structure. We propose a holistic figure-of- merits (FoM) metric combining attack success rates (ASRs) and f--norms (p= 1, 2, oo). Exten- sive experiments
We consider the generalized setting of targeted attacks, or- dered top-K attacks (Zhang & Wu, 2020; Paniagua et al., 2023), that relax the traditional top-1 targets (e.g., to fool a DNN to classify a dog image as cat) to K targets (K 2 1) in any given orders (e.g.. to fool a DNN to classify a dog image with [car, tree, table] as the ordered top-3 predic- tion, see the middle in Fig. 1). Ordered top-K targeted attacks expose deeper vulnerabilities of DNNs, since they show the manipulability of the decision boundary of DNNs at the logits subspace levels, especially when K is large (e.g., K > 20). These attacks are particularly impactful in applications where the order of predictions significantly influences outcomes, such as recommendation systems or multi-class decision-making, and adversaries can exploit decision hierarchies to disrupt critical processes. Partic- ularly, safety-critical systems (e.g.. face unlock, medical triage, content moderation) reason over entire ranked lists. An attacker dictating all top predictions (similar in spirit to [cat, car, fish] vs only "cat") obtains finer control and evades simple "Top-1 changed" detectors.
ImageNet- 1k across six or- dered top-K levels (K = 1, 5, 10, 15, 20, 25, 30) and four models (ResNet-50, DenseNet-121 121, VIT- B. DEiT-B) show RisingAttacK consistently sur- passes the state-of-the-art QtadktttcK.
1. Introduction
Deep Neural Networks (DNNs) have witnessed tremendous progress across numerous applications, enabling the recent development of large foundation models (such as Deep- Mind's 's AlphaZero and AlphaFold and OpenAl's ChatGPT) that are widely recognized to pave a promising way to-
'Department of Electrical and Computer Engineering, North Carolina State University. Raleigh, USA. Correspon- dence to: Thomas Paniagua <tapaniag @ @ncsu.eduu...... Tianfu Wu stwu19@ edsu.edu>.
In the meanwhile, security evaluations now recommend K >>> 1. For example, in the new differential-privant eval- uation guideline, NIST SP 800-226 (March 2025) (Near
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

RisingAttack
Optimal Perturaatin 8' = c Lc., linear com combinations of bases (coluznn V,) in the image space
Jacobian Subspace QP
1st-order Taylor Expansion Linearizing DNN around grerit to enable linear encodings of ordered top=K constraints
Reduced SVD:
Our Proposed RisingAttes
Krnking:
Jacobian V2 Optiniize e, s.t. L, c,
randomiy sampled top-3 targets in the ordor of fcar, tablet
Lineer Head
DNN Backbone f(:;0)
Features: pertur
(W 30
logits: E(z
d
Clamp (a besign
Ordered Top- Attack
eg.. cat image
Success vs Failure
QuadAttacK Feature Space QP Optimize features around garterh via QP s.t. ordered top-K K constraints
Surrogate Loss F Functions t(a peturh to encode ordered K constraints e.g,, CW and AdvDistill (CVPRW'20)
D-
The Prior
(1++3)
((++3)
using logite W-
Figure 1. Workflow comparisons between our proposed image space based RisingAttacK (top) and the prior art (bottom), CW and AdvDistill (Zhang & Wu, 2020) and QuadAttacK (Paniagua al., 2023) for leaminng ordered top-K targeted adversarial attacks (Zhang Wu, 2020) for a benign image x heniggn E [0, 1] (e.g.. D = 33x x 224 x 224). See text for details.
al., 2025) devotes an entire discussion "Practical peterenntiall-privaat Top-K selection" and cites (Durfee & Rogers, 2019) its canonical example which repeatedly frames robustness/utility checks around whether the entire ordered set of the sighest-scoring items is preserved under noise-no not just the single best underssnrsn regulators' need for Top-K mis-ranking tests. Ordered top-K attacks thus supply the stress-test regulators and practitioners request but that Top-l-only methods cannot deliver.
propagating the optimized features through the backbone to compute adversarial perturbations.
QuadAttacK has shown significant improvement in compar- ison with methods based on surrogate loss functions. While QuadAttacK is effeetive, its effectiveness diminishes signifi- cantly when > 20 and the computing budget is restricted (e.g., 30 steps). It relies backpropagation map the optimized feature space perturbation back to the original input image space. This introduces an indirect connection between the optimization problem and the resulting image space perturbation, leading to limitations as-follows:
Ordered top-K K attacks can be straightforwardly formulated as an optimization problem with highly non-linear con- straints, which is intractable in the vanilla form (see Eqn. 4). Thus, learning ordered top-K attacks poses unique chal- lenge as they require the perturbations precisely influence the model's ranking mechanism across multiple outputs (K' > 1), not just single decision (K = 1). Addressing ordered top-K attacks offers valuable insight into how mod- els distribute their confidence across multiple classes and the vulnerabilities associated with this ranking structure. To address this challenge, there are two main approaches in the prior art (see the bottom of Fig. 1):
Feature vs. Image Space Misalignment: Minimizing the perturbation in the feature space does not always cor- respond minimizing in the image space due to the nonlinear mapping between the two spaces.
Suboptimal Visual Perturbations The resulting adver- sarial examples may not fully align with the visual charac- teristics of the image, as perturbations that minimize the distance in feature space may not correspond to minimal or visually coherent changes in the image space, due to the nonlinear relationship between the two spaces.
Designing surrogate loss functions, such as the CWK (extended from the CW method (Carlini & Wagner, 2017)) and the Adversarial Distillation method proposed in (Zhang & Wu, 2020), that transform the constrained optimization problem to an unconstrained one.
To the best of our knowledge, existing approaches have been proposed for learning ordered top- K attacks (K 2 1) directly in the image space due to the complexities of high- dimensional, non non-linear optimization. Potentially due to this, it remains unresolved to seek an explicit formula for "seeing" what adversarial perturbations are formed, if pos- sible. In this paper, we propose Sequential Quadratic Programming (SQP) formulation to address the non- linear optimization challenge of learning ordered top-K
Reformulating the non-linear constraints to linear ones, such as the recently proposed QuadAttacK (Pa- niagua al., 2023). by first solving the optimization prob- lem in the feature space of the DNN backbone (i.c., the input space to the linear head classifier), and then back-
2

---

RisingA
kppk
Aoplee 15
Irpke75
topiio30 30
Tock-6
1036-
100K-11 16
100K-20
topK-25
TOOKC 30
VIT
Int-o C040
11-30192
1r0-00100
194-0.0043
I-E-O 0002
BEE-D 0767
DEI-R
11:00 100
ExP-D 740
Figure Examples adversarial examples and associated perturbations learned for a benign image (ILSVRC2012 val 00002633 with the ground-truth label, redshank) by our RisingAttacK using list of randomly sampled 30 targets in the order of: mask, analog-cla clockk, slide-rule, Siberian-husky, harmonica, african-chameleon. wing, pillow, garter-snake, Great-Pyrerees, puffer, banana,
dowitcher, hyena,
whippet, brown-bear, snowplow, tarantula, space-heater, sports-car, jean, sandbar, perfume, papillen, triceratops, barrow, peacock, digital-watch, carton. The adversarial pertur- bations are normalized to [0, 1] for the sake of visualization. Some of them are treated as being "visually imperceptible" based on the commonly used threshold 8/255 0.0314 for fxx ('linf") norms. For the benign image, the t0p-30 predictions by the four models respectively are:
ResNett0l redsbank, mddd tamstone, red-backed sandpiper, dowischer, oystereatcher, grey whole, rad-bressted merganser, emnee sea lion, chainlink fonce, lakeside, wreek, quail, partridge, serewdrivver
plastic pelican, purachute, killer whale, suester-crested cockatio, African crocudile, white stock, pole, backet, caldron, humminghinl, samübar, penguin, niil syrings.
DenseNet121: relshank, ruddy tumstone, red- rol-bckked sundpiper, aystereatcherr. breakwater, dowitcher, seu lio, academic gown, abua, moriarbuurd, red col-bbeusted merganser, lifebunt, clouk, expresso,
lipstick, theater curtain, wood rabbii, umbrella, refrigerator, rufled grouse, king penguin, puntrige, sanbar, dismonlback, the-ofthe-woods wine bottle, muilbus, stone wall, volcumo, relhune.
VIT-B: redetank, rodkbacked sandpiger, ruddy tarnsioee, downccher, oysterencche, water ouzel, Madagascor cat, chain sam, apiary, zod- breasted marganser, Tibetan mastiff, cicada, seat boit, Americas eguet, feuther
wall clock, mask, leopard, schipperke. potter's wheel, lycaenid, mad corte- retrever, dumbbell, television,
junco. constrictor, volcano.
DETTER ruishank, ruily timstonne rod-hucked sindpiper, dowitderr, aysterestcher, rol-brrastal morganser, warthng, woms fence, Indian elephunt African crocadile, mire. budges, snowplow, Americun hear, king pengain, wheel, perhon, owel, guillnine wild hear, comipade, diamondrackk opiary, homel vipes, sundial, guenon, bustard, skank.
3

---

RisingAttacK
attacks directly in the image space, as illustrated in Fig. (top), which can address the drawbacks of QuadAttacK (Pa- niagua et al., 2023). Our approach efficiently solves the SQP problem by iteratively computing the singular value decomposition (SVD) of the adversarial Jacobian (i.e., the taanekk-argett-rakkig constrained logit-to-image Jacobian matrix), obtained from linearizing the DNN during opti- mization. This direct optimization in image space provides deeper insights into the learned adversarial perturbations: ordered top-K adversarial perturbations can be learned by iteratively optimizing linear combinations of the right singular vectors (corresponding to non-zero singular val- ues) of the adversarial Jacobian. The proposed method is thus dubbed as Ris hgAtttcc (see examples in Fig. 2). Our proposed RisingAttacK achieves significant better per- formance than the prior state-of-the-ar method, QuadAt- tacK (Paniagua et al., 2023) in experiments.
agua al., 2023) to directly address the ordered top-K' adversarial attack problem in the image space.
Sequential Quadratic Programming (SQP). SQP is a widely used framework for solving nonlinear constrained optimization problems (Nocedal & Wright, 1999). By iter- atively solving QP subproblems that linearize constraints and use a quadratic approximation of the objective, SQP effectively handles problems involving nonlinearities and complex constraint sets (Boggs & Tolle, 2000). This ap- proach is particularly relevant in high-dimensional settings, such as adversarial attacks, where the constraints often in- volve intricate relationships between model outputs. How- ever, applying SQP to large-scale problems, such as those in image space, can be computationally expensive due to the need to repeatedly compute gradients and solve large QPs (Gill et al., 2005). Our method adapts SQP for adversarial optimization by leveraging subspace splitting to reduce the dimensionality of the optimization problem, thereby over- coming scalability challenges while preserving accuracy.
2. Related Work and Our Contributions
Adversarial Attacks. Adversarial attacks aim to expose the vulnerabilities of DNNs by introducing small, often vi- sually imperceptible perturbations to input data that cause the model to produce incorrect or adversary-specified out- puts. Foundational work in adversarial machine learning introduced methods for generating adversarial examples under various norms and constraints, including the Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2014), Projected Gradient Descent (PGD) (Madry et al., 2017), and the Carlini-Wagner
Our Contributions. The main contributions of this paper are as-follows: (i) Novel Theoretical Insights: It introduces explicit derivations connecting adversarial perturbations to singular vectors of the adversarial Jacobian, providing new theoretical clarity. (ii) Methodological Innovation: It is the first method to directly optimize ordered top-K adversar- ial attacks in image space via SQP, significantly improving alignment between optimized solutions and visually coher- ent perturbations. (iii) Empirical Advances: It provides comprehensive evaluation across multiple architectures and attack levels, consistently outperforming the previous state- of-the-art, QuadAttacK using a proposed holistic metric, Figure of Merits (FoM) covering both success rates and perturbation magnitudes.
Wagner (CW) attack (Carlini & Wagner, 2017). These early approaches primarily targeted top-1 classifica- tion outputs, seeking to force the model to misclassify input into specific target class.
Beyond 1 attacks, researchers have investigated adver- sarial perturbations that manipulate the top- K predictions of a model. (Zhang & Wu, 2020) introduced one of the carliest methods for addressing ordered top-K adversarial attacks, focusing on creating an optimal target class distri- bution aided by word embedding vectors, and minimizes KI. divergence to this optimal distribution that satisfies the ordered top-K objective. (Tursynbek et al., 2022) explored the geometry of unordered top-K adversarial attacks, high- lighting the complexities of crafting perturbations that ad- here top-K constraints. (Reza al., 2025) proposed GSBAK a geometric score-based unordered top-K black- box attack method built on (Reza et al., 2023). (Paniagua et al., 2023) advanced this area by formulating the ordered top-K adversarial attack problem as a quadratic program- ming (QP) optimization in the feature space. This approach efficiently enforced the desired ordering of logits but re- quired back propaaropngttion to map feature space solutions to the image space. Our proposed JacAttacK builds upon these foundations by extending the idea in QuadAttacK (Pani-
3. Approach
In this section, we first define the problem of learning or- dered top-K attacks (Zhang & Wu, 2020), and then present details of our proposed RisingAttack.
3.1. Problem Definition
Model Under Attack. Let (z.bonign, .y) E [o. 1]3xHXW x y be pair of a benign RGB image benign with spatial height and width, H and W respectively, and its ground-trut label y with the C'-class label space ) = {1, C). Let D= 3 x H x W be the dimension of the input image space. In ImageNet- 1k (Russakovsky et al., 2015) classification, we have C 1000 and D = 3 x 224 x 224 ~ 1.5e5.
A DNN trained for image classification is a mapping from the image space the logit space:
E( 0): [0, _]_ + RC,,
(1)
where O collects all learned parameters of the DNN. We
4

---

RisingAttacK
will omit O in notations and use E(-) for simplicity.
ality of the image space, D, which make the optimization with constraints linearized still infeasible in practice, we streamline yet retain the solutions of Eqn. 4.
We consider validation or testing images that can be cor- rectly classified by trained DNN such as ResNet-50 (He et al., 2016) in learning attacks, i.e., y = arg max (z.henig)) The DNN is frozen in learning attacks.
Eqn. 4 can be re-expressed as,
minimize || benign p
(5)
=E[u,]]
The Adversarial Region of Ordered Top-K Targeted Attacks for (a.henig,, .y). Let T y \ {y} be a randomly sampled sequence of ordered top-K targets for attacking x henign, K- 171. The adversarial region is defined by,
subject to K {(x) > 0,
Similar in spirit to QuadAttacK (Paniagua et al., 2023) and all other attack methods, our proposed Rising is an iterative optimization algorithm starting from the initial per- turbed image wPettub Clamp(2. + 8)))) (e.g., d(h)
R(x Raahenien .T) { 1 E [0.1] satisfying
((andu)) )e, > ((a
Je, l ET, - 1J, [1,K-]]
(2)
0). At the i-th iteration, let pretuuh = Clamp( (z hemign + 8())
((1:th))) Dex > ((2 j, ET,
(3)
be the current perturbed image. We omit the iteration index in penurb for simplicity. To solve Eqn. 5, our RisingAttacK
where the subscript represent the entry index of the logit vector. We often expect the perturbation energy. defined by 1y-norm, ||ي h Ip- is as small as possible to be visually imperceptible for p = 1,2, oc, An adversarial perturbation = v. - heniinn is treated as being "visu- ally imperceptible" based on the commonly used threshold 6o < 8/255- = 0.0314.
is streamlined as follows:
We linearize the DNN ((-) around the current perturbed image apertuch so the nonlinear constraints IK -(xx) > 0 become linear. We use the first-order Taylor expansion,
f(x) R ((2: + [(
(x - p (x-2peeurh)
(6)
where I(rpetttt) E RRCxD is the logit-to-image Jacobian matrix of the DNN, which represents the sensitivity of the DNN logits with respect to changes in perturr, Each row of J (( corresponds to the gradient of particular logit with respect to the input pixels.
Encoding Ordered Top-K Targeted Attack Constraints in the Logit Space. Denote by K E (+1, 0, -1)(c the matrix that encodes ordered K constraints subject to T, with which the adversarial region can be rewritten by.
After the linearization, there is a gap between the objec- tive function (i.e., I should be as close as possible to the benign image), and the linearized constraints which entails æ to be sufficiently close to the perturbed image pertubb to ensure the linearization is sufficiently approx- imately accurate retain the ordered top-K constraints. We re-express the objective function || _. to be ||æ- z:nnchur]] || where z-acchor represents the anchor in optimization, aaanchor = heninn or ,.anchor = penuub (the current perturbed image). We propose an anchor selection strategy: we start with z.ancbor = pe so the algorithm can quickly reach the adversarial region, that is to find E R(z.henign T). We then seek better adversarial im- ages with smaller perturbation energies by letting the anchor zanchor = benign The two steps may iterate based on monitoring the improvement with respect to thresh- old (see Sec. 3.2.4). Consider lg- Ig-norm for the objective, Eqn. 5 is re-expressed as,
R2 T) = v E [0, PP satisfying IK (x-l( > 0}.
Learning ordered top-K K attacks for a benign image benign can be posed as a constrained minimization problem, minimize dER
||0||p
(4)
subject to
IK K- Petterb > 0,
g.eetur
Clamp(x* haniig + +5),
where ô is the adversarial perturbation variables, ||- 1ly rep- resents the lp-non no-m (typically, 12-norm is used). Clamp(-) ensures the perturbed example p: is in the input im- age space (i.e., perrtuhh [0, D) via element-wise pixel value clipping. The challenge of solving Eqn. 4 lies in the nonlinear constraints caused by the highly non-linear DNN (Eqn, 1). In practice, we also expect the learning of rad (= bemign + 8*)) E Renhnnggn T) is efficient subject to a predefined and limited budget such as 30 or 60 iterations.
minimize =E(001]0
|| | -x anchor
3.2. Our Proposed RisingAttacK
s.t. K- (B((2amebrr) + J (arancur) (x x anchur )) > O.
Inspired by the QP approach in QuadAttacK (Paniagua et al., 2023) (see a brief overview in Appendix A), but different from its feature space QP formulation, we aim to solve Eqn. directly in the image space under the SQP frame- work (Boggs& & Tolle, 2000). The core idea is to iteratively linearize the nonlinear constraints in Eqn. 4. Due to the large number of constraints, C - 1 and the high dimension-
Eqn. 7 is theoretically solvable, but practically feasible since the number of constraints, C C-1 is large (e.g.. C = 1000) and the dimension of variables, D is extremely high (e.g., D = 224 x 224), especially given the limited budgets in learning attacks. We propose methods to address these challenges.
5

---

RisingAttack
3.2.1. COMPACT ORDERED TOP-K CONSTRAINTS
structure of A revealed by its SVD,
We introduce mapping that condenses the logit space with- out compromising the ordered top-K constraints, but allows the number of rows of the Jacobian matrix to only depend on the nubmer of targets, K.
A= E V - U- Er V.T
(12)
where U. E [Rd
> Rd and V
RDxD, Σ = - is a diagonal matrix with singular
values, di -a-11. U (and V) provide orthogo- nal bases for the column (and the row) spaces of A. And, U-UT and V
To that end, we first notice that Eqn. 3 can be simplified to reduce the number of constraints from C- K to without breaking the overall ordered top- K constraints,
II (where represents the identity matrix). The rows of U corresponding to large singular values identify the most sensitive ranking constraints. The row space of A corresponds to the input image space, and each column of V represents a principle direction in the image space. Since we have d < D, we can drop the columns of V to form the reduced SVD, i.e., V, E (d-(d) the first d - 1 columns of V, which consists of the and spans the entire solution space of the polyhedron de- fined by A A- S b. The columns of V, span a subspace in which adversarial perturbations are most effective towards satisfying ordered top-K constraints. Learn- ing ordered top-K attacks can be achieved in the subspace accordingly, as we solve it in the following.
(8) where max(.)) introduces nonlinearity in the constraints with a gradient switching effect in learning that is not desirable, however. We tackle this by introducing mapping,
(x))(x max( (((=))
(9) where M is a multiplicative of K such as M 5- K. The mapping G reorders the logits and augments them with differentiable nonlinear term (see Appendix B for details due to space limit).
G: E DC + 1(-) E Rd=K +MM-
last D (dl-mcoolums
orthogonal bases in the image space,
Denote by K E - -1 -1 1)xd the compact encoding matrix using the mapping G, which has a nice form with rows rotating from [1 -1 0 0| (i.e., the logits in I(-) are expected decreasingly ordered). K remains unchanged in the optimization.
Let 5 aannchor, Eqn. 11 is rewritten as,
minimize BERD
11012
(13)
With the mapping G reordered and condensed logits I(.), Eqn. 6 is redefined by,
subject to A- < b - A anchor
1(x) 1( J J( - (x x m..ncbrrr
(10)
With the change of variables ō = V e, we have,
where the Jacobian matrix J[ [[ganchor) E RaxDD with d =
K + MM + 1 only dependent on the number of attack targets,
| l2 = IIV <|12 = ||e||2, (since V is orthogonal)
(14)
K, and often < C (e.g.. d 101 for K- = 20 with
A- 5 U Σ V v U E.G,
(15)
C' = 1000 in ImageNet-lk).
So. Eqn. 13 is rewritten as,
minimize ||e||.. CER
(16)
3.2.2. JACOBIAN SUBSPACE QP
With the compact encoding matrix K and the updated Tay- lor expansion (Eqn. 10), the constraints in Eqn. 7 are then simplified and we have,
subject to E. UT (b- A x mncchrr)
where due to the block diagonal structure of E, we can split
[r] c cy E Rd-1 and 6, lies in the null space of A and
minimize =](0.1IP
||0- aanchor 2
(11)
co
thus can be ignored and set e = 0 since we are minimizing
subject to
A.r x < b.
||<|
We further have,
where A KK - -J (2:ahcor) incorporates the ordered top-K ranking constraints into the logit-to-image sensitivity analy- sis (i.e., the adversarial Jacobian), b K (Iha (2.anchorr) .mmbbbr)) +m defines the constraint boundaries and the feasibility of the optimization, with m being margins introduced to control the target separability and to change from strict *<' to '<' in optimization constraints. Here, A E (d=1)x b E d (a E TRP;; A x < b} defines a high-dimensional polyhedron in the image space.
minimize G.ERé-1
1|c,112.
(17)
subject to E, SUT. 2: anchoor
which is now low-dimensional optimization problem with linear constraints, and can be solved by many QP solvers efficiently, such as the cvxpy package (Diamond & Boyd, 2016; Agrawal et al., 2018). Let b = UT (b- A . zanccur) which represents the projection of the constraint boundary onto the orthogonal basis formed by the left sin- gular vectors. Then, the constraint Σ, E, S also shows the feasibility and constraint satisfaction: the smaller the ratio b, for a singular value o, (i = 1, .dd 2--1 1) is, the a; easier it is to satisfy the corresponding constraint.
Directly solving Eqn. 11 is still computationally challenging and does not meet the low budget in learning attacks. We exploit the structure of the polyhedron via projection.
Exploiting the Subspace Structure of A. We utilize the
6

---

RisingAttacK
Denote by e, the optimized solution of Eqn. 17. The optimal solution of e is E"
as the optimization prioritizes feasibility over minimizing perturbation energy.
[
by definition. Thus, 8" V Ve..
A Alternating Anchor Point Strategy. To balance the trade- offs between rapid feasibility and minimal energy, we im- plement an alternating anchor point strategy. This approach dynamically switches between heaiign and gpentbb as the an- chor point based on the current optimization state.
We can directly recover the optimal solution x= in the image space by, x anccho 8"
anchor
V G
(18)
If the number of iterations since the last feasible solu- tion exceeds 3 (a predefined threshold), we set ae perturb to prioritize reaching the adversarial region.
which can be understood from the QP perspective in the Appendix C, and is used in updating the perturbation and the perturbed image for the next, (i 1)-th iteration of our Attanc,
Otherwise, we set x-achoor = henign to continue minimiz- ing the perturbation energy while staying within the ad- versarial region.
8(++1)= = Clamp(2* (x*) benignn
(19)
y perturb
r bemign + 5(1+1).
(20)
3.2.5. INTERPRETATION OF RISINGATTACK
3.2.3. loo PERCENTILE PROJECTION
Eqn. 18 provides an intuitive interpretation for the optimized perturbation 8 = V, at each iteration of the optimization. The perturbation is the learned linear combination with coefficients in e E RR of d 1 image bases, i.e., columns in V, E (d--1), Recall that each column in V, represents a principle direction the image space that can affect logit ranking the most subject to how large the corresponding singular value is. The learned weighted sum of the columns of V, can provide most efficient perturbation, as shown by the consistently smaller perturbation energy obtained in our experiments.
For the solution 8* = V, + based on Eqn. 17, we observe that it often exhibits disproportionatell high fxx norms. We observe this large &o driven by very few components (pixel values) of our solution and the overall quality of our solution is not contaminated by these extreme values (or outliers). We hypothesize that the outliers might be caused by the first-order Taylor linearization that is not sufficiently accurate at those pixels. To alleviate this issue, we resort to a Loo Percentile Projection as the post- post-processing step. Specifically, we compute
== Perceettlee( 0.995))
(21)
Potential Defensive Insights. By analyzing which singular vectors in V, correspond to large singular values, defensive strategies can be developed by reinforcing robustness in those vulnerable directions against ordered top- attacks. Mcanwhile, adversarial training can be guided to target these critical subspaces. We leave those for future work.
where F indicates 99.5th percentile of magnitudes in our so- lution. We then wlement-wisely project 8* to this percentile,
. + Sign( x min((o21,7))
(22)
where is the entry index.
3.2.4. ANCHOR POINT SELECTION
4. Experiments
When the number of iterations is infinite (or very high), choosing z-anchor = _ benign in Eqn. 11 yields the lowest en- ergy solution upon convergence. This is because each step of the optimization directly minimizes the distance from i to benign aligning the solution trajectory with the global objective. However, in practice, the number of iterations is limited, and honign does not lie within the adversarial re- gion during intermediate iterations. As result, only using r benign as the anchor point can significantly delay reaching the adversarial region, especially when the constraint set is complex (when K is large).
In this section, we evaluate our RisingAtttac in the ImageNet-IK benchmark (Russakovsky et al., 2015), and compare with QuadAttacK (Paniagua et al., 2023).
Models Under AttacK. Following QuadAttacK, we use two representative ConvNets (ResNet-50 (He et al., 2016) and DenseNet-12 121 (Huang et al., 2017)) and two Vision Trans- formers (ViT-B (Dosovitskiy et al., 2020) and DEiT-B (Tou- vron et al., 2021)). Their ImageNet- Ik pretrained check- points from the timm package (Wightman, 2019).
On the other hand, choosing perturb (the current perturbed image), the anchor point ensures rapid progress toward the adversarial region. Since the optimization minimizes the distance from T to perturb at each step, the solution quickly adjusts to satisfy the constraints. However, this may lead to suboptimal solutions in terms of perturbation energy,
Data and Attack Targets. We use ImageNet- val im- ages from which we select and sample subset consist- ing of class-balanced 1000 images (i.e., one image per class). The 1000 benign images can be correctly clas- sified by all the four models. For each image, five or- dered target sets are randomly sampled for each value of K (K = 5, 10, 15, 20, 25, 30), see Appendix D for details.
7

---

RisingAttacK
Table Ordered top-K attack results averaged across 5 different seeds. Overall, our RisingAttacK shows a big leap forward in advancing ordered top- K attacks, outperforming the prior state-of theee-----e--ttttt art method, QuadAttacK (Paniagua et al., 2023) by a large margin most cases (higher ASRs with lower lp norms). ese norms in red is to show they are treated as being "visually imperceptible" based on the commonly used threshold 8/255- = 0.0314. The subscripts of methods (30 and 60) represent the computing budgets.
(a) ResNet-50 (He et al., 2016)
(b) DenseNet- 121 (Huang al., 2017)
Top.
Method
A5X
4,4
(sting)
hoMt
K
Method
ASX
44
44
Time (sting)
FeMt
T0p-30
QualAtacka
Qualhmack
RisngAnacK.
Faled
14539
6,4793
Top-30
QuatAmacka
RiengAnecK.
Fallst
23356
4,5019
inf
RaingAnasKK
0,8022
0.0470
9.5619
RisagAmcce
Fallst
10,2355
Top
QuxhMtacka
QualAmack
Raing/MaccK
KiiiggAtccKo
0,0018
00011
0,8420
0.8392
1004255
11,6214
5.1218
3099
1561
1511.3347
0.1301
0,0395
0,8388
3.4677
127055
14:0839
7,0999
48.9628
Tup-22
QualAtteKa
QuxeAmaca
RicagAncK
RicagAus:Ka
0.1214
0.9390
0.1094
1818
MMNG
Fallst
7770
40938999
01551
0/0776
3,3016
4.1687
8.3779
5.5466
inf
Top-20
QuadAttickoo
Qualhtacca
Ki
08306
0,344
0,975
0.0665
10.0991
978815
37474
34884
3133.6199
285000433
1101
1022.5885
0.055
0.0289
0.1079
3,4099
6.7267
1.734
3/7216
3,1100
1.9481
Tep-30
QualAileKK
RicarAmsKK
RiengAns:Ky Ko
0.340
0.9812
11,6066
5.991
6.1377
3563.3589
17448239
1786.5613
0.
0.0468
4
8.290
4,8066
7,6000
23.7733
Top-15
QuxdhtacK.
QualAAiacc
RaungAnscK,
0,4400
040225
0.9668
0.9856
8,3365
13395
29981
30150
878.9222
2620.7310
3231
871.8877
0.0117
0,0238
0.0254
3,4839
2.8794
5.1634
12783
3,2229
9.9674
1op-15
QualAmaKK
RicagAmcKe
QustAlleeaa
RienzAme:K.
0.9856
0,936
9,2713
4.7M0)
2364.2755
1362.7559
0,0057
3,8%6
1,3919
3,5501
2.3310
3.504
Top-10
QuadAtrakk
RasngAnseK
QualAtiacK.
RaingAAaaK.
0.9866
0.9936
0.3064
03400
0.3547
6.5228
2.1748
2.0835
2044
602,1784
638.8923
1994 1913
0,0544
0.0167
0.0178
3,790m
3
1.7893
1.7W55
3,3482
2.4244
Top-10
QuatAmecK.
QuzlAmnee
RiengAns:Ka Ka
0.9392
0.9556
1,0066
6,7558
759.1986
2123.8944
0.0545
3.8256
4.2223
1.8915
2.5458
2,4222
10p-5
QisafAmisK x
QualAtiacK
Raing-nsck,
0.9988
00588
0.5544
8.359
4,0029
13519
1.1834
1.4693
1261 2314
428,0254
196.1495
1245 0770
0.0309
0.0098
0.0134
4.5357
0,9517
3.3373
2.0081
Tep-5
QusAAneKaa
QualAtteKK
RiengAus:K.
0.9994
0.5996
3,9671
1.2199
331,6714
1705
3.8644
2.2643
1.2082
2,2794
3,0600
Top-1
RasingAmeKa Koo
QualAttacK.
6.9996
0.992
1,4443
B6184
467.1178
165.553
0,0044
0,6144
5.3838
1566
Top-1
QualAmaKa
RisagAm:KK
1,0000
1,0000
0.2001
503.
177.135
1376
3,4133
0,8046
1.9466
ReingAAaccK
0.772
0.9986
1/4344
0.9155
251.6174
461 1199
0.0088
6.0081
2.6011
0.3201
1.4638
RicarAns-KK
0.4255
1.3719
(c) ViT-B (Dosovitskiy et al., 2020)
(d) DEIT-B B (Touvron et al., 2021)
Top-R
Metood
4,4
Mran
Time (stiin).
RMM
Tog-K K
Method
4,4
Mean
Time (sring)
Pole
Tog-30
Quadkttacke
RaiegAmgka
Rs
0,3272
0.9534
0.8568
9,6705
9.7202
11.4132
Falst
2558
2721.2876
3216
2587
4505
0,1632
0.0876
0,1022
5.3135
2.790
31.7799
43,3954
3,1589
Inf
Top-30
RaingAuucKK
QualkinekKs
D.0640
0,5150
0,0000
9.4632
9,3734
11.0771
Falleal
2860.9240
2697.9176
3165,6010
0.0997
0.0957
6.8814
2.9032
43:3521
4.1792
21,6930
5.8333
Inf
Top- 25
RisieghmkcK
RiiiggAmkka
Quad/ttacke
0.6972
8.7836
0.9944
0.4331
7,71900
5,5706
2136
1530
2860
6657
5765
3211
0.1002
0.0526
01021
5,3733
3686566
140775
6415
int
Top 25
Rairg/AmcK
Quod/anccaa
0.6644
0.6745
0.9854
9,3750
6.3220
5,1933
2509 8222
1434/669
1763.4334
0,0950
0.0581
0/0882
2.1733
36.1064
41966
18.1108
3.1975
inf
Top
QualAitscK
Reiss/mmKKe
RaisgAA:::K
100004
[0.2428
0.9864
0.4956
6.3770
7.9136
3.7099
4.9483
2393
1807
13432133
6887
7502
01555
0.815
0.0360
0.043
5,0699
7.015
158230
2
16008662
Tup-30
RaingAnn:
Qusalkite
Roineguucc K.:
0,0622
500113
0.9956
0.346
7,8974
6.3491
2.9174
3.8373
781 2607
2343 5441
1045.9963
1990 0333
EL0292
0.0735
0.8366
2.15KA
4.1868
158331
7.9034
325.7059
2.5465
1op-15
QualAitacKe
ReisggAns-Ke
Rsieg/AmaKK
Quca/inaeK
008404
0,5955
4.5932
6.2651
3,8944
753.1852
1993.5133
5155
0.0500
6,0055
E4245
4.7623
2231
164,5583
Top-15 15
Rsing/AmcKK K
Raing/\makk Ko
QuodkmeeK
0.9700
0.9278
1,0009
6.0671
4
2.3015
3,1.90
S3N 2395
573
1857 4V14
1558,1000
0U0225
0.0944
1L03100
010350
39835
20034
6,0053
11.9500
2.8819
42,8955
Top- 10-10
RaingAnn:K.,
QuaaAiiseK
Quadkttak, 0.9130
RaisgAun:KK
000353
0.9936
0.7112
4.5346
2.6347
1499
1.9915
S0K5791
694.1766
1374 2262
1004 6967
0J0266
0.4100
0/257
2.9134
K2583
4.6368
1660
36.7947
2:5247
Top-10
QuealAmneKa,
RaingAuack s)
QualkmnKaa
RaingAnscc ss
0.9733
0.1296
8.9200
3.5752
1.5076
3.1465
4,9693
379,6582
556.2741
1123.3760
6306
0,0353
0.0162
IU0222
0.0256
R:2610
1.955
1615
2.4555
11,4300
Top-1
QuadAmek,
Quaakunack
RsitgAmn:K
RiiigAnn::..
[0,5024
0.9080
0.5713
0.5050
5,2030
36410
1.6101
1.1659
1128 9154
1020 5490
486.4644
29266994
0.0128
0.0174
01242
211888
22197
4.9981
2 3686
1,7630
Top
Quothmecaan
Raing/maccy
RainggnnacK
01754
0,5509
1.3450
1064-7233
334
254 8953
102412007
0.0149
2.2155
3.375
Dop-1
Qead-makk
QuadAAtscK.
0.9998
0.9335
(19953
1.5716
8,6578
8.4365
149.1661
50K.091
509.5755
96.745
0.0381
0J0181
0,0800
0/036
2
RUGETT
1.2715
1.340
2.1102
52121
Tup-1
RsingAüns:K, g)
QualhiukK
ReiigAnn:
1,0000
1,3910
459,6064
0.0055
2,9955
3.4907
3.9437
Metrics. The metrics used to evaluate the attack methods include the Attack Success Rate (ASR), as well as the LT, l2, and for norms of the perturbations. ASR quantifies the fraction of adversarial examples satisfying the ordered top- K constraints (larger is better). lp norms are computed based successful adversarial examples (lower is better, indicating less .erceple-p.....ibble.... We note that l, norms are compatible between different methods only when their ASRs are similar. For example, a method may show very low E, norms when the ASR is also very low (i.e., it can only
attack a few images). To compare the relative improvement of one method (with ASR and Ey norms) against another one (with ASR" and Eg norms), we propose to use holistic figure of merits (FoM).
ASR
&
FoM
Σ
(23)
ASR 3
PE (1,2,0)
where when the opponent method fails, i.e., ASR2 = 0. we set FoM= +0o. Similarly, we set FoM= -o if the primary method fails while the opponent method succeeds,
8

---

RisingAttack
and FoM= 0 if both methods fail. When the FoM>> 1, say the primary method is holistically better than the opponent method. We report the Mean metrics across the five sampled targets for each K. We also adopt the com- monly used foe = 8/255 as the threshold to characterize the "visual imperceptibility" of learned adversarial pertur- bations (Croce et al., 2020). See Appendix E for details of metries including Best, Mean and Worst comparisons.
for which we used PyTorch 2.6 and the jacrev and vmap (with chunk size 100) functions in the torch. func li- brary. When K is larger than 1, based on Eqn. 9, we main- tain K + M + 1 logits with M = 5 - K. We did not test other factors for M (e.g., 2- K or a predefined constant such as 5). We will address this speed limitation in future work.
5. Conclusion
Baselines. We mainly compare with QuadAttacK (Paniagua et al., 2023) since it is the prior state-of-the-ar method, significantly outperforming the CW and AD (Adversarial Distillation) (Zhang& & Wu, 2020). For a fair comparison, both methods are tested under identical experimental con- ditions. For all experiments, each attack evaluated at 30 and 60 optimization iterations to analyze its performance under varying computational budgets. The initial perturba- tion for all attacks is set to zero, ensuring consistent starting conditions across methods.
This paper presents RisingAttack, novel method for learn- ing ordered top-K targeted white-box adversarial attacks by directly solving the non-linearly constrained optimiza- tion problem in image space under the sequential quadratic programming framework. Our RisingAttace provides a simple yet elegant solution: ordered top-K adversarial per- turbations can be learned via iteratively optimizing línear combinations of the right singular vectors (corresponding to non-zero singular values) of the sttack-targets-ranking constrained logit-to-image Jacobian matrix. Through ex- periments on four ImageNet-Ik Ik trained DNNs, our Risin- gAttacK shows a big leap forward in advancing ordered top-K attacks in terms of a proposed figure-of- -f-mtrits met- ric, significantly outperforming the previous state-of-the-art method, QuadAttacK.
Results and Analyses. Our proposed RisingAttaas shows a big leap forward in advancing ordered top-K attacks, which in turn verifies the significant advantages of learn- ing attacks directly in the image space by our proposed SQP formulation. Results of ordered top-K K attacks for the four models are shown in Table (a)) (b)) 1(c) and 1(d).
Based on the FoM evaluation (Eqn. 23), our RisingAt- tacK consistently outperforms the previous state-of-the- art method, QuadAttacK across all K 10,2,, 25,30) and all four models. It achieves FoMs greater than 2 in most cases (i.e., holistically 2x better than QuadArtacK). Our RisingAttacK facilitates learning visually- imperceptible perturbations up to K ResNet50 and DEĪT-B, K = 15 for ViT-B, and K = 10 for DenseNet121, based on the for threshold, significantly outperforming QuadAtttcK.
Impact Statement
This work advances the field of adversarial machine learning by introducing RisingAttacK. By improving the efficiency and scalability of ordered top- adversarial attacks, partic- ularly for large K values, this research highlights critical vulnerabilities in modern DNNs. However, adversarial at- tack methods also pose risks, as they may be misused to compromise real-world systems. For example, attacks on ranking- based systems could be exploited to manipulate search engine results or recommendation algorithms. To mitigate these risks, this work should be viewed as a tool for potentially strengthening defenses (e.g., as crities for them) rather than enabling malicious use. In addition, this work contributes to the broader exploration of optimization in machine learning by integrating techniques from traditional nonlinear programming into neural aetorrk-based problems. This direction holds promise for both adversarial research and other optimization tasks in machine learning, offering a foundation for solving increasingly complex challenges.
20 for
Fig. 2 show examples of learned adversarial examples and perturbations using RisingAttaan AttacKon- More examples are provided in the Appendix F.
More Results. We also show results of using the lowest- K predictions of each benign image by each model as the ordered top-K K attack targets (Table 6 in the Appendix E). Ordered top-K targets by this image- and -peel-specific selection method are intuitively deemed as more difficult to attack, as empirically shown in (Zhang & Wu, 2020). Coun- terintuitively, our results show they are not more difficult than randomly sampled targets using both QuadAttacK and our Riting
A Acknovledgments
This research is partly supported by NSF IIS- 1909644, ARO Grant W91 INFI 810295, ARO Grant W91 NF22100110 NSF CMMI-202466 and NSF IUSE-2013451. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of ARO, NSF or the U.S. Government.
The Average Speed (secondfimage). We note that for K = our RisingAttacK is consistently faster than QuadAtttck. For K3 1, QuadAttacK is mostly faster than our RisingAt- tacK. The main reason is due to the current implementation of computing the logit-to-image Jacobian matrix in PyTorch,
9

---

RisingAttack
References
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
Agrawal, A., Verschueren, R., Diamond, S., and Boyd, S. A rewriting system for convex optimization problems. Journal of Control and Decision, 5(1))42-600, 2018.
Huang, G., Liu, Z., van der Maaten, L., and Weinberger, K. Q. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017.
Amos, B. and Kolter, J. Z. Optnet: Differentiable opti- mization as layer in neural networks. In International Conference on Machine Learning, pp. 136-145. PMLR, 2017.
Inkawhich, N., Wen, W., Li, H. H., and Chen, Y. Feature space perturbations yield more transferable adversarial examples. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp. 7066- 7074, 2019.
Boggs, P. T. and Tolle, J. W. Sequential quadratic program- ming for large-scale nonlinear optimization. Journal of computational and applied mathematics, 124(1-2):123-
137, 2000.
Li, M., Deng, C., Li. T., Yan, J., Gao, X., and Huang, H. Towards transferable targeted attack. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 641-649, 2020a.
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39-57. Icce, 2017.
Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09677 2020.
Li, Q., Guo, Y., and Chen, H. Practical no-box adversarial attacks against dnns. Advances in Neural Information Processing Systems, 33: 18899-22886, 2020b.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 06083, 2017.
Diamond, S. and Boyd, S. CVXPY: A Python- embedded modeling language for convex optimization. Journal of Machine Learning Research, 17(83)11-5, 2016.
Python-embedded
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenbom,
Naseer, M., Khan, S., Hayat, M., Khan, F. S., and Porikli, F. On generating transferable targeted perturbations. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 7708-7717, 2021.
D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M.,, Heigold, G., Gelly, S., et al. An image is worth 16x16 16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.1 /929, 2020.
Near, J., Darais, D., Lefkovitz, N., and Howarth, G. Guide- lines for evaluating differential privacy guarantees. NIST Special Publication SP 800-226, National Institute of Standards and Technology, Gaithersburg, MD, March 2025. URL https: /ooi. pooii.org/11.. 6028/NIST. SP 18.80022266
Durfee, D. and Rogers, R. M. Practical differen- tially private top-k selection with pay-what-you-get composition. In Wallach, H. M., Larochelle, H., Beygelzimer, A., d' d'Alcé-BBue, F., Fox, E. B., and Garnett, R. (eds.), Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 3527- 3537, 2019. URL https: https://proceeding /tpppppcceeenss... neurips.com cc http:///sccccpppp/////////// htahh//h99hhhhh////e/// b139e1 0239ee00421440aaeeef222 49cdf fe-cdf-eeaaee 6e 6 html.
Nocedal, J. and Wright, S. Numerical optimization. Springer, 1999.
Paniagua, T., Grainger, R., and Wu, T. Quadattac k: A quadratic programming approach to learning ordered top- k adversarial attacks. Advances Neural Information Processing Systems, 36:48962 48993, 2023.
Fang, H., Kong, J., Chen, B., Dai, T., Wu, H., and Xia, S.-T. Clip-guided networks for transferable targeted attacks. arXiv preprint 2rXiv:2407.10179 2024.
Reza, M. F., Rahmati, A., Wu, T. and Dai, H. Cgba: Curvature-awant aware geometric black-box attack. In Pro- ceedings of the IEEF/CVF International Conference on Computer Vision, pp. 124-133, 2023.
Gill, P. E., Murray, W., and Saunders, M. A. Snopt: An sqp algorithm for large-scale constrained optimization. SIAM review, 47( (7(11999-13 131, 2005.
Reza, M. F. Jin, R., Wu, T., and Dai, H. GSBAS*KS: Stop$ SkS geometric score-based black-box attack. In The Thir- teenth International Conference on Learning Represen- tations, 2025. URL https: openreview net/ forum? foaumid==hae 1atummiddhttxtoHyl1l
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv: 14/2 2014.
10

---

RtsKK
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z.., Karpathy, A., Khosla, A., Bernstein, M., Berg, A. C., and Fei-Fei, L. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115(3):211-25,, 2015. doi:
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D.. Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. arXiv preprint 13/26619/ 2013.
Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jégou, H. Training data-efficient image transform- ers & distillation through attention. In International con- ference on machine learning, pp. 10347-10357. PMLR, 2021.
Tursynbek, N.. Petiushko, A., and Oseledets, I. Geometry- inspired top-k adversarial perturbations. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. -1998-407, 2022.
Wightman, R. Pytorch image models. https: / /gihhbb. com/ com/rwitee wwwwiihttann//nmm wwtpae//ytttoooimieeeeeee iodee-mode
2019.
Zhang, Z. and Wu, Learning ordered top-k adversarial attacks via adversarial distillation. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition Workshops, pp. 776-777, 2020.
Zhao, A., Chu, T. Liu, Y., Li, W., Li, J., and Duan, L. Minimizing maximum model discrepancy for transfer- able black-box targeted attacks. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8153-8162, 2023.

---

RisingA
A. Background on QuadAttacK
QuadAttacK (Paniagua et al., 2023) addresses the challenge of optimizing Eqn. 4 by first "lifting" it into the feature space, ie.. the output space of f(.), see the left-bottom of Fig 1. At a given iteration i, let 8() be the current perturbation, and pertuurb x henign 866) the current perturbed image with 2pentur f its DNN features. QuadAttacK aims to iteratively find the optimal perturbed features around g to satisfy the constraints by,
minimize & ||=- - perturb 12:
(24)
subject to K (W. +)
where the nonlinear backbone f(+) is eliminated from the constraints. Eqn. 24 can be solved by a QP package (Amos Kolter, 2017). With the optimized z", the adversarial perturbation is updated by back-propagating the feature distance the image space through the highly non-linear DNN backbone f(-).
((++1) (()) 7 06
(A ||2" perturty 1/ + (|01)))
(25)
where y is the learning rate, and the trade-off parameter between feature distance and image perturbation. The perturbed image is updated by,
porturb Clamp(z + +6(++)).
(26)
QuadAttaeK executed iteratively with respect to a predefined computing budget (e.g.. 30 or 60 iterations). As aforemen- tioned, there is gap between the optimized 2* (Eqn. 24) in the feature space and the computed 5(++1) (Eqn. 25) in the image space in terms of satisfying the ordered top-K constraints, which leads to suboptimal adversarial examples (Eqn. 26).
B. Details on Compact Ordered Top-K Constraints
In Sec. 3,2.1, we introduce the mapping G (Eqn. 9) that reorders the logits and augments them with a differentiable nonlinear term, reproduced here,
G: (() RC 1(-) Rd=K+M++
where K = |T| is the number of attack targets, M is the number of highest non non-target logits to include explicitly (e.g., M- = 5- K), and the final term the soft-maximum of the remaining logits. We have,
The ordered top-K targets: 1(x); - (xx),, for E (I,...,K), K}. where & T is the i-th target class. These targets remain
the same during the optimization.
The ordered top-M non-targets: ((x) = (())) where j E [1,.... MJ. and m, arg sort, (f(x));; E y T), i.e., f(x)m, is the j-th largest non-target logit. For example, M- = 5 x K. Denote by M the ordered top-M non-target classes, which are dynamic during the optimization.
The Soft-Maximum of logits of the Remaining Classes: 1(x) SmoothMax (((())))) y Y (T(TMM))) where d = K + M + 1, and SmoothMax(() differentiable and enables gradient distribution (rather than switching) in learning, which is defined by,
SmoothMax (v) = Sum Sum(SSftmax(t) C v),
(27)
where @ represents element-wist wise (Hadamard) product. It is straightforward to show that mean(v) (v) < SmoothMax < max(v) for any real vectors v.
We note that the inclusion of the t non-target logits is to ensure that the compact constraints remain robust, even in cases where the SmoothMax(() function introduces significant nonlinearity.
C. QP for Recovering Perturbation in the Image Space
We show the solution (Eqn. 18) can be understood from the QP perspective. Based on ó V cand 5 = x annchor have,
anchurr ) 6 4 V.T 1 V.T. where x, is the projection of x, and y-gnchorr the projection of the anchor image.
== V (a x
(28)
x anchor x, x7
ancherr
(29)
Minimizing ||<,112 to find the optimal xt that is closest to anchorr We have, x² = x a,cchor + c with which the QP for
12

---

RttKK
neigghland-whit-teerrte (172): whippet, (294): brown-bear, (803): snowplow, recovering the optimal perturbation in the original image space is to, anchor 2
minimize =E10,]
|| x
(30)
subject to V -
which only involves equality constraints, making it computationally efficient to solve, even though x is in the high- dimensional image space. We show that Eqn. 30 has closed-fom form solution, reproducing the result Eqn. 18.
Recall e, is the solution from solving Eqn. 17, aq -V,T gamcbbrr and x unchor
x. m-mccorr + t Eqn. 30 is reproduced here,
minimize x=(0,1]"
|| x
12
subject to
V, 2 x,
which can be re-expressed by expanding the objective function and removing the constant term as,
minimize =E(0.1)
x 2 mmmcher 2,
(31)
subject to V. x Eyp
And the Lagrangian is,
C(r, A) = x² x - 2 ancchor
+ AT (V, x xx))
(32)
We obtain estimating equations from the derivatives as follows,
(xx A) = 2- x - 2 ancchor + V,, == =00, 0,
(33)
dx
1
x x
mchoor
Vr X.
(34)
2
0 ((x, A)
V,T
xt,- = 0,
(35)
01
VT I = x;;
(36)
We have,
V. (n anchor
Vr A) = xt
(37)
2
A = 2. (V.T
ancchor
- xx/) = 2 (zanchor (a.amchor + +c,)) =-2 . En,
(38)
So, we have,
T x anchor
Vy (--2.,,) = nnchrr + Vn e
(39)
2
which reproduces Eqn. 18. D. Details of Attack Targets
We use 5 random seeds (42, 52, 62, 72 and 82) and sample lists of ordered top-30 targets as follows:
seed=42: (643): mask, (409): analog-clock, (798): slide-rule, (250): Siberian-husky, (593): harmonica, (47); African- chameleon, (142): dowitcher, (276): hyena, (908): wing, (721): pillow, (57): garter-snake, (257): Great-Pyreneess (397): puffer, (954): banana, (203):
(76): tarantula, (811): space-heater, (817): sports-car, (608): jean, (977): sandbar, (711): perfume, (157): papillon, (51):
triceratops, (428): barrow, (84): peacock, (531): digital-watch, (478): carton
seed=52: (523): crutch, (330): wood-rabbit, (743): prison, (611): jigsaw-puzzle, (613): joystick, (810): space-bar, (634): lumbermill, (203): pest--Highland-whii--eeerr
(217): English-springet (816): spindle, (926); hot-pot, (275):
African-hunting (337): beaver, (33): loggerhead, (264): Cardigan, (862): torch, (755): radio-telescope, (949):
strawberry, (162): beagle, (488): chain, (251): dalmatian, (292): tiger, (440): beer-bottle, (638): maillot, (722):
ping-pong-bale (349): bighom, (592): hard-disc, (409): analog-clock, (584): hair-slide, (701): parachute
seed=62: (45): Gila-monster, (224): groenendael, (274): dhole, (54): hognose-snake, (759): reflex-camera, (931):
13

---

RisingAttacK
bagel, (I): goldfish, (478); carton, (51): triceratops, (649): megalith, (117): chambered-nautilus, (652): military- uniform, (601): hoopskirt, (571): gas-pump, (520): crib, (221): Irish-water-ppanell (869): trench-coat, (102):
echidna, (14); indigo-bunting. (670); motor-scooter, (975): lakeside, (511): convertible, (8): hen, (840); swab, (156);
Blenheim-spaniel, (928): ice-cream, (24): great-grey-owl, (567): frying-pan, pan, (668): mosque, (866): tractor
seed=72: (678): neck-brace, (329): sea-cucumber, (731): plunger, (829): streetear, (565): freight-car, (628); liner, (331): hare, (376): proboscis-monkey, (787): shield, (622): lens-cap, (402): acoustic-guitar, (225): malinois, (487): cellular-telephone, (858): tile-roof, (94): hummingbird. (991): coral-fungus, (808): sombrero, (95): jacamar, (649); megalith, (35): mud-turtle, (215): Phittany-spaniel, (246): Great-Dane, (222): kuvasz, (88): macaw, (586): half-track,
(424); barbershop, (553): file, (302): ground-beetle, (363); armadillo, (793): shower-cap
seed==2: (280): grey-fox, (942): butternut-squash, (457): bow-tie, (810): space-bar, (811): space-heater, (388);
giant-panda, (121): king-crab, (974): geyser, (432): bassoon, (969): eggnog, (633): loupe, (399): abaya, (438): beaker, (329): sea-cucumber, (563): fountain-pen, (661): Model-T, (552): feather-boa, (256): Newfoundland, (859): toaster, (539): doormat, (949): strawberry, (157): papillon, (410): apiary, (569): garbage-truck, (496): Christmas-stocking, (207): golden-retriever, (591): handkerchicf, (806): sock, (372): baboon, (219): cocker-spaniel
We use those targets sequentially for K = 1,5, 10, 15, 20, 25, 30 for the four models. The targets are shared by the 1000 testing images. For each testing image, if its ground-truth label is in any ordered top-K K targets, we replace it with a different randomly sampled targets.
In addition to the randomly sampled targets, we also test special case in which the lowest-K predictions by a model for a benign image are used the ordered top-K attack targets (i.e., the first target the class of the lowest logit for the benign image, and so far so on). The results are shown in Table 6 in the Appendix
E. Details of Metrics and Full Results
We report the Mean metrics (ASRs and lp norms) in the paper. Here, we also report results in terms of Best and Worst. metries in Tables 2, 3, 4, 5, where FoMs are computed using Mean.
For model and a given K, there are five different lists of ordered top-K K targets. For each image, its Best (Worst) ASR is if any (all) of the five lists of targets be successfully attacked, and the Mean ASR is the fraction of successful attacks over the total five runs. The overall Best, Mean, Worst ASRs then averaged over the 1000 testing images. Corresponding to the three types of ASRs, their Ep norms are computed using successfully attacked images only.
F. More Qualitative Results
We show examples learned by both our RisingAttack and QuadAttacK for each of the five random seeds. Fig. 3 shows the examples by Qttaer corresponding to those by our RisingAttacK in Fig. 2 and the seed 42
More examples are in Figs. 4 and 5 (for seed=52).
Due to the file size limit (20M), we will show examples using other seeds in our released code repository.
14

---

RisingAttacK
Table 2. Full results including the three metrics (Best, performance.
Mean, Worst) for ResNet50 in Table ((a). FoM is based on the Moan
Top-K K
Method
Best
Mera
Worst
Time (s4im))
FuM
ASW
ASR
A5R
1ac
QuadAttaKao
0,4590
11.0907
0.1307
0.2076
11,8070
3654,9139
0.1349
0.0330
11.9156
5636.5432
0,1394
3.3947
6.479
Top-70
RisingAliacKa
0,8770
6.5011
1922.6799
0,0475
0.6612
7,0271
20818960
0,0511
0,3900
7,5992
225500249
0,0550
17.0013
QuadAtticK.
Failed
Fasled
Failed
1,6539
RisingAttacKa
0.0110
6.2378
1844
1844.3013
0,0470
0.0022
6,2378
1844,3013
0.0170
Fulldd
8,5619
QuadAtmeKoo
0.8460
11. 3686
3526.3618
0.1219
0.0088
11,6244
3599.8101
0.1301
0.3060
1188774
3674 2065
0.1388
3.4167
3.6439
Top-25
Ristng-AliacKo
4.8257
1419
0.422
5.2960
0,0393
0.6700
5,8040
1715.5532
0.0427
14,0839
QuadAlmekip
0.0090
1044261
$290 2773
0.0991
00018
10.4263
3259.2775
0.0991
Fuiled
1.7068
48.9628
Rising-AlaacKn
0.1270
5,430
1487
4868
0,0382
0,0392
5.1218
1511.3347
0.0388
0.0010
5,2031
1535.9489
0,0394
7,0999
QuadAttacK.
0.9560
9.7368
0.0984
0,344
10,0891
3133,6199
0.1079
0.6800
10.4514
3239 8729
0.1183
3,4039
3.1000
Top-20 20
Mising/MtacKo
0,9500
3,3880
992,4068
0.0257
0,3306
3.7474
1101,1521
0.0281
0.6520
4,1005
1207.9307
0.0305
6.7267
QuadAttccK.
0.36.0
9.0111
4259
0,0839
0.9978
9,0948
2850.0455
0.0858
0.0080
9,1756
2X74.5933
0,0876
1.7364
RisingAttacKa
0.2040
3.4129
1000.3753
0.0264
0.0666
3,4854
1022.5585
0.0269
0.0010
3,5609
1045.7229
0.0274
3.7216
QuadAtteeKo
0.9870
7:9013
2470 1343
0,0729
0.940
8,3368
2600.7510
0.0822
0.8460
8,8010
2739 1058
0.0932
3.4839
3.2229
15p-15
Kistng-AttacK.a
266355
0,0208
0.968
3,0150
0.9610
0.0260
5.1631
QuadAliacK.p
0,7540
7,3962
3027
0.0674
0.4922
7,8296
2451.8036
0.0717
0.2090
8.0427
2517:2334
0,0759
1.7382
3.3674
Rising-ttacKa
0.8310
2,7910
812.1335
0,0219
0.5856
2.9944
673.3677
0.0234
0.2970
3,2057
936.9361
0.0249
2.8794
Top-10 10
QuadAtteKoo
RasingAAlack..
0.9970
0,9980
61074
18077
519.1006
19176238
0.0%04
0.0149
0,9666
0.9936
6,5228
2.0825
602.1784
2054,5753
0.0167
0.0576
0.9660
0,9800
6,9893
2.3735
3186 1273
690.1587
0.0666
0.0187
3.7396
3,3991
3.3482
QuadAltcc.
RisingAttacKa Kn
0.9410
1.6997
568.1198
1803 2204
0
0.0160
0.8061
6,3547
2.1748
630.0922
1995
0.0175
0.5990
6,6744
2.3743
690.3330
0.0598
0.0188
1.7593
1.7965
2.9244
Top-5
Aising-AtacKon
QuadAttack.
10000
0.9890
3,6813
0.9567
270.4779
1161 6413
0.0264
0,0085
09558
0.9968
4,0029
1.1534
330.1495
1261.2314
0.0098
0.0309
0.8980
0.9900
4.3529
1,3547
391.1246
1369 4046
0.0962
0,0112
4.5257
1.8225
3.3373
QuadAlmckk
0,9880
3.6500
1953
0.0261
0,9590
5,9539
1246.495
0.0300
0,8950
4,26466
1343 3064
0.0844
2.1458
2.6681
KisingAmacka
0.9860
1.2737
361.3176
0,0110
09504
1,4693
420.0254
0.0124
0.8910
1.6607
477.3590
0.0138
0.9517
Top-1
QuadAltacK1o
Rasing-ttacK..
1.000
1.000
1.1548
0.4136
381 4498
104.7782
0,0049
0.0057
0.9992
0.9996
1,4443
0.6144
467. 1178
165.8517
0.0064
0.0083
0,9980
0,9990
1,7222
0.8364
233 233.5616
550.7556
0,0079
0.0110
5,3373
0.6114
2,1564
RisingAttack,, Ka
QuadAAlaac
0.9980
1.0000
0.6218
163.8100
6522
0,0057
0.0066
0.9986
14424
0.9155
251.6174
469.1199
0.0088
0,93
0.9950
1.2054
338 334
5100146
0.0105
0.0110
26111
0.3201
14638
Table 3. Full results including the three metrics (Best, Mean, Worst) for DenseNet121 in Table 1(b). FoM is based on the Mean performance.
Top-K
Method
Best
Moan
Wonst
Time (sling)
FaM
424
ASR
62
Go
ASR
424
Top-30
QuadAmacKun
RisingAitaeK.
0.7490
138819
Pailed
4117,4537
0.0991
0,4074
14,7263
Falled
4393.8482
0,1051
0.0730
15.6581
Failed
4677.7359
0.1114
20,3156
4.5409
inf
QuadAmackon
RisingAItaeK:
Falled
Falkel
Failed
Failed
Filked
Fiiled
2.3266
10,2335
inf
Top-25
QuadkiaacKa
RisingAttacKK
QuadAAtacKo
RisingAtteK..,
0.4600
0.3150
0.9860
13,0098
9.6484
8.8114
Fanked
2640.4239
2589.4709
4002.5555
0,1489
0,0736
0.0666
0.1734
0,1094
0.370
13.1825
9,9203
9.989M
Fanled
2945,3574
2921.6770
4053.5759
0.1531
0.0756
0.0747
0,0050
0,8340
0.0010
13.3529
10.1868
11,2310
Fanled
4103.6256
3320.9922
3001,6276
0.1573
0,0775
0.0830
4,1687
8.5279
2,2016
16,8643
8,5196
inf
QuslAAtsc...
0.9330
11,8446
3412,9160
0.1140
08340
11.6266
3583.3580
0.1268
0.5840
12.1967
3749.9306
0.1403
4.0066
Top=20
RisingAAttacK;;
0,9970
5,1080
1480.5618
0.0406
0,9812
5.9921
1744,8239
0.0468
0,9450
6,9129
2020.8591
0.0532
8,2901
2.6290
QualAiiacKaa
Rising/AttacKa
0,1240
0.7320
9,7962
5,7318
1664.7979
3054. 7057
0.0914
0.0456
0,4500
9,8564
6.1377
3072.677 6790
1786.5613
0.0485
0.1460
6,5680
Faikel
1915,5893
0.0516
2.02066
4,6070
23/7723
1op-15
QuadAAtacoon
RisingAAtacK.s
0.9970
8.6591
3,8050
2701.
1086.1460
0.0774
0.9866
1.0000
9,2713
4.3657
2884. 2755
9889
0.0887
0.0359
0.9610
9,8890
3067.5 3067.5058
0.1011
3,8%3
6.2878
2.3310
QuadAAtacKa
RisingAAttc.,
0.7780
0.9900
8.3044
4.2188
1207.4247
2599,4287
0,0720
0.0350
0,3088
0.9362
8.6281
4.7580
1697. 1923
1362.7350
0.9771
0.03877
0.2560
0,8350
8.9352
5.2677
2791.7945
1521.6817
0.0821
0.0425
18919
3,5501
3.5524
Top-10
QuadAttacK.o
RisingAsttac., g
1.0000
6,2172
2.3212
1957.3529
649.6995
0.0469
0.0208
1,0000
6.7558
2.6903
2123/4894
159.1986
0.0235
0.9970
1,0000
7,3050
3.0749
874.1637
2291
0.0629
0.0263
3.8256
4.2223
2.5458
Quac/Atackaa
KisingAttacKas
0.9900
0.9980
6,1801
2.4880
698.6799
1555.1525
0,0161
0.0221
0.9322
0.9880
6.6701
2.9210
827.1686
2098
0.0331
0.0253
0.3360
0.9690
7.1563
3.3607
958.0512
1218 2525
0,0602
0.0288
2.2937
18918
2,4272
Top-5
QundiAiacc.o
RisingAttacka:
1.000
1,0000
3.6045
1.0122
270.9332
1143.1525
0.0226
0,0103
0.9994
0.9998
3.9671
1,2169
331.6714
1258. 1706
0.0119
0.0264
0.9990
0.9980
4,3422
1.4422
1377 1377,3171
398.9840
0.0305
0.0136
3.8644
2,2643
3,0870
QuuccAmack.,,
RisingAitteK ys
0.9900
1.0000
3.6019
1.3896
37H.3550
1142.1894
0.0135
0.9944
0.9982
30552
166003
457.9204
1255.775
0.0156
039200
0.9930
4.3229
1.9524
544.3561
1371 33716645
0.0178
1,3502
1.20M2
2.2794
Top-1
QuadAttacaa
AitingAtttcK., Kag
0.0000
1,000
1.1724
0.4732
397,8131
112,4793
0,0063
0,0049
1.0000
1,0000
1,5191
0.7001
503.0047
177.1356
0.0070
0.0085
1.0000
1,0000
L.8542
0.9566
606.7211
251,8730
0.0093
0.8108
3.0413
0.8046
1.9166
Rising
QuadAnackaa
L0000
1.0000
L.728
0.7032
175.2027
397.9629
0.00844
0.0049
0.996
1.0000
LS144
1.0708
28000300
501.479
0.00770
0.9950
1.0000
L.4426
1.4523
390.3133
60340238
0.8149
0.0092
L,5199
0.4255
1.2739
15

---

RisingAttacK
Table 4. Full results including the three metrics (Best, Mean, Worst) for ViT-B in Table ((c). FoM is based the Mean perfor-
mance.
Top-K
Method
Best
Meat
Worst
Time (shmg)
FoM
ASR
4.
Fx
ASR
ASR
Top-50
QuadArtaKa
QuadAmacka
RisingAltacKa
0.6730
1,0000
9.4223
6.7803
Failed
2964
18817456
0.0996
0.0613
0.3272
0.9534
9.6708
9.7262
Failed
2721.2576
2938.2587
0.1032
0.0876
0.0590
0.8260
9.9254
14,2611
Failed
4001.9570
3014,5189
0.1067
0.1299
5.2135
43,3954
1.7870
3,89
inf
RisingAmeKK
0,9880
10.3031
8575
0.0934
0,5568
11.4132
4206
0.1029
0.2430
126194
3558.5805
0.1134
21.2179
Top-25
R At
QualAAtacaa
QuadAstacKa
0.9350
1.0000
9.0105
4.0101
Failed
2737 2737
1084.9150
0.0935
0.0332
0.6872
0.9944
94331
5.5706
Failed
2860.6667
1520.5703
0.1002
0J1526
0.3490
0.9740
9,8582
8.1685
Failed
2985.220
2232,4551
0.1010
0.0782
5,2723
2.7354
36,048
2,6425
RisingAAttc. p
0.9330
6,8418
1877.8280
0,0643
0.7536
7,7050
2126.3211
0.0721
0.5000
8.8011
2438.7838
0.0825
18.0775
Top
RisingAttacK
RisaigAnaacaa
QuadArascaa
QuadAttaca
0.9710
0.0020
0,9980
0.7380
7.4811
6.3770
3,0033
4.5276
792.6934
2268.2729
1221.1645
7502
2729
0.0533
0.0294
0.0748
0,0436
0,7828
0.0044
0,9864
0.4956
7,9108
6,3770
3,7609
4.9482
2393.0675
1007.6887
1343.2135
1992.7502
0.5333
0.0815
0.0473
0.0360
0.4910
0.9560
0.2490
8,3426
5,3892
4,5804
Fulled
2519.7231
1241.9193
1471.1873
0.0884
0,0511
0.0432
5,0069
2.6200
7.9615
15,8230
1610.8632
2,8308
QuadAitacKa
0,9730
5,8803
1780.9271
0.0558
0.6404
6.2661
1893,5173
0.0620
0,5960
6.6687
2011,4965
0.0684
4.7622
2.7231
1op-15
Kis
1,0000
2,3069
59344747
0.0235
0,9988
2.8751
753.1852
0.9244
0.9940
3.5373
939.6227
0.8343
11.9841
RisingAltacKa
QuadArackg.
0.0340
0.9270
4.7.03
3,4001
908
14X10706
2324
0.0339
0.0055
0,7510
4.7082
3.8944
1036.7394
8405
0.0379
0,5310
4,4471
Paila
1197,6996
0.0427
6,0305
2.4245
16488583
Top-10
QuadAmacKi
RisingAltic..
1,0000
4.55
1.5872
5184
397.2939
0.0363
0.0169
0:9130
0,9936
4.5246
1.9915
1374
50K.8791
0.4100
0.0206
0:7510
0.9750
4,8729
2,4423
634.1043
1476,9954
0.0247
2
2,5247
QuadAitacKa
0,0810
3.4168
1791
0.0255
0.0252
3,1999
1090 1997
0.0361
Failed
1.0034
36.7947
RisangAttaKa
0.9010
2.3233
599,0848
0.0240
0.7112
2.6247
684.1576
0.267
0.4810
2,9492
775.8982
0,0297
4.00
QuadAtacKa
1,0000
3.2461
1010
0.0241
0,9980
3.6439
1128,
0.0288
0.9930
4,0423
1246.0157
0.0E3M
4,3981
1.7630
Top-5
RisingAlneK.
08350
0.9934
235.3329
0.0111
0,5712
1.3650
292.6494
0J0128
0.2910
1,3395
340,4352
0.0144
4 4018
RisungAAtac..
Quat/Aiaacaa
0.8420
1.3886
345.5126
0.022
0.0153
0.5021
0,5980
3,2920
1.6101
406.4644
1029 $10
0.0174
0.1760
0.3310
3,4520
1.8357
468.6344
1087.7357
0.066
0.0195
2:2197
11108
2,9688
Top-1
QuadAmack
Rising/ltacKa
QuadAAtacKa
0.9910
1,0000
L,0000
1:2541
1.2537
0.2978
410.8221
41006006
60.3734
0.0045
0.0059
0.0059
0.9958
0,9388
0,9998
1.5736
0.4365
1,6881
509.7575
508.0591
96.0745
0
0.0081
0.9900
0,9990
0.8260
1,9042
1,8935
0.6648
612,7661
029.5179
139.9744
0.0106
0.0105
0.0078
2,6007
1.3040
L2715
2.1102
321211
RisingAltac Ka
0.9250
0.4270
90,9700
0.0050
0,9362
0.6578
149.1661
0.0086
0.8180
0.9318
219.6820
0.0115
0.6417
Table Full results including the three metrics (Best, Mean, Worst) for DEiT-B in Table I(d). FoM is based on the Mean performance.
Top-K
Method
ASR
4,
Best
6
ASR 1
4
Mean
61
ASK
4,
Wonsi
Time (s/img)
FoMt f
Top-30
QuidAmecaa>
RisingAlacKo.
0.2350
0.9860
9.300
7.9531
2840-2109
2263,3899
0.0985
0.8678
000400
0.5150
9,3734
9.4432
2697.9176
2860-9240
0.0997
0.0804
0.0010
0,0340
9.4465
11,7557
2881.7991
3365. 5665
0.1009
0.1007
4.1792
43.3521
8.8333
QuadAltacka:
Falled
Faaled
Fialed
2.3033
inf
AsiiggAmacK
0.2160
10.8325
3092.9322
0,9977
0.0600
11,0771
3165,0010
0.0577
Failed
21,0930
T5p-25
RsiingAmack.
QuadAltacKa
0.9000
10000
8,8805
3.6473
2703,0149
1002.9836
0.0886
0.8337
036611
0.9854
9,3780
5.1921
2829,8222
143466160
0.0960
0,0482
0.5850
0.9360
9.9093
7.9650
2187.8969
3006.5687
5687
0.1009
0.0768
4.0966
36,3064
2.1975
QundAmsc
Failed
Failed
Failed
2,2173
RisingAttucK., Ko
0.9100
3.6674
1573.9766
0.0520
0.6748
6.3220
1763,4334
0.581
0.3620
7.1691
2002.6739
0.0662
18.1
Top-20
RisingAmacKu
QuadAtttcKa
0.9990
10000
7,2048
611.1088
2199
0.0665
0.6122
0.9956
7.6974
781.2607
2343.5441
0.0355
0.0082
0.8540
0.9850
8.2363
3,5733
2459. 1404
994.9946
0,0811
0.0339
4.1868
158331
2.8466
RsingAAack,
QundAAlaccis
00160
0.560
6.2591
3,5031
94666329
19300525
0.024
0J8338
0000
0,648
6.799
33373
1045.3953
1950.0335
01021
0.0366
0.3810
4.1863
Fialed
1148,5782
0.0395
2.1563
7.9024
325.2090
1ip-15
QualAmacaa
RisingAttucKo
L0000
10000
5.5928
1.7594
1713.0018
4486124
0.0481
0.0184
0.750
1,0000
6.671
2.2015
573,3811
1852
0.0544
0,0223
0.9100
1,0000
6.5509
2.7017
715,2705
1997, 5902
0,0611
0.0266
3,9525
11,9810
2.8819
QuadAmticca
0350
4.5541
1548.1232
0.0833
000338
4.9674
1558.1400
010866
Failed
2,0254
42,8983
RiiiggAmacK.
0.9670
2.7227
7148364
N3N.2295
0,0310
0.8140
3,5773
963.3399
0.0346
6/0263
Top- 10
RisingAnaacK.
RsingAmaccoo
QualAAtscka
QundAttacKa
0.3500
0.9800
0.9600
100000
3.4065
3.9545
1.7993
1,1885
29155197
458.0865
1097.7370
1222.0665
0.0132
0.0191
0.0005
0.7622
0.9200
0.9996
4,3693
33572
1,5976
2.1465
556.2741
379,6882
1366,6326
1123,3760
0.0053
0.0162
0,0233
0.150
0.9980
0.3000
4.7999
2.5030
1.8825
658.8665
1475.4252
484,4438
1148,9145
0,0406
0,0195
0,0253
3,8755
4,1613
1,9552
8.2610
2.9455
11,4800
QuadAAtecK.;
1,0000
2.9872
940.1374
1374
0.021
0.9984
3.9975
1064.7252
0.0243
0.9950
3,8303
1192.7754
0,0288
3,4381
3.1378
Top-5
RisingAAl.cKun
10000
189,0444
1,0575
254,5953
1,366
44027
Rsing-Aacc,,,
QundAAtacKi
09/00
0.9760
19971
1,0890
932.7132
264.4366
0.0125
0.7994
0,5500
3.2526
1,3450
1024,0007
334
010255
0.0149
0,4770
0.7110
3.5522
1.6168
1114,3200
410.8617
0.025
0,0174
2.2165
1,7718
2.6286
Top-1
QualAAtacKas
RisingAmaceen
RisingAllacKau
QuadAmtcc,
09990
L0000
18000
1.1376
1,372
0.2450
381.0736
380-9527
67.5065
46.1936
0.0041
0.0052
0.0047
0.994
0.9994
1.3910
1.3899
0.5249
0.3340
459. 5060
159
68.5738
0.0063
0.0073
0.0952
0.0063
0.9970
1,0000
0.9240
0.9420
0.4472
0.7524
1.6311
1.6659
515.2655
544,4684
171,9542
97.7384
0,0080
0100000
0.0065
1,4404
0.6426
1.2708
2.4502
3,9437
16

---

RisingAttacK
Table 6. Ordered top-K attack results using the lowest-K predictions of benign images as attack targets. Overall, our RisingAttacK shows a big leap forward in advancing ordered top- K attacks, outperforming the prior of-t-offthhe-rt method, QuadAttacK (Paniagua ct al., 2023) by large margin in most cases (higher ASRs with lower Ep norms), fa--norms in red is to show they are treated as being "visually imperceptible" based on the commonly used threshold 8/255 = 0.0314. The subscripts of methods (30 and 60) represent the computing budgets. The FoM (figure of merits) of our RisingAttack against QuadAttacK is computed by Eqn. 23 to show its holistic improvement terms of how many times is better.
(a) ResNet-50 (He et al., 2016)
(b) DenseNet- 121 (Huang et al., 2017)
Top. J
Method
A3RT
Single Rin
51
Time (stmn) 1
Tep-I
Maahod
ASR
Single Run
Time (sling) L
FoMt
Top-50
RiinpAnneK.
Quad/mmccee
QuniAmmcks
RisisAAmeK.
0.3250
010200
0,5340
0,8040
11.7305
106641
6.3881
55437
15798711
1870.2285
36411 1040
1762.7836
0.1111
0.12M2
0,0433
0,0490
4
2.2976
38,9735
19,6166
3.8464
7,6222
Top-30
QustAmaka
RieneAmskk
QualAAtaeka
RienpAmscy. y
0.137
0.8520
0,8890
1333362
83630
10.2572
Failed
382909433
2561
41 1292
8755
0.1466
0.0689
0.0764
5,3182
1,8216
40,2658
9,4906
inf
Top-25
Kin
QundAinackas
(6630
0,0250
6,7000
10:301
11.5386
4.789%
4.2926
1585.999
1263,4319
3235,3005
1415,3054
01554
0.1390
0,388
2.2886
4.8973
16.1438
52,0004
3.1978
2.2999
Top-25
QuatAnnkka
QualAmaaKa
RieazAm:K. k.
RicagAmcky
0.750
0.0301
0,4730
0.9640
13.1121
11.125
7.2228
7,8557
2200.2915
21308964
4052.3545
0.1417
111047
0.0661
0.0897
5,8749
12,7430
1644573
3.0895
Top-30
Quad/insckee
Qundhmaska
RisisgAinnc.e
Rislsp/mmeKK
0,0090
0,7800
0,0500
10,0533
3,6953
3,3400
993,0273
3129.2405
1012,5122
4.5M3
7,4255
2.243
1,2764
Top-30
Qualtinnka,
QualAliskk,
RiengAms:,,
RicapAmakK
0.350
0.1710
0.5000
0,4640
9.555
13.3230
504476
8.5711
3118.5342
3513.0089
1612/615
14603408
0.1342
0.0556
0.0497
0.0451
2,5858
4,8813
7,4930
14.5262
2,6299
7,5798
Top-15
Quithmmoki
RisispAnnuK..
(1910
0,380
0.3830
8.620
3,1353
3,8005
917.7340
900.1031
23530003
766%
0.1249
10,7638
$6529
3.1577
2,6144
1op-15
RiinsAmsK
QustAmzka
QualAitakK,
RienzAma:K. k.
0.9910
0.330
0.9548
1,000
9,2727
8.322
4.5907
4.1631
2396.0532
1310.9248
27076770 6770
1190.4402
0.0340
0.0348
0.0080
4
2.4834
5.7305
11.1324
2,0579
2,3900
1op-10
Qundkmakka
QuniAitack.e
RisispAinuK..
Ko
0:9840
0.6500
0:9840
6.670
6,6988
6.746
1,2758
2.3197
700000600
661.3469
674.2584
2130,0666
0.610
00554
0.0190
0.0185
2.3425
3.9934
7.6067
4,965
2,5281
3.1999
Top-
QuaäAitakaa
QualAmaaKa
RisagAinkK K.
RiengAm::K g)
0,9950
0.225)
0.9830
1,0000
7.0547
6.5556
3.1446
2,8900
890.9174
887.3569
2232.9939
IU9222
0.0551
0.0359
1L0253
4.4977
4,0913
2.1163
7,3405
2,4674
7.34%
Top.5
Ristng/meea
Riskep/mmecKe
Qundhmtack
QunlAtracke
0.970
6.900
6.210
09250
4.175)
4.2896
1,3773
1,4905
1318,6006
397.4290
1351 5930
486.2640
00139
031100
01023
0.0114
2.1234
5.1849
2
4.3419
2.4533
2
Top
Qual/tmack
MuslAttakaa
BienrAnccK x.
RisugAm-KK
03810
0.9990
0,5930
0,599
4.3886
4.3000
20012
1.4322
558.1958
394.3157
1377.3555
1396.2655
0.0185
0L9138
4.6690
12309
4.4815
2.3815
2,0768
2,5089
Top-1
Risisp/uauc..
Rising/meee
Quad/macks
QusdAinacki
016:00
0.000
1,8000
1,0000
1.800
18117
0.7486
1,8900
521
542.3103
203.8991
203.6755
0.0003
0J0044
0.0002
0J1997
6.1673
3,0124
0.8E85
1.4833
2,1185
1.4446
Top-1
QualAmmcc
RisagAnn-K
RiengAm::K. a)
0.9910
1,4000
1.0000
1,0000
1.7586
1.7665
0.2916
1.2218
377.00 977.0253
547 8897
201. 0199
321.1319
0.0150
0.0000
3,098
1.5322
2,8500
1.8697
2,0625
1,3011
(c) ViT-B (Dosovitskiy et al., 2020)
(d) DEVT-B (Touvron al., 2021)
Top-x
Mothod
A
f,
Stagle Rui
Time (slang)
FoM
Top-K
Method
ASX 1
4,4
Single
12-
Time (witeg)
Fubdt
Top
Kuod/MacKK
RaispAmauKa
Kiitg//mmcKe
0.9900
0.5300
9.2033
6.9513
9.2443
Fanial
2576 3629
2828.3158
0.9977
0.0842
107,4773
54.5843
Top-30
RicasAms:Kp
QuatAmaaKKa
RisagAncKo
0.3600
0,2920
96171
7.8222
Falea
2027.7147
2213 4546
1846.
0,0933
0,8575
0.0694
107
5.313H
30831
$4.7059
4,2723
Inc
Top
Keodhmacce
Raitt//mxKKa
RairgAAmeKes
0.586
9,243M
6,8079
Falled
28136764
1859
019900
0.0640
3,504
46,2906
3.9297
25
Qux2AtaaKp RisakAm:Ky Ko
Quatmmaka
RicngAnccK
0,7090
5.4817
2808
1521 3459
0.0433
0.0508
M077073
00,3786
29515
isC
T0p-20
Qrodhmmckn
Raiig//mok.,
000000
0.9600
0.300
3.5513
4,8757
173508923
1316.7188
7153773
6000
01101
0,472
34886
26.0167
43,4559
450.2016
3:3785
Top-30
QualAmeeaa
RicagAncK, a.
RicakAm:Ko
0,5990
2.0716
195%
1003.
1000022
7259
000290
6.0264
0,8357
43.5567
24,6677
31254
24639533
OssulAune
0.606
2.4951
QuaAAtieK.
1855
0.0516
10521
15p-15
KairghmmkK
1.000
2.8185
734.7598
33.9166
1op-15
RicagAncKo
20666
53207703
6,0213
37.9756
Quachmacaa
0.6700
3.7915
1009.0554
0.0372
18.6377
62,7339
QusAmnkka
RicasAm-Ky Ko
0,9050
4.766
2.225
7748312
0,0291
18,6005
60.3640
0.8000
4,4075
1342.7171
0.0401
5.7166
2.5217
QualAmueK
4.3244
1340,
0.0844
4.7699
30775
Top
K
Kaitg/mmka
BairgAmee&
0,680
26736
096.4319
01073
12.7649
24
Top- 10
RicagAmcK<
RicngAm:KK
0.9230
20037
530.5555
0.0212
12.7532
15,815
Unad/mmkk
0,430
31150
1.1798
4541
13611
12.1849
2.1568
1.8908
Top-5
QualAneeKa
QuaZAmece
RicagAissK.
0.500
1005
4.6600
12.1753
26324
3.333
RairpAmmka
05450
429.3178
0J083
0.3619
RicagAmcK a
0,5700
1,3232
6.0147
63770
Top-1
09250
1000
1.7206
0.4883
189.9290
255.2060
0,005
3.7639
Top-1
QualAttecK.
RieasAus-K
0:9860
1.0006
76.0298
9909
0.0054
3.8654
3.149
4B412
BisinAAnneK
Qsadkmmkaa
09'50
200113
QuatAmeeaa
RiengAtt::K..
2.4961
17

---

Rising AusingAttack
Sppke
tock-s
1opil 15
topk-25
toplo-30
Feekard0
Brd-0.
100K-11
lopk-26
topK--0
Derssta0112
Inf-000545
INI-D. 1452
XTTBB
Inf-o CO76
InT-0 COFa
BrE-0 0387
0rf-000700
In--0 CBR7
1-1-0 10:1
30
DEM-
Ire-00514
Figure 3. QuadArtack examples of adversrial examples and associated perturistioos learned for benign image (ILSVRCZ2112.dl) D0012633 with the ground-rruth label, redisaank using list of randomly sampted 30 targets (see for seed-42 the Appendix D) the order of: nach, analog ulack, alide rule, Sibesian busky, Stamonica,, Afelcan clameleon, dowstchher, hyena, wing, pillow, gorter-enake, Pyrereey,,,, putter, banans, peett-iiigiann-mmitttttrrrtsssse whippet, brown-beas, snouplox, terantula, space-hestes, sperte-car, dean, cancber, percume, papillon, tri triceestss,, barrow, peacock, digital listtalsstc... carton. The adverstrial perturbttins normalized
for sake of visulization. Some of them treated being "visually imperceptible" based the commonty used threshold 8/255 0.D014 for Ex ( ('linf') ) noms, QQadAAtacK fails using a model for a K le.g. topK=25 for DenseNet121), we loave blank. For the benign image, the top 30 predictions by the four models respectively are:
ResNet50; redibank. suddy cumstone, red backed sandpiper, dowischer, oystercascher, grey whale. red breasted merganser.
lion, chainlink fence. lakeside, wreck. quail, parttidge, screwdriver.
plastic bag, pelican, garachute, killer whale, siphur-crested cockatoo, African creendile, white stoek, pole, hacket, caldron, humminghind, sandbor, king parguin, nail syringe.
DenseNet121: redshank, rıdy tamistone, red-backed sandpipes, aystoratchher brcakwates, dowitcher,
academic gown, abaya, mortarhaaed, red-breasted merganser, lifshost, cleak, expresson
lipstick, theoter curtain, wood rabbit, umbrella, refrigeratur, rufied grouse, king penguin, purridge, sandbar, dismondback, hem of the woods, wine bottle, muilbus, stone wall, volcamo, relbone.
sam, aplary, wall clock, mask, snow leogard, schipperke. potter's wheel, lycaenid, mad tuttle, corty-zonted retriever, dumbbell, televasion, strainer, feather bes. buckle, junco, boa constrictor, volcano.
VIT-B: redsbunk, bucked sandpiper, ruldy urnsiome, dowischer. eystercticher water ouzel, Madagascar
mergamer. Tibetan mustiff, cicuda,
egret.
DEIT-B: redstank, roddy tumatone, red- backed sandpiper, dowitcher, oystercutcher, red-breasted merganser, warthog wonn Fence, elophaat. African crocodile, maze, badges, stowplow, American blck hear, stone wall, king pengain, wheel, rock python, water owzl, guilloine, wild bear, comipode, diamondrack, opiary, haroow homed viper, sundial, guenon, bustend, skonk.
18

---

Rising ttack
harignog degpled
DOONS 15
15
XIT
Int-- DOC
1nf-0 0257
0460
A-t- 0244
R 09:6-
DEIT
10F- 11:000173
LEF:0021
MI:00000
Figure RisingAttacK examples of adversatial examples and asocciated perturbations learned for benign image (LSVRC2012 val. 00002266 with the ground truth label, dogsi ad) using seed=52 Appendix
onder uzuteh,, rabbit, pa prissn, jägesw pusxle, joystlikk, space Junbeeni1l, Hest Highland white Lusziee, Bogli aal ape ingees, spindle, lut. pou, African hunt ing dog, beaver, loggechead, Cacdigan, Losch, radion radion celescope, strambeesy, beagle, chain, dalnatian, Liges,
madovaly sumpled targets
botlle, mwillot, pang pang ball, bigharn, hard dise, analug clouk, hair-slide, parachute. The alversuial pertrrations are nommliized to (0, I] for the sake of visuaiication Some of them are trested as being "visully impercpptibl" based on the commonly used threshold 8/255 0.0314 for ('liff) norms, For benign image, up- predictions
models respectively
ResNet50: dogsled, Eskimo dog, bobsied, Lbizan bound, Labrndoe retriever, EnsleBucher, beagle, Weimaraner, Greater Swiss Mountain dog. bloodhound, stretcher. Cardigan, Walker hound, redhone. Leouberg, Siberian busky, Englisha foxhound, Chihuabua, shovel, Bernese mountain dog. malinois, mask, groenesdael, Chesapeake Bay zetriever. cury. coated retriever, drum, cocker spaniel,
setter, Saluki, cowhoy lot.
DenseNet121: dogsted, hoard, Chesapeake Bay retriever, Americae Staffondshire temier, whipget, Weimornner, bobsled, vissa, snowmoblle, drum, malinois, Rhodesiae ridgchack, Saluki,
dug. ski, Labrador retriever, mountuin Irish lerrier, tnyshop, shovel, muzele, ski mack dingo, alp. Irish wollhound. Greaser Swiss Mountain dog. Britany sponiel, hog. Staffomsshie bulleerrerr, Siberian
busky.
VTT-B: dogsted, Thizan hound, Eskimo dog, American Staffonlshire verrier, whippel, Greater Swiss Mountain snowmshile, EatleBocher, buxer. Suluks, bobsled, Siberian husky, Nurfolk terrier.
Stafordshire buliterrier, basenji, Great Danc, Khodesian nigeebukk, Irish ternier Beitaay spaniel. Tibetan terrier. Chihnabua, muzzle, vizsia, beagle. rubby ball, Walker hound. Norwich terrier, Italisa
greyhound Cardignn, Weimaraner.
DETT-B: dogslad, Fikkim dog, FatleRucher, Thizan hound, whipper, Chilushua Weimamnerr Siberian busky, beankin, Crnaater Swise Mountain Italian greghound, hohsled, munhole cover, baggle snowmoblle, coffoeper, scabbont. caple, langur, wing, espeesso, stehhssappe, mattarbord, dingo, cowhay pigzy bank, carpenter's kit, hesenji, zucehini.
19

---

Rising ttack
hornigroog dogpledd
Dogrle 15
Feekerto
Br 0063
tspk-25
LeÉ DISTO
LNI-D 10210
XITBB
Int-o COCODO
BFT 0305
1nf-00516
0770
I-I-O 0015
DEM-
Ire:00514
Figure 5. QuadAttucK examples of udvensarial examples and associated peturbutions leamnd for benign image w1S.V/RC20122...000000000 with the ground cruth label. dogslod) using randemly sampled targets (see Junbeenill, Hest, Highland white Lereles, Buglish spging spindle, hut pou, Afrisan hunt ing dog, beaver, loggeshead, Cardigan, Luzch, radao lelascope, atraxbsecy, beagle, chain, dalnetian, Ligez, bows bottle, swillot, pang pang ball, bighorn, hasd diac, analug clock, bair-siide, parachute. The advensnial pertarbations nommilized to (0, for the sake of visualization, Some them trented being "visually impercaptible" based on the commonly used threshold 8 8/255 0.0314 oo ('lin)) nomms If QunlAAtacK fails using model for K' (eg. lopK=15 for DenseNatl1), we leave blank. For the benign inage, the top-30 peodictions by the four models respectively
seed=52 Appendix D) in order crutch, wood-rabbit, prison, 1iqgexx-puziic, jaystick, spaco-bar,
ResNet50: dogsled, Eskimo dog, bobsled, Ubizan bound, Labrudor retriever, EmtleBucher beugle, Weimaraner, Greater Swiss Mountain dog, bloodhound, stretcher. Cardigan, Walker bound, redbone.
Leonberg, Siberian busky, English foxhound, Chihuabua, shovel, Bernese mountain dog, malinois, ski mask, groenendael. Chesapeake Bay retriever. cudy couted retriver, drum, cocker spaniel, Gerdon
setter, Saluki, cowbay hot.
DenseNer1l1: dagsled, Ihizan hoard, Chesapeske Bay American Staffondshie temier, whippet, Weimarneer, bobsled, vissa, snowmobile, drum, malinois, Rhodesian ridgehack, Saluki, Eskimo
dog, ski Labrador retriever, mountán teni, Irish terrier, tysshop shovel, muzde, ski mask, dingo, alp, Irish wolthound, Greaser Swiss Mountain dug. Brituayy spaniel, hog. Suffimdshire bulkerrier, Siberian husky.
VTT-B: dogsled, Ihizan hound, Eskime dag, American Staffordshire terrier, whigpet, Greater Swiss Mountain dag, snowmobile, EarleBuches, bover, Saluka, bobsled, Siherian husky, Norfolk terrier,
buliterner, baseaji. Great Danc, Khodesian nigebbckk, Irish tenrier Brimtay spaniel, Tibetan ternier, Chihuatua, muzzle, vizsia, beagle. rugby ball, Walker hound, Norwich tenier, Italiaa
prey hoyd,, Canligan, Waimaraner.
DETT-B: dogsted, Fakimo dog, FatleRucher, Thizan hound, whippot, Chilushus, Weimamner, Siberiun bucky, heankkin, Cinaater Swiss Mountain dog. Italian greghound, hobsled, munhole cover, heagle,
snowmoblle, coffeeper, scabband, hald cagle, langur, wing, expeesso, stchosoope, martalvarr, dingo, suit, cowhay hot, pizzy bonk, carpenter's is kit, hasenji, encchini.
20


Reviews:
[{"review_id": "ZrfOJXl4eQ", "reviewer": "Reviewer_ubo3", "summary": "The paper introduces a new method for generating ordered top-K adversarial attacks. The authors use Sequential Quadratic Programming (SQP) to solve the optimization problem behind top-K adversarial attacks directly in the image space. After adapting the SQP algorithm to make the computation tractable and avoid high $\\ell_infty$ norm, they derived a method called RisingAttacK that outperforms the previously state-of-the-art method QuadAttacK on ImageNet-1k. The new adversarial method provides insights on the nature of the adversarial attacks, they are linear combinations of the right singular vectors of the attack-targets-ranking constrained logit-to-image Jacobian matrix.\n\n## update after rebuttal\n\nThe authors answered the questions that I had about the two claims that I identified in the paper. Concerning C1, the authors did some preliminary experiments to address my question and are willing to \"re-run all the experiments with time complexity recorded for a full-scale time complexity comparison between the two methods in revision\". I am satisfied with the answer to my question about C1. Concerning C2, the authors agreed with my remark that the claim is misleading and suggested to change the title of the paper as a consequence. The rephrasing of the claim makes it less strong, the claim \"Adversarial Perturbations Are Linear Combinations of the Right Singular Vectors of the Attack-Targets-Ranking Constrained Jacobian\" was an interesting theoretical claim about adversarial attacks. While I appreciate that the authors took into account my remark, the fact that the original claim was misleading and will be rephrased impact the message of the paper. \n\nOverall, I am satisfied with the authors' response and have decided to change my score from 3 to 4.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer ubo3,\n\nThank you very much for your valuable comments and efforts. We address your concerns one by one as follows, which will be carefully updated in revision. \n\n### C1: Report the time complexity of an iteration of RisingAttacK and that of QuadAttacK \n\n> Thank you. We report the **average seconds/iteration** using a batch of 32 images over 30 iterations on a single A100 GPU as follows, \n| $K$ | QuadAttacK | RisingAttacK |\n| :----:| :----:|:----:|\n| 1 | 1.31 | 1.38 |\n| 5 | 1.17 | 0.83 |\n| 10 | 0.95 | 1.57 |\n| 20 | 1.30 | 2.8|\n| Avg| 1.18 | 1.64 |\n\n> We note three aspects, \n\n+ For both methods, the time complexity of an iteration is not necessarily monotonically related to $K$. It reflects the complexity of the underlying QP to be solved, which in turn is affected by the the sheer challenges of the randomly sampled top-$K$ attack targets for different $K$'s and different images.\n+ On the average (32 images over 30 iterations), our RisingAttacK is more computationally expensive than QuadAttacK. With the significantly improved performance by our RisingAttacK, the increased time complexity seems to be reasonable.  \n+ We will re-run all the experiments with time complexity recorded for a full-scale time complexity comparison between the two methods in revision.\n\n### C2: Could you clarify the claim of the paper \"(…) ordered top-K adversarial perturbations can be expressed as linear combinations of the right singular vectors (corresponding to non-zero singular values) of the attack-targets-ranking constrained logit-to-image Jacobian matrix.\" ? The iterative nature of the method seems to make the interpretation of this right singular vectors more difficult.\n\n> Thank you for pointing this out. We agree with you that the iterative nature of our RisingAttacK indeed makes the interpretation not precise. \n\n> We propose to change the title to ``*Adversarial Perturbations Are **Formed by Iteratively Learning** Linear Combinations of the Right Singular Vectors of the Attack-Targets-Ranking Constrained Jacobian*\", as well as all the related statements in text. \n\n>> We would like to continue to highlight the observation of \"*Linear Combinations of the Right Singular Vectors of the Attack-Targets-Ranking Constrained Jacobian*\" in solving Eqn.18 at each iteration, which we think provides useful insights for understanding adversarial perturbations directly in the image space.", "claims_and_evidence": "There are two main claims in the paper: \n1.\t\"(…) ordered top-K adversarial perturbations can be expressed as linear combinations of the right singular vectors (corresponding to non-zero singular values) of the attack-targets-ranking constrained logit-to-image Jacobian matrix.\" \n2.\t\"Our RisingAttacK significantly outperforms the previous state-of-the-art approach, QuadAttacK, consistently across all top-K (1, 5, 10, 20, 25) and four models (ResNet-50, DenseNet-121, ViT-B and DEiT-S) on ImageNet-1k in experiments.\" \n \nThe first claims provides a valuable insight on the structure of a top-K adversarial attack by defining the low dimensional ($O(d)$) manifold it belongs to. However, given the iterative nature of the method, the adversarial perturbation after reaching the iterations budget is actually a linear combination of the right singular vectors of A (attack-targets-ranking constrained logit-to-image Jacobian matrix) evaluated on the adversarial image generated by the previous iteration. This make the subspace to which the adversarial attack belongs to hard to interpret as it depends on the adversarial attack obtained in the previous iteration.  \n \nThe second claim is clearly supported by extensive experiments on different iteration budgets and datasets.", "methods_and_evaluation_criteria": "The choice of architectures and dataset makes sense. The FoM metric gives a nice overview on how methods compare in different scenarios. The authors say that they compare attacks under the same computing budget for fair comparison. However this computation budget is measured by the number of iterations performed by the method. To ensure that the number of iterations is a good proxy for computation budget, it would have been valuable to provide the time complexity of one iteration for each method or eventually an empirical measurement of the compute time and memory required.", "theoretical_claims": "na", "experimental_designs_or_analyses": "See \"methods and evaluation criteria\"", "relation_to_broader_scientific_literature": "This work is part of the larger family of work on adversarial attacks. Earlier work mainly focused on perturbing the top-1 prediction on a neural network. In this work the authors studied the case ordered top-K attack. Top-K attacks have been introduced by Zhang and Whu [1], Paniagua et al.[2] improved the attacks method using quadratic programming. The authors build upon the method of Paniagua et al.[2]. \n \n[1] Zhang, Zekun, and Tianfu Wu. \"Learning ordered top-k adversarial attacks via adversarial distillation.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops. 2020. \n[2] Paniagua, Thomas, Ryan Grainger, and Tianfu Wu. \"QuadAttac $ K $: A Quadratic Programming Approach to Learning Ordered Top-$ K $ Adversarial Attacks.\" Advances in Neural Information Processing Systems 36 (2023): 48962-48993.", "essential_references_not_discussed": "na", "other_strengths_and_weaknesses": "na", "other_comments_or_suggestions": "na", "questions_for_authors": "•\tWould it be possible to report the time complexity of an iteration of RisingAttacK and the time complexity of an iteration of QuadAttacK ? Or alternatively, evaluate empirically the time necessary to run both methods ? This is supported by having fair comparison between methods (see \"Methods And Evaluation Criteria\"). \n•\tCould you clarify the claim of the paper \"(…) ordered top-K adversarial perturbations can be expressed as linear combinations of the right singular vectors (corresponding to non-zero singular values) of the attack-targets-ranking constrained logit-to-image Jacobian matrix.\" ? The iterative nature of the method seems to make the interpretation of this right singular vectors more difficult (see \"Claims and Evidences\" for more details)", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "j1cuQpW244", "reviewer": "Reviewer_69zR", "summary": "In this work, the authors propose an ordered top-K targeted white-box attack called RisingAttacK by solving the non-linearly constrained optimization problem in image space under the sequential quadratic programming framework. Experiments on ImageNet-1k dataset validate the effectiveness of RisingAttacK.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer 69zR, \n\nThank you for valuable comments and efforts. We address your concerns one by one as follows. We will carefully update those in the  revision. \n\n### C1: I cannot figure out why we need the top-K targeted attack. Can you provide any practical scenarios or its benefits compared with targeted/untargeted attacks?\n\n> First of all, targeted attacks can provide better controllability for adversaries against untargeted attacks, and are a harder problem to solve, as widely recognized in the literature. \n\n> For targeted attacks, in terms of how precisely and how aggressively we could manipulate the outputs (i.e., the entire logits) of DNNs, there are three different settings with increasing difficulties to achieve: (i) conventional top-1 targeted attacks, (ii) unordered top-$K$ targeted attacks ($K\\geq 1$), and (iii) ordered top-$K$ targeted attacks ($K\\geq 1$). We focus on (iii) in this paper. \n\n> From top-1 to top-$K$ (unorder or ordered), as pointed out in (Zhang & Wu, 2020), the robustness of attack methods themselves  should be investigated. For example, a top-1 targeted attack may be viewed successfully (e.g., from a cat image to a dog prediction), the ground-truth label (cat) may still be the top-2 or 3 prediction, which will be less effective in terms of top-k (e.g., top-5) accuracy metric. So, top-$K$ attacks, especially with a large $K$, can ensure the ground-truth labels will be pushed sufficiently away. \n\n> Between unordered top-$K$ and ordered top-$K$, as pointed out in (Paniagua et al., 2023), there are two scenarios in practice, ordinal examples and nominal examples: \n>> ``Imagine a cancer risk assessment tool that analyzes 2D medical images (e.g., mammograms) to categorize patients’ cancer risk into the ordinal 7-level risk ratings ([Extremely High Risk, Very High Risk, High Risk, Moderate Risk, Low Risk, Minimal Risk, No Risk]), An oncologist could use this tool to triage patients, prioritizing those in the highest risk categories for immediate intervention. An attacker aiming to delay treatment might use an ordered top-3 adversarial attack to change a prediction for a patient initially assessed as Very High Risk. They could target the classes [Moderate, Low, Minimal], subtly downgrading the urgency without breaking the logical sequence of risk categories. An unordered attack, in contrast, might lead to a sequence like [Low, Very High, Minimal], disrupting the ordinal relationship between classes. Such a disruption could raise red flags, making the attack easier to detect.\"\n\n>> Please see page 2 for the nominal examples in (Paniagua et al., 2023), due to space limit, we can not quote those examples here.\n\n> Similar in spirit to the ordinal and nominal examples provided in (Paniagua et al., 2023), learning ordered top-$K$ targeted attacks could find practical applications such as for the recommendation systems  (that often recommend a number of items in a particular order) and the retrieval systems (that often return ordered retrieved items). \n\n> More related to computer vision applications,  APIs such as Google Cloud Vision, Microsoft Azure Computer Vision, Amazon Rekognition, and IBM Watson Visual Recognition, often return ordered top-$K$ (e.g., 10) predictions about input images, for which  ordered top-K targeted attacks could be studied. \n\n### C2: It is not clear how you solve Eq. (25). Which optimizer do you adopt?\n\n> Thank you. As stated in lines 340-341: ``We show that Eqn. 25 has a closed-form solution (see the proof in Appendix C), reproducing the result in Eqn. 18.\". So, we do not need an optimizer to solve it. \n\n### C3: The proposed holistic figure of merits (FoM) metric seems to be limited. It is constrained with a single baseline. How could I calculate it with multiple baselines?\n\n> Thank you. The propose FoM is for pair-wise comparisons. For comparing a method 1 against other methods (2 to M), there are three possible extensions: \n+ We may simply compute $mean_{j=2}^M FoM(1, j)$, similar in spirit to the mean Average Precision (mAP) that is widely used in object detection for comparing accuracy across multiple categories and across multiple IoU thresholds. \n+ We may further consider: (i) the strict $\\text{FoM} = \\frac{\\text{ASR}^1}{\\max_{j=2}^M(\\text{ASR}^j)}\\cdot \\frac{1}{3}\\cdot \\sum_{p\\in \\{1, 2,\\infty\\}}\\frac{\\min_{j=2}^M\\ell_p^j}{\\ell_p^1}$, to show how well the method 1 performs against the best of the rest in terms of every aspects (ASR and three norms), and (ii) the  average $\\text{FoM} = \\frac{\\text{ASR}^1}{mean_{j=2}^M(\\text{ASR}^j)}\\cdot \\frac{1}{3}\\cdot \\sum_{p\\in \\{1, 2,\\infty\\}}\\frac{mean_{j=2}^M\\ell_p^j}{\\ell_p^1}$", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "Yes, the experimental design is good.", "relation_to_broader_scientific_literature": "RisingAttacK achieves good performance on top-k targeted attack compared with the baseline QuadAttack.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "1. I cannot figure out why we need the top-K targeted attack. Can you provide any practical scenarios or its benefits compared with targeted/untargeted attacks?\n\n2. It is not clear how you solve Eq. (25). Which optimizer do you adopt?\n\n3. The proposed holistic figure of merits (FoM) metric seems to be limited. It is constrained with a single baseline. How could I calculate it with multiple baselines?", "other_comments_or_suggestions": "N/A", "questions_for_authors": "N/A", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U4jVk3IgEh", "reviewer": "Reviewer_D2j5", "summary": "This paper introduces RisingAttack, a novel method for generating ordered top-K adversarial attacks on Deep Neural Networks (DNNs) by optimizing directly in the image space. The method leverages Sequential Quadratic Programming (SQP) to manipulate adversarial perturbations as linear combinations of the right singular vectors of a specially constrained logit-to-image Jacobian matrix. Demonstrated across multiple architectures like ResNet-50, DenseNet-121, ViT-B, and DEiT-S on the ImageNet-1k dataset, RisingAttack outperforms existing methods such as QuadAttack by achieving higher attack success rates and less perceptible perturbations. By addressing both the ordered top-K attack problem and optimizing in the high-dimensional image space, this work enhances the understanding of adversarial vulnerabilities in DNNs.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer D2j5, \n\nThank you for your valuable comments and efforts. We address your concerns as follows and will update those carefully in the revision. \n\n### C1: The reliance on computationally intensive techniques like SQP and SVD may render RisingAttack less feasible for real-time or on-device applications where computational resources are limited. The paper does not sufficiently address the method's performance or feasibility in real-world scenarios, where computational efficiency and the ability to operate under diverse and unpredictable conditions are crucial.\n\n> Thank you. We acknowledge the importance of developing methods that can be deployed in real-world scenarios under various conditions.  \n\n> Both our RisingAttacK and the prior art, QuadAttacK can not achieve real-time attacks yet (please see our time complexity report in addressing the C1 to the Reviewer ubo3).  \n\n> The novelty of our proposed RisingAttacK lies in its ability of learning ordered top-K adversarial perturbations directly in the image space using SQP for the first time to our knowledge, which is crucial for enhancing our understanding of adversarial perturbations and potentially for developing adversarial defense methods.   \n\n> We hope that the deployment aspects of our RisingAttacK, as well as other attack methods,  could be improved gradually when techniques become more mature with better optimizers and engineered implementations. \n\n> We also hope that the current lack of real-time running speed of our RisingAttacK (as well as the prior art, QuadAttacK) is not a factor that negatively impact us and other researchers on investigating rigorous optimization frameworks such as SQP in adversarial learning. \n\n### C2: The effectiveness of the attack largely hinges on the accurate computation of the Jacobian matrix, which can vary significantly depending on the model's architecture and the data, potentially limiting the method's effectiveness in less ideal conditions.\n\n> Thank you. This might be a misunderstanding. The computation of the Jacobian matrix is not approximated. For most DNNs that are fully differentiable and since we are studying white-box attacks, the logits-to-input Jacobian matrix can be exactly computed. For example, we used the `torch.func.jacrev`  [1] in our implementation. So, the Jacobian computation does not limit our method's effectiveness. \n\n> The approximation component in our proposed method lies in the first-order linearization of a DNN (Eqn.6) to relax the optimization problem with highly non-linear constraints to one with linear constraints, as commonly done under the SQP framework.\n\n### C3: The generalization of the method to tasks outside of image classification or to non-visual data remains untested, which may limit its utility in broader applications of AI. Although it outperforms certain established methods, the paper could benefit from a broader comparison with a wider range of adversarial attack strategies to more comprehensively position its effectiveness within the field.\n\n> Thank you. We acknowledge the importance of developing attack methods and testing them for many tasks, rather than image classification.  However, image classification is still the most widely used application task for studying new adversarial attack methods. \n\n> For the ordered top-K targeted attacks studied in this paper, it is still under active research with two previous approaches that we can find (Zhang & Wu, 2020; Paniagua et al., 2023). For practical considerations of conducting experimental comparisons, we follow the prior art to focus on image classification tasks. The reported experimental results are sufficiently comprehensive to verify the effectiveness of our proposed method in our opinion. \n\n> With a forward-looking thinking, our proposed method should have similar potential extensions as methods such as PGD (projected gradient descent) for learning top-1 targeted attacks. We leave those applications for further work, while we are continuing working on improving the efficiency of our current RisingAttacK. \n\n\n---\n[1] https://pytorch.org/docs/stable/generated/torch.func.jacrev.html", "claims_and_evidence": "See strengths and weaknesses.", "methods_and_evaluation_criteria": "See strengths and weaknesses.", "theoretical_claims": "See strengths and weaknesses.", "experimental_designs_or_analyses": "See strengths and weaknesses.", "relation_to_broader_scientific_literature": "See strengths and weaknesses.", "essential_references_not_discussed": "See strengths and weaknesses.", "other_strengths_and_weaknesses": "Strengths:\n1. The approach is based on solid mathematical foundations, particularly the application of Sequential Quadratic Programming (SQP) and Singular Value Decomposition (SVD) to optimize the adversarial attack, ensuring that the perturbations are not just random but strategically effective.\n\n2. It has been tested and shown effective across different types of deep neural network architectures, including both traditional convolutional networks and more recent transformer-based models, indicating its adaptability and broad applicability.\n\n3. The method provides new insights into the susceptibility of DNNs to adversarial attacks, contributing to the broader understanding of model weaknesses and paving the way for developing stronger defensive mechanisms.\n\nWeaknesses\n1. The reliance on computationally intensive techniques like SQP and SVD may render RisingAttack less feasible for real-time or on-device applications where computational resources are limited. The paper does not sufficiently address the method's performance or feasibility in real-world scenarios, where computational efficiency and the ability to operate under diverse and unpredictable conditions are crucial.\n\n2. The effectiveness of the attack largely hinges on the accurate computation of the Jacobian matrix, which can vary significantly depending on the model's architecture and the data, potentially limiting the method's effectiveness in less ideal conditions.\n\n3. The generalization of the method to tasks outside of image classification or to non-visual data remains untested, which may limit its utility in broader applications of AI. Although it outperforms certain established methods, the paper could benefit from a broader comparison with a wider range of adversarial attack strategies to more comprehensively position its effectiveness within the field.", "other_comments_or_suggestions": "See strengths and weaknesses.", "questions_for_authors": "See strengths and weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: One reviewer brought up several claims were resolved during the discussion period. Unfortunately, the other two reviewers barely engaged in the discussion. Upon closer inspection, I believe their concerns to be either answered, unaddressable hypothesizing, or valid concerns of relatively minor importance. As a result, I am inclined to be aligned with the positive reviewer in this case, who gave a well thought-out critique of merits of the paper, and is now happy to accept the paper, based on the authors promise to update the wording around their claims to be less misleading and to finalize the full scale of the additional experiment.
Decision: Accept (poster)