MALT Powers Up Adversarial Attacks
Authors: Odelia Melamed
Gilad Yehudai
Adi Shamir
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Examples
Robustness
Neural Networks
Classification
Adversarial Attacks
Primary area: safety_in_machine_learning
TL;DR: We present a novel adversarial attack MALT (Mesoscopic Almost Linear Targeting), which wins over the current SOTA AutoAttack on several datasets and robust models, while being five times faster.

Abstract: Current adversarial attacks for multi-class classifiers choose potential adversarial target classes naively based on the classifier's confidence levels. We present a novel adversarial targeting method, \textit{MALT - Mesoscopic Almost Linearity Targeting}, based on local almost linearity assumptions. Our attack wins over the current state of the art AutoAttack on the standard benchmark datasets CIFAR-100 and Imagenet and for different robust models. In particular, our attack uses a \emph{five times faster} attack strategy than AutoAttack's while successfully matching AutoAttack's successes and attacking additional samples that were previously out of reach. We additionally prove formally and demonstrate empirically that our targeting method, although inspired by linear predictors, also applies to non-linear models.

MALT Powers Up Adversarial Attacks
Odelia Melamed
Gilad Yehudait
Adi Shamir
Abstract
Current ad adversarial attacks for multi-class classifiers choose the target class for a given input naively, based on the classifier's confidence levels for various target classes. We present novel adversarial targeting method, MALT' Mesoscopic Almost Linearity Targeting, based on medium-scale almost linearity assumptions. Our attack wins over the current state of the art AutoAttack on the standard benchmark datasets CIFAR-I00 and ImageNet and for a variety of robust models. In particular, our attack is five times faster than AutoAttack, while successfully matching all of Attokttack's successes and attacking additional samples that were previously out of reach. We then prove formally and demonstrate empirically that our targeting method, although inspired by linear predictors, also applics to standard non-linear models.
Introduction
Neural networks widely known be susceptible to adversarial perturbations (Szegedy al. [2013]), which are typically imperceptible by humans. Many different papers have shown how to construct such attacks, where adding small perturbation the input significantly changes the output of the model (Carlini and Wagner [2017]. Papernot et al. [2017], Athalye et al. [2018]). To protect from these attacks, researchers have tried to develop more robust models using several different techniques, such as adversarial training using different attacks (Madry et al. 22017J, Papernot et al. [2016], Liu et [2023], Wang al. [2023]).
The current state of the art adversarial attack, known as AutoAttack (Croce and Hein [2020b]), combines several different parameter-free attacks, some targeted and some untargeted. AutoAttack currently leads the RobustBench benchmark (Croce et al. [2020]). which is the standard benchmark for adversarial robustness. Notably, the targeted attacks used in AutoAttack pick the adversarial target classes according to the model's confidence levels and attack the top nine classes, even though CIFAR-100 and ImageNet have many more possible target classes. The reason for attacking only limited number of classes, rather than all possible classes, is computational, as each such attack has a significant running time.
The reason that adversarial examples exist remains a hot topic of debate, specifically, whether is due to the highly non-linear landscape of neural networks rather to their local linearity properties. In Goodfellow et al. [2014], the authors provide several strong arguments for the local linearity hypothesis while presenting FGSM, one-step gradient attack. Following Bubeck et al. [2021], we consider three distance scales around each fixed data point where linearity properties should be studied separately. On the macroscopic scale, neural networks are highly non-linear functions and have very complicated decision boundaries. On the other hand, neural networks with ReLU activation are piecewise linear, and thus at the microscopic scale (in which no ReLU input changes signs), they can be seen as completely linear functions. The third is the intermediate mesoscopic scale, which characterizes the typical distances between inputs their nearest adversarial examples.
"Weizmann Institute of Science, Israel, odelia. me Maeeaaddeeee wein zmann i1 Center for Data Science, New York University, gy2219enyuu edu Weizmann Institute of Science, Israel, adi shami r@wei www.eeimmann.c..
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

At this mesoscopic scale, Bubeck et al. [2021] proved that random networks are locally almost linear, hinting that for adversarial examples, we can use prediction techniques that are motivated by the behavior of linear functions.
In this paper, we present a novel adversarial attack, MALT (Mesoscopic Almost Linearity Targeting), which is five times faster than the current SOTA attack while exceeding its success rate. It uses the common fast APGD attack (Croce and Hein [2020b]) with new targeting algorithm. The basic idea of MALT is that instead of sorting the target classes only by the confidence levels of the attacked model, MALT normalizes the class's confidence by the norm of the row of the Jacobian corresponding to it. This ordering is motivated by the case of linear classifiers that can be fully analyzed, and makes use of the almost linearity of the model at the mesoscopic scale.
Our attack wins over Attocttack on both CIFAR-100 and ImageNet datasets for different robust models from the standard RobustBench benchmark. In particular, in all of our experiments, we show that the MALT targeting algorithm eliminates the need to use any attacks other than APGD: for every image that AutoAttack successfully attacks, MALT also succeeds while reaching several additional images on which AutoAttacks fails. A major benefit of MALT is that on SOTA robust models, our attack runs five times faster than AutoAttack on the ImageNet attack test dataset.
To further support the mesoscopic almost linearity hypothesis presented in Goodfellow et al. [2014] and Bubeck et al. [2021], we demonstrate both theoretically and empirically that our targeting method, though inspired by linearity considerations, also applies to non-lineal models. On the theoretical side, consider the setting of Melamed al. [2023], Haldar et al. [2024] where the data resides on low dimensional manifold, and prove that the network remains "almost linear" at the mesoscopic scale around data points, deducing that the ordering provided by our targeting method is preserved in that scale. Empirically, we demonstrate that models tend to be almost linear close to data points by showing that linear approximation successfully predicts the model's output when taking random or adversarial steps away from a data point.
2 Related Works
Linearity and adversarial attacks The local lincarity of non-linear classifier in the context of adversarial example was first hypothesized for explaining the adversarial examples' existence (Goodfellow et al. [2014]), presenting the successful FGSM attack. Later, multi-step attacks with higher success rates have shown that the standard classifiers. indeed, are not entirely linear in the mesoscopic scale (Madry et al. [2017], Carlini and Wagner [2017]). Local linearity was also researched in the robustness context, finding linearity constraints increases the classifier robustness (Uesato et al. [2018], Sarkar and Iyengar [2020], Qin et al. [2019]) and the attack transferability (Papernot et al. [2017], Guo et al. [2020]).
Targeting methods As non-naive targeting method has yet to be proposed, the FAB attack (Croce and Hein [2020a]) and DeepFool attack MMosavi-Dezzood et al. [2016]) are using a step-wise targeting method to boost the untargeted version of the attack. The step-wise point of view, looking at the microscopic scale, allows assuming linearity, and estimating the best target becomes an easy linear problem. Sarkar and Iyengar [2020] uses the same simple method for linearity- classifiers. Our targeting method implements the same tinearity-based targeting idea but is calculated once at the starting point.
Theory of adversarial attacks The source of adversarial examples has been extensively researched in recent years. Building on Shamir al. [2019], was shown in Daniely and Shacham [2020] that adversarial perturbations appear in random networks. This result was extended to a larger family of networks with random weights (Bartlett et al. [2021], Bubeck et al. [2019, 2021], Montanari and Wu [2022]). In Vardi et al. [2022], Frei et al. [2024], the authors show that the gradient method is implicitly biased towards non non-robust networks. The hypothesis of the data lies in -indiimnsioonll manifold, which the adversarial examples are perpendicular to was suggested in both theoretical (Gilmer et al. [2018), Tanay and Griffin [2016), Melamed et al. [2023]) and applied (Song et al. [2017], Stutz et al. [2019], Shamir et al. [2021]) settings. Melamed et al. [2023] proved that for data that lies on a linear subspace, there exist adversarial perturbations. Their result extended in Haldar et al. [2024] to clustered data.
2

---

3 MALT Mesoscopic Almost Linearity Targeting
The targeted attacks in AutoAttack choose nine target classes to attack, while ImageNet, for example, contains 1000 classes. This is done since the running time of each such targeted attack is long, and attacking each image in the entire ImageNet test dataset for a large number of classes will be cumbersome. Hence, it is extremely important to choose the right nine target classes. Otherwise, the attack may fail on those target classes, while may succeed on other classes that are not chosen.
The naive targeting in AutoAttack chooses the top nine classes sorted by the output of the model, which corresponds to the confidence the model gives to each class. In Figure I, we show two examples of images from the ImageNet dataset which AutoAttack fails, both with targeted and untargeted attacks, while MALT succeeds. For each image x, after finding the adversarial perturbation we divide it into 100 equal parts, namely V; TOo for ....., 100. We plot the network's ' confidence levels for each class N(x + v:) (y-axis) w.r.t the interval = O, ..... 100 (x-axis). The advantage of MALT here is that it allows targeting classes that overlooked by AutoAttack. Before presenting the MALT attack, we motivate by analyzing adversarial attacks in linear models. Additional examples where MALT finds adversarial examples while Autokttack fails can be found in Appendix A.
Toatter
Ypp Scown
YONITe
teed CaSDaOO
Yo Scoce 31
Sead Castace
head casbage
(a)
(b)
Figure 1: Examples of images from the ImageNet dataset that AutoAttack fails to attack while MALT succeeds. The top row shows APGD attack on the target class with the highest logit, and the bottom row shows an APGD attack on the class which MALT finds and succeeds, corresponding to the (a) 18th and (b) 52nd classes with the highest logits. The images are shown before and after the attack, and the change in logits is presented in the middle column.
3.1 Motivation The best target in a linear function
Naive targeting methods consider the top-c classes with the largest output of the model, i.c., the top-c logits (often, for 9), which corresponds to the classes that receive the highest confidence from the model. However, our goal is to find the target class for which its adversarial perturbation the smallest from given data point. In fact, it is not the case in general that the targets with the highest confidence will also have a small adversarial perturbation. For linear predictors, is possible to fully analyze and find the target class with the smallest adversarial perturbation, shown in the following:
Lemma 3.1. Consider linear predictor over k classes of the form F(x) Wx + b where Rd, W E kxd und b E R... Denote the i-th row of W by w, and by F2(x) = (W,; x) + by the i-th output of F for every i. E [ki]. Let x Rdd with arg max; F((xo) = E and denote by (w)) Then, the adversarial perturbation z that changes the label of Xo with the smallest <; I/w, -wel=
-w;=we,No) L2 norm is equal to z = <,(, we) the target class j == argmin; www-
The full proof is deferred to Appendix B. The above lemma states that, for data point xo classified by the linear predictor as class e, the class with the smallest linear perturbation will minimize the term (w. wy.Xo) Note that the term (w; WWW Wt) represents the distance between the output of
well
3

---

the model on class & and class which are the logits that are commonly used in selecting the targets for adversarial attacks. The lemma states that this term should be divided by l|w; well. which corresponds to the norm of the difference between the gradients.
There is intuitive explanation
why this targeting method is optimal for linear predictors. While the term (w,- we, xo) represents the "distance" that the adversarial perturbation should move change the prediction class, the term ||w; - well represents the "speed" at which this change happens. Thus, the fastest way to change the prediction class is to consider the target for which the ratio between the distance and the speed is the smallest.
3.2 Targeting method
We now formalize MALT, which is an adversarial attack that applicable to any model, not only linear. The basic idea is to re-order the target classes using our targeting method, and then employ fast targeted adversarial attack towards those targets.
Consider a classification model over k-classes (e.g., neural network) N IR R*. Suppose we are given data point Xo E Rd classified in class é by N, meaning that é arg (a... (N(x)) (xo));- We look the top E N (c S k)) classes ordered by their output Xp. and for each such class (N(x))); ((V
calculate a score of the form TV [x ( NV (xx))elll We now pick the top a (a S e S k) classes
re-ordered by our score and perform a targeted adversarial attack towards it. The two hyperparameters in our algorithm are c, which represents the number of candidates for which calculate the score, and a, which represents the number of classes we perform a targeted attack towards. The full attack algorithm is presented in Algorithm
Note that to calculate a score for some target class, we need to calculate the gradient of the model on Xg w.r.t this class. For datasets with many possible classes (e.g. ImageNet) would like to limit these calculations. In all of our experiments, we used 100 and a = 9.
We note that our targeting method is compatible with any targeted attack. We empirically found that APGD (Croce and Hein [2020b]) with the default DLR loss performs well across datasets and models, improving the current state of the art AutoAttack (Croce and Hein [2020b]). Full empirical results are in Section
Algorithm MALT attack algorithm
Input: Trained classification model N Rdd + R data point Xo Rd, hyperparameters a, c E N.
set é arg ma..)(I1.....) (NV (NV(x))),
Set CandidateClasses [0, ................................ 0). a list of size
for top e classes i E {1 .kl k} {e} ordered by (N(x))); do
Set AttackScore; I[V (xca 1). (V. (xxa()
(N(xx)) )) (N(x)))
Append (i, AttackScore, to the CandidateClasses list
end for
Sort CandidateClasses list by AttackScore
for class in the top classes of the CandidateClasses list do
Run TargetedAtttack [N, Xo,
if Adversarial perturbation found then
return the adversarial perturbation end if' end for
3.3 Complexity analysis
now calculate the time complexity of MALT with APGD, and compare with the time complexity of AutoAttack. We calculate the complexity in terms of forward and backward passes (i.e., gradient caleulations). We also consider the default hyperparameters of each adversarial attack, e.g., for APGD, perform an attack with 100 iterations.

---

MALT with APGD. Calculating the targeting order takes backward passes, since the corresponding row of the Jacobian is calculated. For the top classes in this ordering, we perform an APGD attack which takes a 100 backward passes and a 100 forward passes.
AutoAttack. We calculate the complexity of each attack separately: (1) Untargeted APGD with CE loss takes 100 forward and 100 backward passes; (2) Targeted APGD with DLR loss attack the top 9 targets, which takes 900 forward and 900 backward passes; (3) Targeted FAB also attack the top 9 targets, runs for 100 iterations and takes one backward, two forward passes for each iteration, in addition to three forward passes for each target. In total, takes 900 backward and 1827 forward passes; and (4) Untargeted Square black- box attack for 5000 steps, which takes 1 forward pass each for a total of 5000 forward passes.
Finally, we sum the total complexity, and use the hyperparameters c = 100, a = 9 for MALT (which are used in our experimental results). MALT takes 1000 backward and 900 forward passes, while AutoAttack takes 1900 backward and 7827 forward passes. Since each forward pass takes approximately the same time as backward pass, we conclude that MALT requires 1900 passes, while AutoAttack takes 9727 passes, which is more than five times faster. In Section 5, we complement this analysis with experiments. showing that also in practice, MALT is on average five times faster than AutoAttack on the ImageNet test dataset.
4 Mesoscopic Almost Linearity in Neural Networks
In the previous section, we defined MALT, which relies on normalizing the output of the model by the magnitude of the gradients. This method motivated by analyzing linear predictor and finding the target class with the closest adversarial example. However, neural networks are highly non- non-linear, and the gradient can potentially change significantly when traversing the trajectory from data point to an adversarial example. In this section, we claim that neural networks behave as though they are almost linear in the mesoscopic scale, in the sense that the norm of the gradient does not change very much when moving from a data point towards an adversarial example. This means that the target classes which MALT chooses attack remain good target classes also when moving away from the attacked data point.
4.1 Almost Linearity for Data Residing on a Low-Dimensional Subspace
In this subsection, we prove theoretically that 2-layer neural networks are almost linear in the mesoscopic scale and in certain directions under the setting where the high-dimensional data lies on a -ow-dimensional manifold. This setting was studied in several works such as Fawzi et al. [2018], Khoury and Hadfield- consider the setting from Melamed et al. [2023], where the authors analyzed two-layer networks, and the data lies on cow-dimeniional linear subspace. All the proofs can be found in Appendix C.
[2018], Shamir et al. [2021]. Melamed et al. [2023]. In particular, we
Model. Our model is a two-layer fully-connected ReLU network N Rd IR with input dimension and hidden dimension m: N(x, W Wi:m) Σm u1:0( (w, x). where a : TR - TK is a non-linear activation, and Wim. (Wi...., Wm). We additionally assume that o is L-smooth and there exists 3 > O such that d'(z) 2 8 for every E IR. An example of such an activation is smoothed version of Leaky ReLU, We initialize the first layer using standard Kaiming initialization He et al. [2015],
}). Note that in standard Kaiming initialization, each u, would be initialized normally with standard deviation of vm For ease of analysis, we fix these weights their standard deviation and only randomize the sign (this was also done in Melamed et al. [2023], Bubeck et al. [2021]).
Le. w, ~ N (o, t1). and the output layer as u, - (m+
Data. Following Melamed et al. [2023], our main assumption on the data is that it lies low dimen- sional linear subspace. Namely, we consider a binary classification dataset VI),.... (Xm= Ur) e Rd x {+1). We assume there exists a linear subspace of dimension e < d such that x; E P for every i.
Loss and training. Given a loss function L X R (e.g. MSE, BCE), we consider the optimization problem: minw En L(ye, N Nx;,, WI:m)), which is optimized using standard gradient descent. For ease of analysis, we assume only the weights of the first layer are trained (i.e. the w,'s 's) while the weights of the second layer (i.e. the u, 's) are fixed at their initial values, this was
5

---

also done in Melamed et al. [2023]. Since we consider trained networks in our results, we will write (x), and omit the Wi.m as an imput to the network.
Mesoscopic local linearity. Following Bubeck et al. [2021], we say that the network N is mesoscopic locally linear at point Xo with ||||| - if if for every v with ||v|| = =(vd) we have:
[ Vx v)ll o V (xx)ll)
We now show an upper bound on the lhhs of Eq. (1) and a lower bound on the r.h.s of Eq. (1) when projecting the gradients the orthogonal subspace which the data lies on. In the following theorems, p means an orthogonal projection on the subspace P-.
Theorem 4.1. Suppose that the network N(x, Wi:)) = Ei= (:o((, x) is trained on a dataset which lies on linear subspace P of dimension f. Then, w.p > I over the initialization for every P. with |v| R and every x E we have that:
log (TT
log (1)
p pa (VN(x) VN v))l 20LR
d
m
Theorem 4.2. Under the same assumptions as in Theorem 4. and that d 2 2 2log (t), wpp > 1- over the initialization we have that:
log
μ (VxN(x))II 2 B. 11
d
Using both theorems, we can prove that the network mesoscopic almost linear in directions orthogonal to the data subspace:
Corollary 4.1. Suppose that the network N(x) = Ei uno w x) is trained on a datasel which lies on a linear subspace P of dimensions E. Let v E P- with [|v| S R and x E P. Assume that 3 3= Q(1), d d == =((d), R = olvd - E) and m = (dd - f), then we have that:
||Tp^ (xxo) (x + v))ll < (VN(x)))]l).
The reason that the directions orthogonal to the data subspace are interesting, is because it is proven in previous works that in those directions, there exist adversarial perturbations, see for example Melamed et al. [2023], Haldar et al. [2024]. This means that if we consider an adversarial perturbation in those directions, the ordering of the target classes from our targeting method should remain approximately the same throughout the trajectory of the perturbation. This is because the norm of the difference between the gradients is not too big, at least compared the norm of the gradient itself.
Remark 4.1 (Assumption in the theoretical part). For the formal statements to work, make several simplifying assumptions. In Appendix C.4, we provide further explanation on the necessity of those assumptions and whether they could be relaxed. In nutshell, most assumption (especially the ones on the activation) are made since we consider a very general setting, where our only assumption on the data is that it lies structure or limit the number of training points. By introducing more assumptions on the data, we could relax our other assumptions.
low dimensional manifold, note that don't It assume a more intricate
4.2 Empirical local linearity
In this section, we study mesoscopic almost linearity empirically using state of the art robust networks from RobustBench (Croce et al. [2020]), and for both the CIFAR 100 and ImageNet datasets. In the first experiment, for each image Xy the test dataset, we consider an e-norm ball in Tose around (with 8/255 and 4/255 for CIFARIO 100 and ImageNet respectively). Our goal is to study how the gradient changes when moving from Xg to a X + v. where v is some direction inside the e-ball.
We use two strategies to choose the direction v. The first is drawing random direction for each image, and the second is the direction of the gradient each image, which corresponds to an adversarial direction. After choosing v we divide it into 100 equal parts, namely v1 100 V, Va
1
100 V. ...., V100 v. We will consider two measures study the mesoscopic linearity:

---

(x VN + vi)ll
VN + v(+1) VN + v.)l
(x())l
part
VN(x))]
Namely, a corresponds to Eq. (1) and measures the total change in gradient norm from Xo until Vo while Opart measure this change but only for consecutive steps. In Figure 2a and Figure 2b we plot or and Opart for all E [100] for both adversarial and random step V. respectively, for the ImageNet Swin-L [Liu et al., 2023] classifier and the CIFAR100 WRN-28-10 10 [Wang et al., 2023] classifier. The experiment details are in Appendix D.I.
CIHARI0D
IMAGENET
CHAR100
IMAGENE
2-
2-
25
90
75
100
25
50
75
100
25
100
25
50
75
(a)
(b)
Figure 2: Measurement of mesoscopic almost linearity experimentally when taking step v away from test image x for CIFAR 100 and ImageNet. The results are averaged over all the images in the test set, where (a) random step; and (b) Direction of the gradient (adversarial step).
It can be seen that for random directions (Figure 2b). both a and Apart are very small for both datasets, and with a very small variance. For adversarial directions (Figure 2a), Oppart still very small, while is larger since it accumulates small deviations from linearity when moving further away from Xg- We emphasize that by Eq. (1), mesoscopic almost linearity means that a oa(1), where is the dimension of the input. In other words, larger input dimension should decrease, or at least not increase, the value of a. In this experiment, the CIFAR 100 and ImageNet datasets have very different input dimensions, namely, d 3072 and d 150528. We see that although the input dimension is almost 50 times larger for ImageNet compared to CIFAR 100, the average value of a nearly the same. This implies that mesoscopic almost linearity also happens in adversarial directions, and it would be interesting to further study how a changes when having even more drastic changes in the input dimension.
In our second experiment, we take small adversarial step and compare the change of the logits of the output of the network and its linear approximation. In Figure 3, for each image Xg, we find an adversarial direction v, which we split into 100 equal parts similarly the previous experiment. For a network N we calculate its linear approximation L at Xg using Taylor's ' expansion, and compare
N(xo + v:) to L(xo + v:). Note that since is a linear function, L(xo + v.) always a straight line when plotting the output for every 1, ... 100. It can be seen that although N(xo + v;) is not necessarily linear, it does closely resemble the linear approximation, which suggests that almost linearity happens in the mesoscopic scale. We note that the logits from Figure lb look less linear than in the figures below. We conjecture that this is because is difficult to find an adversarial example for this image (and indeed, AutoAttack fails to do so). Hence, the network is less linear in those adversarial directions, and such examples are what causes the high variance in Figure 2a. This may require additional investigation, which we leave for future research.
5 Experiments
In this section, we compare the MALT attack (using a standard APGD attack) to the current state of the art AutoAttack. Our comparison is made to be compatible with RobustBench (Croce et al. (2020]), which is the standard benchmark for testing adversarial robustness. Namely, we consider attack CIFAR- 100 (Krizhevsky et al. [2009]) with an l budget of 8/255 and on ImageNet (Deng et al. [2009]) with an E budget = 4/255. We compare the two attacks on several robust models from the top RobustBench benchmark.
For MALT, we consider calculating the score for the e 100 classes with the highest model's confidence and attacking the top = classes according this score. This corresponds to the
7

---

sandal
Image
French loaf
strainer
miniature schnauzer
cattle
orchid
Adversarial Image
Model
Score
hrecch sandal
Y980
Great Dana
Irout
possum
Train
Lihear Approximation
Scor
Heech koaf
miriinur cohouoer
Catte
Sendll
Drcit Dano
peooum
100
300
50 Internal
100
300
50
300
300
Figure 3: Empirical mesoscopic almost linearity: demonstrating the logits changes from an image Xo to its adversarial example. In the third row, plot the model's output logits changes, and in the bottom row are the results of the linear approximation of the model at Xo-
targeted attacks in AutoAttack,, which attempt to attack the top 9 classes according to the model's confidence, All the hyperparameters APGD and the other attacks used in AutoAAtack their default values. Full details for all experiments in this section are in Appendix D.
In Table 1 (CIFAR-100) and Table 2 (ImageNet),, present the results of the experiments. Note that MALT able to attack more images than AutoAttack across all robust models and for both datasets. Also, there is an inclusion of successful attacks in the sense that for every image that AutoAttack successfully attacks, MALT also succeeds. Thus, the improvement contains only images that AutoAttack fails Note that in Table 2, the robust and clean accuracy is not exactly equal to those reported on the RobustBench website since newer versions of the Python libraries use give slightly different results.
Table I: CIFARI00 Loo robust accuracy (lower is better), comparing MALT and AutoAttack, which is the current state of the art.
MODEL.
ROBUSTNESS
ACC.
MALT
SOTA
DIFF
SPEED-UP
WRN-28-10 10 [WANG AL., 2023]
72.58%
38.79%
38.83%
0.04%
3.36 =0.18
WRN-70-16 16 [WANG ET AL., 2023]
75.22%
42.66%
42.67%
-0.1%%
3.87 40008
WRN-28- TO [CUI ET AL., 2023]
73.83%
39.18%
39.18%
0%
3.43 =0.08
WRN-70-16 [GOWAL AL., 2020]
69.15%
36.81%
36.88%
0.07%
3.42 00.09
Table 2: ImageNet- Lox robust accuracy (lower better), comparing MALT and AutoAttack, which the current state of the art.
MODEL
ROBUSTNESS
ACC.
MALT
SOTA
DIFF
SPEED-UP
SWIN-L [Lu AI.,, 2023]
79.18%
59.84%
59.90%
0.06%
5.18 +0.04
CONvNEXT-L [LIU ET AL., 2023]
78.20%
58.82%
58.88%
0.06%
x 5.22 10.1
CONVNEXT-L=* [SINGH AI.,, 2024]
77.02%
57.94%
57.96%
0.02%
4.86 +0.06
SWIN-B [LIU ET AI.,, 2023]
76.22%
56.54%
56.56%
0.02%
5.02 +0.03
CONVNEXT-B+ [SINGH ET AL.. 2024]
76.00%
56.48%
56.52%
0.04%
x 5.00 10.07
8

---

Attack Running Time For the speed-up up column. we first sampled uniformly from the test dataset five batches of size 200 for ImageNet and 400 for CIFARI00, which corresponds to 5 x 4% of the entire test set. We timed both MALT and AutoAttack, when running on the exact same GPU chip and on the same samples, we present the mean and variance of these experiments for each robust model. On the ImageNet dataset there is on average a five times speed up. while for CIFAR 100 it is 3.5 times on average. The lower rate can be explained by the higher attack success rates for CIFARIO0. In other words, the complexity analysis from Section 3 is of the worst case, and since fewer test examples pass through all four different attacks in AutoAttack, the running time is lower.
Integrating MALT with different attacks Our experiments found that MALT operates well across datasets and models with the standard and fast APGD attack. We also integrated MALT with the targeted FAB attack (Croce and Hein [2020a]) as well as with the APGD attack with the CE loss, on the Swin-L robust model (Liu et al. [2023]). Both attacks achieved worse results of 60.64% for the FAB attack and 60.52% for the APGD attack with CE loss, compared to the superior 59.84% robust accuracy using APGD with the DLR loss.
5.1 Targeting analysis
In this subsection, we analyze the targeting mechanism of MALT and whether other targeting techniques could have improved it. In Figure 4, show how the successful attacks are distributed according to the score given either the by MALT or the naive targeting (i.e., according model's confidence). It is evident that the score provided by MALT leans much more towards the top than naive targeting. This indicates that the score provided by MALT has higher correlation with successful attacks than the naive targeting method. Also, since MALT successfully attacks more images for the top targets (achieving robust accuracy of 59.84%, compared to 59.949 59.94% for naive target- ing), the sum over the columns of MALT attacks is larger than that of the naive targeting.
Choosing top k targets
MALT
Nalve Targeting
surcessful sttacks
750
251
Finally, we test whether the choice of 100 is enough, namely calculating the score for MALT only for the top 100 classes sorted by the confidence level of the model. To this end, we ran MALT with = 1000 for the ImageNet test dataset on the Swin-L robust network. Note that the number of gradient calculations for each test image has increased by factor of more than two. This attack reached robust accuracy of 59.84%, exactly the same as 100. This means that calculating the score for the top 100 classes is enough to find the top classes to attack. It may be possible to optimize this hyperparameter even more, although the benefit in running time will be negligible.
The orcer of the targets bested
Figure 4: Comparing targeting methods for Liu et al. [2023] SOTA model: The number of successful attacks for each target order by two targeting methods: In blue, we MALT targeting and APGD, and in orange, we compare to APGD) with top logits targeting performed in AutoAttack.
Conclusions
In this paper we present MALT, an adversarial attack which is based on a targeting method that assumes almost linearity in the mesoscopic scale. MALT wins over the current state of the art adversarial attack AutoAttack on several robust models, and for both CIFAR and ImageNet, while also speeding up the runtime by more than five times. We also present theoretical and empirical evidence that our almost linearity assumption is applied to neural network, in the mesoscopic scale where adversarial examples exist.
There are several future research directions that we think are interesting. First, it would be interesting to further study the mesoscopic almost linearity property of neural networks. In particular, whether this property is affected by (or affecting) the robustness of the network to adversarial perturbations, and the perturbation's 's transfcrability capabilities. Theoretically, it would be interesting to extend our

---

analysis to deeper networks. As for the applied results, good future direction would be to conduct more extensive empirical study of MALT on more robust models and datasets, even beyond the scope of the RobustBench benchmark. Finally, it would be interesting to understand whether there exists better targeting method to find adversarial classes, e.g., using second-order approximation of the network.
References
A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give false sense of security: Circum- venting defenses to adversarial examples. In International conference on machine learning, pages 274-283, PMLR. 2018.
P. Bartlett, S. Bubeck, and Y. Cherapanamjeri. Adversarial examples in multi-layer random relu networks. Advances in Neural Information Processing Systems, 34, 2021.
S. Bubeck and M. Sellke. A universal law of robustness via isoperimetry. Advances in Neural Information Processing Systems, 34:28811 10088811128222 2021.
S. Bubeck, Y. T. Lee, E. Price, and I. Razenshteyn. Adversarial examples from computational constraints. In International Conference on Machine Learning, pages 331-840. PMLR, 2019.
Bubeck, Y. Cherapanamjeri, G. Gidel, and R. Combes. single gradient step finds adversarial examples random two-layers neural networks. Advances in Neural Information Processing Systems, 34, 2021.
N. Carlini and D. Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM workshop artificial intelligence and security, pages 3-14, 2017.
Croce and M. Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International Conference on Machine Learning, pages 2196-21662002 2205. PMLR, 2020a.
F. Croce and M. Hein. Reliable evaluation of adversarial robustness with ensemble of diverse parameter-fie free attacks. In International conference on machine learning, pages 2206-2216. PMLR, 2020b.
F. Croce, M. Andriushchenko, V. Sehwag, F. Debenedetti, N. Flammarion, M. Chiang, P. Mittal, and M. Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020.
J. Cui, 7. Tian, Z. Zhong, X. Qi, B. Yu, and H. Zhang. Decoupled kullhack-leibler divergence loss. arXiv preprint arXiv:2305.1 /3948, 2023.
A. Daniely and H. Shacham. Most relu networks suffer from le adversarial perturbations. Advances in Neural Information Processing Systems, 33, 2020.
Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248 255. leee, 2009.
A. Fawzi, H. Fawzi, and O. Fawzi. Adversarial vulnerability for any classifier. Advances in neural information processing systems, 31, 2018.
S. Frei, G. Vardi, P. Bartlett, and N. Srebro. The double-edged sword of implicit bias: Generalization vs. robustness in relu networks. Advances Neural Information Processing Systems, 36, 2024.
Gilmer, L. Metz, F. Faghri, S. S. Schoenholz, M. Raghu, M. Wattenberg, and Goodfellow. Adversarial spheres. arXiv preprint arXiv: wwXiv:1801.02774 2018.
J. Goodfellow. J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. Preprint, arXiv: 2014.
S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli, Uncovering the limits of adversarial training against norm-bounde adversarial examples. arXiv preprint
2020.
10

---

Y. Guo, Q. Li, and H. Chen. Backpropagating linearly improves transferability of adversarial examples. Advances in neural information processing systems, 33:85-95, 2020.
R. Haldar, Y. Xing, and Q. Song. Effect of ambient-intrinsic dimension gap on adversarial vulnerabil- ity. In International Conference on Artificial Intelligence and Statistics, pages 1090-1098, PMIR,, 2024.
K. He, X. Zhang, S. Ren, and Sun. Delving deep into rectifiers: Surpassing human-level per- formance imagenet classification. In Proceedings of the IEEE international conference computer vision, pages 1026-1034, 2015.
A. Jacot, F. Gabriel, and C. Hongler. Neural tangent kemnl: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018.
M. Khoury and D. Hadfeeld-Menel.. On the geometry of adversarial examples. Preprint, arXiv: 1.0052,, 2018.
A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images. 2009.
B. Laurent and P. Massart. Adaptive estimation of a quadratic functional by model selection. The Annals of Statistics, 28(5):1302 1338, 2000. doi: 10.1214/ass/0115553395 URL https: aos 1015957395.
//dei.org//// http:/0..1111110 //os
C. Liu, Y. Dong, W. Xiang, X. Yang, H. Su, J. Zhu, Y. Chen, Y. He, H. Xue, and Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking. arXiv preprint (3x::33333.23000 2023.
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. Preprint, arXiv: 06083, 2017.
O. Melamed, G. Yehudai, and G. Vardi. Adversarial examples exist in two-layer relu networks for low dimensional data manifolds. arXiv preprint arXiv:2303.0074 2023.
A. Montanari and Y. Wu. Adversarial examples in random neural networks with general activations. arXiv preprint arXiv:2203. 17209, 2022.
S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582 2016.
N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium security and privacy (SP), pages 582-597. IEEE, 2016.
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506-519, 2017.
C. Qin, J. Martens, S. Gowal, D. Krishnan, K. Dvijotham, A. Fawzi, S. De, R. Stanforth, and P. Kohli. Adversarial robustness through local linearization. Advances in neural information processing systems, 32, 2019.
A. Sarkar and Iyengar. Enforcing linearity in dnn succours robustness and adversarial image generation. In Artificial Neural Networks and Machine Learning Learning-ICANN -CANN 2020: 29th Interna- tional Conference on Artificial Neural Networks, Bratislava, Slovakia, September 15-18, 2020, Proceedings, Part I 29, pages 52-64. Springer, 2020.
A. Shamir, I. Safran, F. Ronen, and O. Dunkelman. simple explanation for the existence of adversarial examples with small hamming distance. Preprint, 19X. 2019.
A. Shamir, O. Melamed, and O. BenShmuel. The dimpled manifold model of adversarial examples in machine learning. Preprint, 2rXiv:2106.1015/ 2021.

---

N. D. Singh, F. Croce, and M. Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. Advances in Neural Information Processing Systems, 36, 2024.
Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10770 2017.
D. Stutz, M. Hein, and B. Schiele. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6976-6987, 2019.
C. Szegedy, W. Zaremba, I. Sutskever, Bruna, Erhan, I. Goodfellow, and Fergus. Intriguing properties of neural networks. Preprint, arXiv:/312.6199, 2013.
T. Tanay and L.. Griffin. A boundary tilting persepective on the phenomenon of adversarial examples. arXiv preprint arXiv: /608. (0660, 2016.
Uesato, B. O' O'donoguue, Kohli, and A. Oord. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference Machine Learning, pages 5025-5034. PMLR, 2018.
G. Vardi, G. Yehudai, and O. Shamir: Gradient methods provably converge to non-robust networks. Preprint, arXiv:2202.04347 2022.
Z. Wang. T. Pang, C. Du, Lin, W. Liu, and S. Yan. Better diffusion models further improve adversarial training. In International Conference on Machine Learning, pages PMLR, 2023.
12

---

A Additional MALT Targeting Examples
Following Section to further present the performance of the MALT targeting method, we add more examples of images on which Auto/ttack fails and MALT succeeds. We present such images from the CIFARI00 and the ImageNet datasets in Figure 6 and Figure 5 respectively. As the examples found in Section 3, Figure I, we present two attacks on each image the naively targeted APGD and MALT attack using APGD.
MALT and APGD For all experiments, for the MALT attack, we used a = 9 and c 100, and the default hyperparameters the attack APGD adapted from the official AutoAttack git repository.* Note that we used the APGD attack with the given default DLR loss.
In the upper row, for each image, one second-best confidence level. On the bottom row, we present our successful attack a successful APGD attack toward a target found using the MALT method. The original image is on the left, and the perturbed image is on the right. Between them, we present the change in the model's output logits, starting from the original image and ending the perturbed one.
failed APGD attack toward the class with the model's
Note that in the CIFAR100 dataset experiments, the APGD attack gets random errors due to ran- domization. We count both here in Figure 6 and in Section 5 only images that MALT targets to class not within the naive top nine logits, therefore a clear advantage to MALT, regardless these randomization-resut errors.
foun
Top Score mi)
pusching
Score #15
(a)
(b) Yop Seowe #1
Vip Serww
lab coul
Thp Score
proggonng bull
worbut
Scare
dung Sests
"bapss/gittubb.oo///////aau
13

---

mooggte
kg Scae
mooguuo ret
monqutt
Figure 5: Additional examples of images from the ImageNet dataset that AutoAttack fails to attack while MALT succeeds. The top shows APGD attack the target class with the highest logit, and the bottom row shows an APGD attack on the class that MALT finds and succeeds. (a) and (b) examples from Swin-L [Liu et al., 2023] network. (c) through (e) are from ConvNext-L [Liu et al., 2023] network. The images are shown before and after the attack, and the change in logits is presented in the middle column.
Score
4034
Thp Score #13
Dile
Instrt
Thp Score a1
camts
(a)
Tgp Score
Top Score #1
bos
SR
14

---

Bozwer
Tap Score #1
boSker
Top Score #1
Tip
mV.
reav
coldbr
g
(h)
Ttp score #1s
ii)
Figure 6: Additional examples of images from the CIFAR 100 dataset that AutoAttack fails attack while MALT succeeds. The top row shows an APGD attack on the target class with the highest logit, and the bottom row shows APGD attack on the class that MALT finds and succeeds. (a) through (g) examples from WRN-70-16 [Gowal et al., 2020] network. (h) is from WRN-28-100 10 [Wang et al., 2023] network. (i) is from WRN-70-16 [Wang et al., 2023] network. The images are shown before and after the attack, and the change in logits is presented in the middle column.
15

---

B Proofs from Section
Proof of Lemma 3.1. Consider finding the smallest adversarial perturbation z; for x where the i-th output of F is larger than the E-th output of F. That is, we want to find:
min | s.t. Fx + z.) Fx + z.) > 0
(2)
We have that: (x. + z,) (x6 +2) (w,, Xg + 2,) (We, Xn 2z)- Hence, get that Eq. (2)
is a constraint minimization problem with a single linear constraint. The solution to this problem given by the direction z; x W; we. We can write 2, e:(w; w:) for ej which will be determined later, then we have that:
Fx 2.) Fx(xx z:) = (W,, Xo + 2.) (we, xo + zi))
(Wi, Xo + e:(:W; (ww) (Wz, + +:((w - wx))
(w, - we, + [||;-/ wwwl?
That is, for (W, WWr--W and z; = e we) we have that (x, + z;) = Fi(xo + z;). Note
w. well"
that ||z [w, Iw: well
omit the absolute value the nominator since the constraint in Eq. (2) that it is positive. Finally, finding arg min; ||z||| = arg min;
(w.-w;,x)) provides the class index [[w:-wzl well
with the smallest norm adversarial perturbation.
C Proofs from Section 4
C.1 Proof of Theorem 4.1
Proof. Using Lemma C.1 we can assume w.l.o.g that P = span(e1.... cu-e). Denote by w == Tp (w) the projection of w on the subspace P-, By Lemma C.2 we get that the weights w; did not change from their initial value for any E [1,...,m].
We will now calculate the gradient of the network w.r.t the data. For ease of notations we drop the Wmmm the input of the network.
vxN(
Σ u. Now,o'(w,T
Thus, we want to bound the following:
m
m
Ip
Σ
(w, Σ
uw. (x
Σ u. (o'(w, o' (w, x x
m
Using that ||w|| = =SUPusgu- w T u, it is enough to bound the following for any u E gd-1,
m n.w. (a'(w, x) o'(w, x v))
Σ
We will now use Bemsstein inequality on the above sum. d'w x v)). then we have that:
Denote
X;
u, w u (o'(w] x)
L
L
E| 9 < maf2
[w
v
V Ell 11120. Bll v
m9/2
[RR)
(LR)²
(2g - 1)!! < g! (LR)²
E
[ < (d
(d
m/ (0.1)
2 (d 2)
16

---

2 2oog (1) where we used that a is L-smooth, and the assumption on the initialization of w, and Note that the above true for every u 1d hence by Bernstein inequality with (d-t)ym
LR have w.p
8 over the initialization:
Σ w. (o'(w, d' d'(w, d'ww, v\)
LR
log (
(
log (1) m
- - e
8)
Denote by Ω = v) || - Rvv, J. we will now bound Eq. (3) uniformly over f2 Denote by Φ v) : Em u, (o'(w, x) o'w, x v)). We define an c-net over
for e be chosen later, denote this net by Mc. The size of the Me is at most (z d-t ( and have that:
sup ( v) < sup (u,v)En
Φuu, v) +
sup (u.)). ll llvvllls
(uu,, v) - D('', v')l
(,,v)E
To bound the first term of Eq. (5) we union bound over all of Mc, and by Eq. (4) have w.p
> 118: 8:
LR
log (2) log (1)
(d E) log (1) + log (1)
sup (u,))EM,
6( v) S
d (d
8
1+
m
(6)
For the second term in Eq. (5), note that for any u, u', v, v':
- T('', v)1 ||u
u'll
/wall
mm
1=1
LR ||v v'll
m
D(u, v\1
|/
m
|w/l is scaled chi-squared distribution with d degrees of freedom. By Lemma 1 in Laurent and Massart [2000] we have w.p > 5 that:
Note that E
m
m log (1) d- l
Σ
W. S m + 2/
+ d
Combining the above, and taking
m get:
log 8
2 2
sup (u.v),(u' (").e. ||+ [+ll--/vvll |s (bu v) o('', v\1 < LR
21
+
vm
d
(d - f)
Plugging this into Eq. (5), while choosing 8' finishes the proof
C.2 Proof of Theorem 4.2
Proof. Denote by w TT (w) the projection of the subspace PL, We have that:
m
p (VxN(x))I
Σ
u. (w, x)
Σ
W
m
Using Lemma C.1 can assume w.l.o.g that P spanfei,.... ed-e). By Lemma C.2 get that the weights w; did not change from their initial value for any E (1...., m). Hence, w; (o, 11) for every i, then E w; ~ N (0, 1)). By Lemma in Laurent and Massart [2000] w.p - 8 we have that:
m
log
W
2 m 21
17

---

Combining the two displayed equations yields:
log
(VxNx())
21
d
C.3 Additional Lemmas
The following the lemmas are taken from Melamed et al. [2023]. and used to assume w.l.ogg that P = span(ei..... Eu-e). and that the weights of the neurons projected on p- do not change during training. We provide them here for completeness".
Lemma C.1. [Theorem A.l from Melamed et al. [2023]] Let PCP' ad be a subspace of dimension d - l, and let M span (p.......... ..d.....,....... (d
Let R be an orthogonal matrix such that R P P M, let X). Assume we train a neural network (x) Zi=1 u.o(v (w, x) as explained in Section 4, and denote by N and NXR the network
X C be a training dataset and let Xn {R x:
trained on X and Xa respectively for the same number of iterations. Let X1, X2 E P, then we have:
W.p. p (over the initialization) we have
[Tp-
(ONN(XI) (x1)
2 crrepp. S for some e E TR
Ox
iff w.p. also
[M
(ON (Rxa))
2 (resp. S c).
8x
2. W.p. p (over the initialization) we have
[pp
(x1)
IIp
(ON~
2 (resp.
ONN <NN*R x((x))
(ON TaN (R
S c) for some R, iff w.p. p also
II
Ox
Ux
(resp. Sc).
Lemma C.2 (Theorem A.2 from Melamed et al. (2023]). Let M = spanter,.... ed-e). Assume we train a neural network N(x, Wim) = Emh u:00 (w x) as explained in Section (where Wi:m = (wi,.... Wm)). Denote by W == Tas (w) for w Rdd, then after training, for each i [m]. w; did not change from their initial value.
The following Bernstein lemma, adapted from the phrasing of Theorem 3 in Bubeck et al. [2021].
Lemma C.3. Let for 1,...,m be i.i.d random variables with zero mean, such that there exists e > 0 that for all integers 2 we have:
g!c² 2
E [X 1
Then, w.p 1 - 8 we have that:
X.S
2o2klog
+ clog
C.4 Assumption the theorems
Here we discuss the different assumptions made in the formal proofs, and where they are used. We separate between the assumption the activation, and the assumptions the parameters made in Corollary 4.1.
Assumptions the activation. The assumption that the activation is L-smooth is used in the proof Theorem 4.1 to bound the difference between the gradient at different points. Bubeck and Sellke [2021] generalize this result the ReLU activation, however they assume that the data point are drawn randomly from a Gaussian. The reason for such an assumption is to bound the number of neurons which change the sign for ReLU networks. In our case, since don't 't assume random data points, the number of neurons that change sign depends on the data, and the neurons w,, which during
'The second item of Lemma C.I does not appear as is in Melamed et al. [2023], but proved in the exact same way as first item.
18

---

training with gradient descent also become dependent on the data points. Thus, the generalization from Bubeck and Sellke [2021] is not applicable in our case.
The assumption that the derivative is lower bounded by some constant is used in the proof of Theo- rem 4.2. There, the norm of the gradient be bounded more generally by the term _i=1 a'(w, x)² Again, note that each neuron w; depends on the data that the network trained on. Hence, if a is not lower bounded, even at single point, then o' ('W,, x)² be very close zero for every i, and thus the bound becomes vacuous.
Both assumptions can be relaxed by adding more assumptions on the data. For example, if assume that the data is drawn randomly from a Gaussian, then we could use similar arguments to those used in Bubeck et al. [2021] generalize these results. Another possible direction is to assume over-paramettrrizaion,, i.e. the number of neurons much larger than the number of samples. In this case, it is possible to analyze these results in the NTK regime Jacot et al. [2018].
Assumptions in Corollary 4.1. Here, besides the assumption on the activation, we additionally have assumptions the parameters of the problem. We explain in details the interpretation of each assumption:
1. d - f- (d). This assumption means that the dimension of the orthogonal subspace to P is large enough. Such assumption is also needed in Melamed et al. [2023], Haldar et al. [2024]. since the analysis of adversarial perturbation is made inside the subspace P+, which needs be large enough.
2. R=
R=o(vd o(Vd f). This just means that the perturbation is not too large. This is equivalent to saying that we focus on the mesoscopic scale, i.e. where the network is non-linear, but still behaves as it is almost linear.
3. l2dd f). This assumption is used since the bound on the gradient depends both on the input dimension, and the number of neurons. This assumption can be interpreted as the number of neurons cannot be much smaller than the dimension of the subspace p- on which the adversarial perturbations exist.
D Experimental Details
D.1 Experiments from Section 4.2
In Figure 2, for an image Xy in the test dataset, we create perturbation vector v of norm = 8/255 or 4/255 for CIFAR100
ImageNet datasets respectively, with respect the L norm. The models considered are the ImageNet Swin-L [Liu et al., 2023] classifier and the CIFARI00 WRN-28-10 [Wang al., 2023] classifier.
We consider two different choices of such v:
Random direction: we start from a random v ~ U (f=)))" This randomization is common for adversarial attacks.
2. Gradient direction: we calculate the gradient of the network w.r.t. the input at Xo. VxN((x)) and normalize it to be of norm e.
In both cases, we then truncate to the input domain so that x would not exceed 11 in each coordinate.
We divide to 100 equal parts, namely vi v, V2 calculate:
2 T0o V. ..... V100
For each i,
|xN(xx) VN(xo v.)ll
| + Veti) VN +v)l
[
O'purt
[NN(x))
For each i, we take average and mean over all the test datasets, viewed in Figure 2.
19

---

D.2
Experiments from Section 5
We use the same e budget for all experiments 8/255 and 4/255 in Loo norm for CIFARI00 and ImageNet datasets, respectively.
D.2.1 Robust Accuracy Experiment Details
AutoAttack For all experiments, if needed, we run AutoAttack with its default hyperparameters taken from the RobustBench git repository." For the CIFAR 100 dataset, we took the clean and robust accuracy results directly from the RobustBench website. For the ImageNet dataset, we noticed that even the clean accuracy of the networks changes when using different versions of the Pytorch library, This clearly affects the robust accuracy of the networks since misclassified test images are considered their own adversarial examples. Therefore, we re re-calculate the clean and robust accuracy for all considered networks, presenting the results of our execution.
MALT and APGD For all experiments, for the MALT targeting method, we used a 9 and e = 100, and the default hyperparameters of the APGD attack, adapted from the official AutoAttack git repository." Note that we used the APGD attack with the given default DLR loss.
Our attack uses an APGD attack within it; therefore, it suffers from common issue of randomization in the CIFAR 100 executions (also mentioned in Appendix A). Consequently, we ran these experiments five times for each model examined and took the best value avoid these sandomization-resulee errors.
General execution details For the CIFAR100 robust classifiers, we execute the attack batches of 200 samples each and 50 sample batches for the ImageNet classifiers. All the weights for all the classifiers were downloaded directly from the RobustBench git repository. All experiments were done using a GPU Tesla V-100, 16GB.
D.2.2 Running Time Experiment Details
In this experiment presented the rightmost column of Table and Table 2, we sample five independent image subsets for each dataset, consisting of 400 and 200 images from CIFAR100 and ImageNet datasets, respectively. For each sample, we run both AutoAttack and our attack on entire sample and measure the attack running time. Later, for each network, we calculate the mean and standard deviation over all five samples. The CIFAR100 attacks ran all GPUs of Tesla V-100, 16GB. The ImageNet attacks ran 3 GPUs of Tesla V-100, 16GB. Of course, for each network, both attacks were executed one after the other using the exact same computing power.
D.2.3 MALT and FAB Details
For this experiment, we take the same 9 and 100 hyperparameters for MALT and take FAB implementation from the official AutoAttack git repository, with all its default hyperparameters.
D.2.4 Targeting Analysis Details
For the analysis of the targeting capabilities in Figure 4, we ran two attacks:
1. MALT and APGD, with the same a = 9, c = 100 hyperparameters
2. APGD attack with naive targeting to top 9 targets, as it performed in the targeted version of APGD within AutoAttack.
We observe the number of successful attacks for each targeting method and for each ordered target suggested. For naive targeting columns, the targets are ordered by the corresponding class confidence level given by the model. For the MALT columns, the targets are ordered according to the MALT algorithm.
"https//githubbco bbuts///iittbb.om//oouueeeeeeeee http://hwbb..mmooooooeeeeebbbbee https://gituub.co/////////a/ attack
20

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: We present our attack algorithm in Section 3, its theoretical justification and applied evidence in Section 4, and its winning experimental results in Section 5.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: For the teoretical limitation, we include the theoretical limitations and as- sumptions in Remark 4.1, and elaborate about it in Appendix C.4. For the applied results limitation, we mention the subset of classifier examined, particularly not being the full set. We thoroughly discuss the time complexity in worst-case Section and empirically in Section 5.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
21

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: We include the theoretical limitations and assumptions in Remark 4.1, and elaborate about in Appendix C.4, Full proof of Lemma 3.1 are Appendix B. Full proof for the theorems 4.1, 4.2, 4.1 are in Appendix C.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Experiment presented in Section are fully detailed in Appendix A. The experiments from Section 4 and Section 5 are fully detailed in Appendix D. We provide links to all external code, attacks, and models we use, full description of all hyperparametes chosen, and full description of our method, so it can be easily reproduced. In the final version we will link to mon-anoonymized GitHub page with an API for our attack.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm.
(b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
22

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We detail all the commands and environment details required to faithfully re- produce the main experimental results in Appendix D, including relevant GitHub references and links.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines /https://nig cc/
publ e gesdde/// CodeeSuome ssisnnoons weiioonollcoe cy)) for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / //nips.co cc/ public iici//////// guiguuieee wenidee/// Code Submiss
olicyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Our paper doesn't include any training, but test details are supplies fully in Appendix D, and the important datails are within the experimental Sections 5, 4.2.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
23

---

The statistical significance are extremely important at Section 4.2, Figure 2, and plotted as a blurred colored area around the reported mean, to demonstrate its significance. In experiments in Section 5, we denote it using the + sign next to the running time mean in Tables and 2.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Computing details are in Appendix D.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that NeurIPS Code of Ethics https: htap:p::///euris...mm http://///aaapoo..o////a///cccaa
didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the
Answer: [Yes]
Justification: Read and conform.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- cration due to laws or regulations their jurisdiction).
10. Broader Impacts

---

Question:
Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our paper presents faster attack that overcomes few of the state of the art attack limitations. As any other paper regarding adversarial attacks, it may have both positive and negative societal impacts. We suggest faster attack that can be used to attack neural networks, yet we helieve reviling those weakness of neural networks will encourage researchers develop networks more robust these attacks.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to partieular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (c.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
25

---

Justification: We cite all the papers and sources from which we took the datasets, models and attack codes, including URLs.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (c.g.. website). the copyright and terms of service of that source should be provided.
assett are released, the license, copyright information, and terms use the package should be provided. For popular datasets, papers aaperswii wwwsswitte thoode com/ dataset has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. this information is not available online, the authors are encouraged to reach out to the asset's ss creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodl as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
26

---

Answer:
[NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
27


Reviews:
[{"review_id": "Km1WsM2Xhx", "reviewer": "Reviewer_WTPi", "summary": "Several evasion attacks seek untargeted adversarial examples by performing multiple runs with a targeted loss against different target classes. This process often leads to better results with respect to using untargeted losses, as the optimization process might be more stable. Until now, the choice of the considered target classes has been made by simply picking the top-k output scores - excluding the true class. This paper presents a novel method to perform this choice based on a score computed by normalizing the difference between the candidate target and the true class scores by the norm of the input gradients with respect to them. Using this score instead of the common naive approach on APGD-T is shown to improve the attack performance while reducing its computational cost.", "questions": "- Can you compare the MALT performance to APGD-T with random restarts and APGD-T with 9 randomly chosen target classes?\n- How does MALT perform using APGD with targeted CE loss? (If you perform these experiments, it would also be interesting to see APGD with random restarts and randomly chosen target classes.)\n- These two papers also provide improvements with respect to AutoAttack (in both performance and efficiency). Can you compare MALT with them?\n\n\n[a] Liu, Y., Cheng, Y., Gao, L., Liu, X., Zhang, Q., & Song, J. (2022). Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 15084-15093.\n\n[b] Yao, C., Bielik, P., Tsankov, P., & Vechev, M.T. (2021). Automated Discovery of Adaptive Attacks on Adversarial Defenses. Neural Information Processing Systems.", "limitations": "Limitations are discussed.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Although based on existing previous works, this work presents a novel idea that addresses an underexplored aspect of evasion attacks to the best of my knowledge. The problem of improving the performance of these attacks is well-known and very relevant, as - apart from very few settings where certified defenses can be applied - the robustness of machine learning algorithms can only be evaluated with empirical methods, and there are no formal guarantees on the provided results which might overestimate it. Thus, stronger attacks help a reliable robustness assessment. The proposed approach is well presented and formulated (including theoretical and empirical justifications), reports promising results, and can be applied to any attack.", "weaknesses": "Some aspects of the attack evaluation should be clarified or integrated with additional assessments. As the improvements provided by MALT with respect to AutoAttack are quite marginal, the experiments should clearly show that these improvements are exclusively due to the applied method.\n\nEven if comparing MALT with the entire AutoAttack suite is very important, it is interesting here to provide insights on how much MALT improves the standard APGD-T algorithm. In addition, the authors could perform some additional tests to validate their results further (see questions). I don't expect that all the required experiments will be performed, but I will suggest them as I think they could strengthen this work.\n\nThe authors claim multiple times that their method is five times faster than AutoAttack. This value is estimated by comparing the total number of forward and backward passes required by MALT and AutoAttack and then empirically computed by measuring the runtime. However, the empirical measurements are unreliable as they are highly influenced by several factors. Thus, I think it would be sufficient to consider the number of forward and backward passes (separately). Regarding the provided values in Sect. 3.3, the authors report the number of forward and backward passes for a worst-case scenario where all the attacks of the AutoAttack suite are executed. This should be clearly stated. Additionally, the experiments should report the actual number of forward/backward passes of AutoAttack, as it is likely that not all the attacks are executed for many samples.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thorough review. \n\n\"**Some aspects of the attack evaluation should be clarified or integrated with additional assessments. As the improvements provided by MALT with respect to AutoAttack are quite marginal, the experiments should clearly show that these improvements are exclusively due to the applied method.**\"\n\nWe emphasize that we haven’t altered any properties or any hyperparameters of APGD-T other than improved targeting. Compared to AutoAttack, we used just one out of the four attacks included in its ensemble (namely, APGD-T), and changed only its targeting method. Therefore, the time gain and the attack improvements are all due to MALT.\n\nWe acknowledge that the additional attacked images are not numerous, resulting in a marginal improvement in terms of successful attacks over AutoAttack. First, we note that the dramatic running time improvement, while also improving the attack success rate, is in itself a notable contribution. In addition, this attack success rate improvement is due to an inherent weakness of the existing widely used targeting methods and is neither dataset\\model-specific nor depends on some fine-tuned hyperparameters. Using nothing but better targeting, not only do we gain the improvement over APGD-T gained by AutoAttack, but also add additional improvement by attacking images that were previously out of reach for both naively targeted APGD-T and AutoAttack. \n\n\"**Even if comparing MALT with the entire AutoAttack suite is very important, it is interesting here to provide insights on how much MALT improves the standard APGD-T algorithm.**\"\n\nWe made this comparison as the reviewer suggested. This experiment is done on the Swin-L model [Liu et al. 2023] and Imagenet dataset, this is the top robust model for Imagenet according to Robustbench. APGD-T with standard targeting achieves 59.94% robust accuracy, Autoattack achieves 59.9% robust accuracy and APGD-T with MALT targeting achieves 59.84% robust accuracy (lower is better). There is a strict inclusion between the attacks, namely every image that APGD-T with standard targeting successfully attacks, Autoattack also attacks, and similar for Autoattack and APGD-T with MALT. We acknowledge that at today’s level of adversarial attack, it is very difficult to significantly improve over current attacks. However, we believe the main advantage of our method is to outperform the current state-of-the-art on every tested model, while also significantly improving its running time. If the reviewer thinks this is an important comparison, we can add it also to the other models in our paper in the final version.\n\n\n\"**The authors claim multiple times that their method is five times faster than AutoAttack. This value is estimated by comparing the total number of forward and backward passes required by MALT and AutoAttack and then empirically computed by measuring the runtime. However, the empirical measurements are unreliable as they are highly influenced by several factors.**\"\n\nFor the empirical measurements of the running time of AutoAttack and MALT, we used 5 different batches while performing the experiments on the exact same GPU. All the details are in lines 288-295. We agree that this empirical measurement might not be precisely exact, but since it is consistent across 9 different models, and for five different batches for each model (while having relatively small variance) we believe this is a reasonable conclusion. We acknowledge that the analysis in Section 3.3 is for a worst-case scenario, and we’ll emphasize it in the final version.\n\n\"**Can you compare the MALT performance to APGD-T with random restarts and APGD-T with 9 randomly chosen target classes?\nHow does MALT perform using APGD with targeted CE loss? (If you perform these experiments, it would also be interesting to see APGD with random restarts and randomly chosen target classes.)**\"\n\nWe thank the reviewer for these helpful questions. We performed these experiments for the rebuttal as the reviewer suggested, and will add them in the final version. Here are the details:  \n\n(1) We performed an APGD-T attack with 9 random targets on the Swin-L model [Liu et al. 2023] (which is the top robust model for Imagenet according to Robustbench). This attack was significantly less successful, achieving a robust accuracy of 78.54%, compared to 59.9% with Autoattack and 59.84% with MALT and APGD-T with a DLR loss (lower is better). \n\n(2) We performed an APGD-T attack with CE loss combined with the targeting of MALT. Again, the attacked model is Swin-L, and the dataset is Imagenet. This resulted in a robust accuracy of 60.52%, which is close to APGD-T with the DLR loss and MALT (59.84%), but still underperforms.\n\n(3) Regarding random restarts, all our experiments that include APGD have a random restart which is the default setting of APGD. According to [Croce and Heine, 2020], which introduced the APGD attack, additional random restarts do not improve the success rate. \n\n\"**These two papers also provide improvements with respect to AutoAttack (in both performance and efficiency). Can you compare MALT with them?**\"\n\nThank you for the suggestion. Due to time constraints in the rebuttal phase, we did not run those experiments, but we will consider adding these comparisons in the final version. Both papers include also targeted attacks, thus MALT can also be used as an off-the-shelf targeting method to improve these methods. We also note that both papers consider only the CIFAR dataset and not Imagenet. The reason may be because these are adaptive methods, which adapt to the model and dataset and require a very long precalculation to allow this adaptivity. These precalculations may be too long to run for Imagenet and for the current state-of-the-art robust models which are significantly larger than the models that are used in those papers.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0dryiBRm60", "reviewer": "Reviewer_BXuQ", "summary": "The paper presents a novel adversarial targeting method, Mesoscopic Almost Linearity Targeting(MALT), based on local almost linearity assumptions. The proposed attack wins over the current state of the art AutoAttack on the standard benchmark datasets CIFAR-100 and Imagenet and for different robust models. The proposed attack uses a five times faster attack strategy than AutoAttack's while successfully matching AutoAttack's successes and attacking additional samples that were previously out of reach. The paper proves formally and demonstrates empirically that the proposed targeting method can apply to non-linear models.", "questions": "1.Does the proposed method be effective for untargeted method?\n2.The proposed MALT's performance advantage over AutoAttack is not obvious as shown in Table 1 and Table 2.\n3.Deepfool is also the minimal distance attack method, what's the difference between Deepfool and the proposed MALT?\n4.small typo errors,line 30,Provides.", "limitations": "The experimental performance of the proposed method is not that good.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper has good originality, quality, clarity, and of important significance.", "weaknesses": "The proposed MALT's performance advantage over AutoAttack is not obvious.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thorough review. \n\n\"**The proposed MALT's performance advantage over AutoAttack is not obvious.**\"\n\nWe acknowledge that the additional attacked images are not numerous, resulting in a marginal improvement in terms of successful attacks over Autoattack. However, this is a very different concept from an improvement in other metrics in machine learning where indeed marginal improvement may not be significant. The reason is that for every image that AutoAttack successfully attacks, MALTs also successfully attack, while also attacking additional images that are out of reach for AutoAttack. Hence, there is a strict inclusion in the successful attacks. This is while improving running time by a factor of 5 on the entire imagenet attack test set. Also, this improvement is consistent across all the 9 tested models, and two benchmark datasets.\n\nAlso, note that we haven’t altered any other properties or any hyperparameters other than improved targeting. Compared to AutoAttack, we used just one out of the four attacks included in its ensemble (namely, APGD-T), and changed its targeting method. Therefore, the time gain and the attack improvements are all due to MALT.\n\n\"**Does the proposed method be effective for untargeted method?**\"\n\nYes, actually MALT is a method to choose the top-k targets. Thus, by choosing k targets MALT runs as an untargeted method, just like APGD with top-k classes runs in an untargeted fashion, meaning that choosing the targets is not part of the attacker's input but rather a part of the algorithm. We note that APGD can run completely untargeted, i.e. doing gradient steps that are not targeting any target class. MALT is a method to improve the choice of easier targets to attack, thus it is inherently different from APGD in this sense. Also, targeted attacks have been shown to perform better than untargeted attacks (see for example [Croce and Heine 2020]), thus we focus in this paper on the targeted version of APGD.\n\n\n\"**The proposed MALT's performance advantage over AutoAttack is not obvious as shown in Table 1 and Table 2**\"\n\nPlease see our answer to the first comment.\n\n\"**Deepfool is also the minimal distance attack method**\"\n\nDeepfool can be compared to APGD as an attack that performs gradient steps. However, MALT is a method to improve the targeting in targeted attacks. Thus, MALT may also improve the performance of Deepfool. We focused on APGD since this is a widely used standard attack, which is part of AutoAttack, the current state-of-the-art adversarial attack.\n\nWe will fix the typos in the final version", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kegG78GriY", "reviewer": "Reviewer_fhJA", "summary": "This paper introduces MALT, a heuristic technique for selecting target classes for adversarial perturbations. The intuition behind MALT is to order attack targets in the order of high row norm in the jacobian. They show that this can beat an AutoAttack baseline with much less compute for CIFAR and ImageNet classification tasks.", "questions": "Q1: Why are these types of targeted attacks needed? In general, the purpose of a targeted attack is to make the model do a specific thing that the adversary wants. So why do targeted attacks if the attacker doesn't care about what the target it. Does it make the attack more efficient? Why not just do untargeted attacks? Why isn't this a baseline? I might be unfamiliar with the background lit, but has it been empirically, convincingly established that dynamically selecting target classes is more efficient than simply doing an untargeted attack in the first place?\n\nQ2: What does \"interval\" mean in table 1?\n\nQ3: In what sense is AutoAttack the SOTA? Says who? Why were no other baselines tested against?", "limitations": "L1: Model size & scale, problem realisticness, and demonstrated value in realistic applications. My main challenge with this paper is that I don't feel that there have bee many experiments to convincingly demonstrate value of MALT for realistic, useful applications in 2024.", "rating": 3, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 1, "strengths": "S1: The core result in tables 1 and 2 is compelling. The speedups are impressive. \n\nS2: I liked the writing and clarity, but I have a few questions below.", "weaknesses": "W1: This paper seems to be behind its time. It only experiments with image classification including CIFAR. I don't really fault the paper for this, but modern image and other classification problems are just addressed with much bigger models. I don't see why it would be necessarily hard to implement this. If I ask myself \"has this paper convincingly done experiments at a scale/setting that seem convincing that MALT would be useful for modern problems\" I would say no. \n\nW2: Section 4.1 seems pointless -- just proving something to prove something. I don't see any value in proving something here about a two-layer network. Conditional on section 5 already existing, I think that section 4 is of no interest.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thorough review. \n\n\"**W1: This paper seems to be behind its time.**\"\n\nWe first emphasize that all our experiments are done against the top robust models according to Robustbench, which is the de facto standard benchmark in this field. All the models we tested on are from 2024 or 2023 and are large-scale. For example, Swin-L [Liu et al. 2023] is the current best robust model for Imagenet, it is based on transformers and contains 187 million parameters. Our experiments are done for the Imagenet and CIFAR-100 datasets, we note that Robustbench includes only those datasets as standard benchmarks. It is a legitimate criticism that other datasets should be included as standard benchmarks in the adversarial attack research field, but this is relevant to all papers published in this field and not particular to ours.\n\n\n\"**W2: Section 4.1 seems pointless**\"\n\nOur method is based on an analysis of mesoscopic linear models, as explained in Section 3. We believe it is important and interesting to study whether this analysis is valid theoretically. Two-layer neural networks are already highly non-linear, thus studying the mesoscopic linearity properties in such networks is in itself challenging and interesting. A similar result was proven before only for networks with random weights [Bubek et al. 2021], and we extend it to trained networks under certain assumptions. \n\nWe also believe that this study of mesoscopic linearity can be of independent interest beyond the scope of adversarial attacks, as it unveils a certain intriguing phenomenon about the optimization landscape of neural networks.\n\n\"**Q1: Why are these types of targeted attacks needed?**\"\n\nIn earlier days of studying adversarial attacks, this was a very important question. Indeed, targeted attacks have been shown to be more effective than untargeted attacks, for a great study on this subject we refer to [Croce and Heine 2020]. Also, note that in AutoAttack , which is a composition of four different attacks, two are targeted and two are untargeted (lines 153-159). Since our attack performs better than Autoattack, in particular, it performs better than the current top untargeted attacks. \n\nWe also emphasize that  MALT runs in an untargeted fashion, just like APGD-T with top-k classes runs in an untargeted fashion. Namely, given an image to attack, the attack itself does not target some predetermined class but rather automatically choses the classes that are easiest to attack according to the score given by MALT.\n\n\"**Q2: What does \"interval\" mean in table 1?**\"\n\nIn Figure 1 we divide the adversarial perturbation into 100 intervals and present the change over time in the output’s confidence for each class. We will add this explanation in the final version.\n\n\"**Q3: In what sense is AutoAttack the SOTA?**\"\n\nAutoAttack is widely considered to be the state-of-the-art adversarial attack, which in itself is an ensemble of four different attacks. It is the standard benchmark to test against robust models in the official RobustBench benchmark.\n\n\"**L1: Model size & scale**\"\n\nPlease see our answer to W1.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VuWIGK49ty", "reviewer": "Reviewer_hP7Q", "summary": "AutoAttack is a highly successful image-based adversarial attack method that combines targeted and untargeted approaches to effectively target a wide range of models. For targeted attacks, AutoAttack selects 9 adversarial target classes based on the model's confidence levels. However, this restriction is imposed due to computational constraints. Notably, the authors of this paper argue that picking target classes based on the model's confidence levels is not an optimal approach. They demonstrate that for linear classifiers, given an input instance, the best target class minimizes the ratio of distance to the target class and the norm of the difference between the gradients. Additionally, they show that deep neural networks (DNNs) are almost linear in their mesoscopic region, indicating that this approach can also be applied to DNNs. Building on this insight, the authors propose a new method called MALT, which empirically outperforms AutoAttack and achieves faster adversarial perturbation discovery.", "questions": "1. The authors showed that MALT leans towards the top-1. Should we select a=1 in all cases then?\n2. Do the authors have any intuition behind why APGD is better than FAB for MALT?", "limitations": "N/A", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1.The study reveals a significant flaw in the AutoAttack method: the optimal target class for linear classifiers is not determined by the model's confidence levels. This fundamental finding highlights a limitation of AutoAttack and underscores its potential shortcomings. Specifically, AutoAttack may falter in certain scenarios due to its reliance on selecting the top 9 classes for targeted attacks, which can overlook the most suitable class if it does not fall within this range. By recognizing that linearity holds true in the mesoscopic region, the authors of the current paper are able to refine and improve upon AutoAttack. Their proposed approach, MALT, demonstrates empirical superiority over its predecessor while achieving faster adversarial perturbation discovery.\n2.The authors also conduct a complexity analysis to compare the efficiency of MALT with AutoAttack. As MALT relies solely on APGD-based attacks, it exhibits a significant speed advantage over AutoAttack. Specifically, when applied to the Imagenet dataset, MALT demonstrates an average speedup of 5 times compared to AutoAttack, making it a more efficient and practical solution for adversarial attack detection.\n3. The empirical findings presented in this paper are robust and convincing. The authors demonstrate that MALT consistently outperforms AutoAttack, with its success rate of finding adversarial examples never trailing behind and often surpassing AutoAttack. Moreover, MALT exhibits a significant speed advantage, allowing it to identify adversarial examples more efficiently. To validate their approach, the authors selected a value of c=100 for the Imagenet dataset, but their empirical analysis reveals that even higher values (e.g., c=1000) do not necessarily yield better results. This finding underscores the effectiveness of MALT's design. Furthermore, they empirically demonstrate that APGD is an excellent choice for their attack strategy.", "weaknesses": "1. While MALT's primary innovation is rooted in its refined class selection process, which sets it apart from AutoAttack, this refinement may somewhat temper the overall novelty of this manuscript.\n2. The authors have chosen a specific value of c (c=100) and demonstrated empirically that this value is sufficient for the Imagenet dataset. However, the selection of an optimal value of c that generalizes well across various datasets remains unclear, leaving room for future exploration and refinement.\n3. In line with their earlier findings, the authors have empirically demonstrated that APGD outperforms alternative strategies in the context of MALT. While this suggests a strong case for APGD as a suitable choice for MALT, it remains to be seen whether this advantage will hold across diverse settings and datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the positive and thorough review.\n\n\n\"**While MALT's primary innovation is rooted in its refined class selection process, which sets it apart from AutoAttack, this refinement may somewhat temper the overall novelty of this manuscript.**\"\n\nWe acknowledge that the main contribution of MALT is the introduction of a refined class selection process and its use with existing attacks such as APGD. We believe that although APGD is already widely used, the addition of MALT significantly improves it. We are sorry if we didn’t understand this point and would be happy to elaborate further.\n\n\n\"**The authors have chosen a specific value of c (c=100) and demonstrated empirically that this value is sufficient for the Imagenet dataset. However, the selection of an optimal value of c that generalizes well across various datasets remains unclear, leaving room for future exploration and refinement.**\"\n\nIt is an interesting question to optimize the value of c, thus further reducing the running time of MALT. However, we believe it would be very beneficial if the value of c can be universal across all datasets and models, and thus be treated as a constant rather than a hyperparameter that needs tuning. In section 5.1, lines 314-325 we study the effect of the value of c, by choosing c=1000 (i.e. all the possible classes of Imagenet), and show that the robust accuracy doesn’t improve. This indicates that a value of c=100 is indeed a proper choice for all our experiments, at least as an upper bound, and we admittingly haven’t attempted to optimize it further.\n\n\"**In line with their earlier findings, the authors have empirically demonstrated that APGD outperforms alternative strategies in the context of MALT. While this suggests a strong case for APGD as a suitable choice for MALT, it remains to be seen whether this advantage will hold across diverse settings and datasets.**\"\n\nThis is a good point. We have tested MALT combined with the targeted FAB attack (lines 297-299), and it performed worse than with APGD with the DLR loss. We additionally conducted another experiment for the rebuttal phase, using MALT with APGD and the CE loss (instead of DLR) on the SWIN-L model. The robust accuracy against MALT with APGD and CE loss is 60.52%, for Autoattack it is 59.9% and for MALT with APGD and DLR loss it is 59.84% (lower is better). We will add this experiment in the final version.\nIt is indeed an interesting research direction to study other targeted attacks and experiment with MALT beyond the datasets that appear in the RobusBench benchmark.\n\n\"**The authors showed that MALT leans towards the top-1. Should we select a=1 in all cases then?**\"\n\nAlthough MALT does lean towards the top-1 better than naive top-k targeting, there are still images where the attacked target is not the top-1. We used top-9 according to the MALT class selection to align with the current targeting (top-9 according to the highest model confidence). Thus a=9 seems to be a good choice, although it could possibly be further optimized to further improve the running time of MALT.\n\n\"**Do the authors have any intuition behind why APGD is better than FAB for MALT?**\"\n\nWe think that, in general, a targeted FAB attack is less successful than a targeted APGD attack. This can be seen in the experiments done in [Croce and Heine 2020] (Table 1). Hence, this difference between APGD and FAB is probably unrelated to MALT. We believe this is also true for the additional experiment done in the rebuttal phase with APGD and CE loss, which underperforms compared to APGD with the DLR loss.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes a new method for targeted adversarial attacks. The method is shown to be (marginally) more effective than AutoAttack while being significantly faster. Overall, reviewers appreciated the novelty of the idea as well as the intuitive and theoretical justification, as well as the robustness of the empirical evaluation. One reviewer was concerned about the size and scale of the experiments, but given that no concrete suggestion was given to the authors I am inclined to accept the paper. I encourage the authors to address any and all reviewer comments and suggestions, specifically about more accurately reporting speedups, methods for setting hyperparameters, and additional experimental comparisons (where applicable).
Decision: Accept (poster)