Generating Adversarial Examples with Task Oriented Multi-Objective Optimization
Authors: Anh Tuan Bui
Trung Le
He Zhao
Quan Hung Tran
Paul Montague
Dinh Phung
Venue: Accepted by TMLR ()

Abstract: Deep learning models, even the-state-of-the-art ones, are highly vulnerable to adversarial examples. Adversarial training is one of the most efficient methods to improve the model's robustness. The key factor for the success of adversarial training is the capability to generate 
qualified and divergent adversarial examples which satisfy some objectives/goals (e.g., finding adversarial examples that maximize the model losses for simultaneously attacking multiple models). Therefore, multi-objective optimization (MOO) is a natural tool for adversarial example generation to achieve multiple objectives/goals simultaneously. However, we observe that a naive application of MOO tends to maximize all objectives/goals equally, without caring if an objective/goal has been achieved yet. This leads to useless effort to further improve the goal-achieved tasks, while putting less focus on the goal-unachieved tasks. In this paper, we propose \emph{Task Oriented MOO} to address this issue, in the context where we can explicitly define the goal achievement for a task. Our principle is to only maintain the goal-achieved tasks, while letting the optimizer spend more effort on improving the goal-unachieved tasks. We conduct comprehensive experiments for our Task Oriented MOO on various adversarial example generation schemes. The experimental results firmly demonstrate the merit of our proposed approach. 

Published in Transactions on Machine Learning Research (05/2023)
Generating Adversarial Examples with Task Oriented Multi- Objective Optimization
Anh Bui
Yuananh.bui@monaeh
Monash University
Trung Le Monash University
trungin@monnash.c edu
He Zhao CSTRO's Datab1, Australia
he.zhao@ieee.oo
Quan Tran Adobe Research
gtran com
Paul Montague
Defence Science and Technology Group, Australia
Dinh Phung
däih.phhung@mmmnsh.cco edu
Monash University, VinAl Research
Reviewed on OpenReview: https: openneviee. net/ forum? id=
Abstract
Deep learning models, even the-state-of-the-art ones, are highly vulnerable adversarial examples. Adversarial training is of the most efficient methods improve the model's robustness. The key factor for the success of adversarial training is the capability to generate qualified and divergent adversarial examples which satisfy some Abjectives/goale (e.g., finding adversarial examples that maximize the model losses for simultancously attacking multiple models). Therefore, multi-objective optimization (MOO) a natural tool for adversarial example generation to achieve multiple objectives/gowd goals simultaneously. However, we observe that naive application MOO tends maximize all objectives/ goals equally, without caring if an objective /vgog has been achieved yet. This leads to useless effort to further improve the goal-achieved tasks, while putting less focus the goal-unachieved tasks. In this paper, propose Task Oriented MOO to address this issue, in the context where define the goal achievement for a task. Our principle is to only maintain the goal-achieved tasks, while letting the optimizer spend more effort on improving the goal-unachieved tasks. We conduct comprehensive experiments for our Task Oriented MOO on various adversarial example generation schemes. The experimental results firmly demonstrate the merit our proposed approach. Our code is available at htttps://gitae wctmm//uaannbbui8//AAA00
explicitly
1 Introduction
Deep neural networks are powerful models that achieve impressive performance across various domains such as bioinformatics (Spencer et. al. 2015). speech recognition Hinton el al. 2012 computer vision (He et al., 2016), and natural language processing VVaswani et al. 2017). Despite achieving state-of-the-ars performance, these modcls are extremely fragile, as one can casily craft small and imperceptible adversarial perturbations of input data fool them, hence resulting in high misclassifccatios (Szegedy al. 2014]] Goodfellow et al. 2015). Accordingly, adversarial training (AT) (Madry et. al. 2018
Zhang et al. 2019) has been proven to

---

Published in Transactions on Machine Learning Research (05/2023)
be one of the most efficient approaches to strengthen model robustness (Athalye et al.
AT requires 2018 Zhang et al.)
2018
challenging models with divergent and qualified adversarial examples (addry et al.
2019 Bui et al.) 2021b) so that the robustified models can defend against adversarial examples. Therefore, generating adversarial examples is an important research topic in Adversarial Machine Learning (AML). Several perturbation based atlacks have been proposed, notably PGD (Madry et al. 2018), CW (Carlini & Wagner 2017). and AutoAttack (Croce & Hein 2020). Most of them aim to optimize a single objective/ /goll,
e.g.: maximizing the cross-entropy (CE) loss w.r.t. the ground-truth label (Goodfellow et al.) 2015 Madry ct al. 2018), maximizing the Kullback- Kullback-Leibler Leibler (KL) divergence w..tt. the predicted probabilities of a benign exampe ple (Zhang et al. 2019), or minimizing combination of perturbation size. and predicted loss to a targeted class as in Carlini & Wagner (0117).
However, in many contexts, we need to find qualified adversarial examples satisfying multiple objectives/goals, e.g., finding an adversarial example that can atfack simultaneously multiple models in an ensemble model Pang ct al., 2019 Bui al. 2021b), finding an universal perturbation that can attack simultaneously multippe benign examples (Moosavi-eezoooli et. al., 2017]. Obviously, these adversarial generations have a nature of multi-objective problem rather than single-objective one. Consequently, using single-objective adversarial examples Icads to a much less adversarial robustness in ensemble learning as discussed in Section 4.2 and
Appendix D.2
Multi- Objeitivee Optimization (MOO) (Désidéri 2012) is an optimization problem to find a Pareto optimality
that aims to optimize multiple objective functions. a nutshell, MOO is a natural tool for the aforementioned multi-objective adversarial generations. However, direct and naive application of MOO generating robust adversarial examples for multiple models ensemble of transformations does not work satisfactorily (cf. Appendix D. Concretely, it can be observed that the tasks are not optimized equally. The optimizing process focuses too much on one dominating task and can be trapped casily by it, hence leading to downgraded attack performances.
Intuitively, for multi-objective adversarial generations, we can explicitly investigate if an objective or a task achieves or fails to achieve its goal (e-g., the current adversarial example can fool a model successfully or unsuccessfully in multiple models). To avoid some tasks dominating others during the optimization process, we can favour more the tasks that are failing and pay less attention to the tasks that are performing well. For example, in the context of allacking multiple models, we update an adversarial example x² to favor the models that x" has not attacked successfully yet, while trying to maintain the attack capability of x" on the already successful models. In this way, we expect that no task really dominates others and all tasks can be updated equally to fulfill their goals.
Bearing this in mind, we propose a new framework named TAsk Oriented Multi-Objective Optimization (TA-MOO) with multi-objective adversarial generations as the demonstrating applications. Specifically, we learn weight vector (i.e., each dimension is the weight for task) lying a simplex corresponding to all tasks. To favor the unsuccessful tasks while maintaining the success of the successful ones, we propose a geometry-based regularization term that represents the distance between the original simplex and reduced simplex which involves the weight vectors for the currently unsuccessful lasks only. Furthermore, along with the original quadratic term of the standard MOO helping to improve all tasks, minimizing our geometry-based regularization term encourages the weights of the goal-achieved tasks to be as small as possible, while inspiring those for the goal-unachieved ones to have a sum close to 1. By doing so, we aim to focus more on improving the goal-unachieved tasks, while still maintain the performance of goal-achieved tasks
Most related work to ours is Wang et al. (2021), which considers the worst-case performance across all tasks. However, this original principle reduces the generalizability to other tasks. To mitigate this issue, a specific regularization was proposed to balance all tasks' weights. Our work, which casts an adversarial generation task as a multi-objective optimization problem, is conceptually different from that work, although both methods can be applied to similar tasks. Further discussion about relate work can be found in Appendix A
To summarize, our contributions in this work include:
(CI) We propose novel framework called TA-MOO, which addresses the shortcomings of the original MOO when applied to multi-objective adversarial generation. Specifically, the TA-MOO framework incorporates
2

---

Published in Transactions on Machine Learning Research (05/2023)
geometry-based regularization term that favors unsuccessful tasks, while simultaneously maintaining the performance of successful tasks. This innovative approach improves the efficiency and efficacy of adversarial generation by promoting a more balanced exploration of the solution space.
(C2) We conduct comprehensive experiments for three adversarial generation tasks and one adversarial training task including attacking multiple models, learning universal perturbation, attacking over many data bransformations, and adversarial training on ensemble learning setting. The experimental results show that our TA-MOO outperforms the basclines by a wide margin on the three aforementioned adversarial generation tasks. More importantly, our adversary brings great benefit improving adversarial robustness, highlighting the potential of our TA-MOO framework in adversarial machine learning.
(C3) Additionally, we provide a comprehensive analysis on different aspects of applying MOO and TA-MOO to adversarial generation tasks, such as the impact of the dominating issue in Appendix E.1 the importance of the Task-Oriented regularization in Appendix E.2 the impact of initialization of MOO in Appendix dubsee:oppimalliiii-mooo and the limitations of MOO solver in Appendix seccsup-gradiee---ee--iisets We believe that our analysis would be beneficial for future research in this area.
2 Background
We revisit the background of multi-objective optimization (MOO), which lays the foundation for our task- oriented MOO in the sequel. Given multiple objective functions f6) == [fa (6) ..... fm (6)] where each
ft d: E, we aim to find the Pareto optimal solution that simultaneously maximizes all objective functions:
max f(6) = ifi .... (5)]
(1)
While there are a variely of MOO solvers MMetttinen 2012 Ehrgolt 2005 in this paper, we adapt from the multi-gradient descent algorithm (MGDA) that was proposed suitably for end-to-end learning by Désidéri (2012). Specifically, MGDA combines the gradicnts of individual objectives to a single optimal direction that increases all objectives simultaneously. The optimal direction corresponds to the minimum-non point that can be found by solving the quadratic programming problem:
"² argmin w² T:Qw,
(2)
where Am = f E E ||||| = 1} is the m-simplex and Q E Rmxm is the matrix with Qú Vafi (8) Vof, (0). Finally, the solution of the problem i can be found iteratively with each update step 8 8= 8 n9 where g is the combined gradient
Ex w Vafi (6) and > 0 is a sufficiently small learning rate. Furthermore, Désidéri (2012) also proved that by using an appropriate learning rate al each step, we reach the Pareto optimality point 8* at which there exist w E Am such that Σ w. Vafi (8*) = O.
3
Our Proposed Method
3.1 Task Oriented Multi-Objective Optimization
We now present our TAsk Oriented Multi-Objectivg Optimization (TA-MOO). We consider the MOO problem in (1) where each task (i = 1,..., m) corresponds to the objective function f, (6) 1,. m). Additionally, assume that given a task T;, we can explicitly observe if this task has currently achieved its goal (c.g., the current adversarial example x can fool successfully the model ft), which is named goal-achievod lask. We also name task that has not achieved its goal a goal-unachieved lask. Different from the standard MOO, which equally pays equal attention to all tasks, our TA-MOO focuses improving the currently goal-unachieved tasks, while trying to maintain the performance of the goal-achieved tasks. By this principle, we expect all tasks would be equally improved to simultaneously achieve their goals.
To be more precise, we depart from dn and consecutively update in L steps to obtain the sequence ò1 ò2. &g that approaches the optimal solution. Considering the f-th step (i.c., 1 1 S L), we currently have 6, and need to update it to obtain 8,+1- We examine the tasks that have achieved their goals already and denote them Tı, T2, ... Ts without the loss of generalization. Here we note that the list of goal-achieved tasks is
3

---

Published in Transactions on Machine Learning Research (05/2023)
empty if s = 0 and the list of goal-unachieved tasks is empty if s m. Specifically, to find de+1, we first solve the following optimization problem (OP):
w" = argmin {w"Qw Uy (w)).
(3)
where Q E R with Qú V&li (o.) Volz (6+), >> is trade-off parameter, and Ω (w) is regularization term to let the weights focus more the gnac-eene tasks. We next compute the combined gradient gt and update 82 as:
m
9t
w Nala (6)) and de+1 8g +99--
The OP in (3) consists of two terms. The first term w Qu ensures that all tasks improving, while the second (erm Q (w) serves the regularization to restrict the goal-achieved lasks Ti,.... T, by setting the corresponding weights Wi,.., Wa as small as possible.
Before getting into the details of the regularization, we emphasize that to impose the constraint w E Ams we parameterize w softmax (a) with a E I and solve the OP (3) using gradient descent. In what follows, discuss our proposed geometry- regularization term & (w).
Simplex-based regularization. Let S, {3 [A1 E RT the goal-umachieved tasks and S = {0.) S. be the extended simplex, where 02 is the s-dimensional vector of all zeros. We define the regularization term f (w) as the distance from to the extended simplex S:
Bg 1,=1} be simplex w.r.t.
Ω (ww) = d (w, S) = minles ||W - T
Because S is compact and convex set and ||w 212 is differentiable and convex function, the optimization problem in (4) has a unique global minimizer Q (w) = |w - projs (w)llg: where the projection projs (w) is defined as
projs (w) argmin ||W T|/
The following lemma shows us how to find the projection projs (w) and evaluate Ω (w).
Lemma 1. Sorting Wo inlo Ust such that Us+1 2 Us+2 2 2 Um Desining p
max {s (8+ 1-15t < m u, + - (1 Ej uj) >0]. Denoling 7 = projs (w) can be computed as
1 (1 Ep us), the projection
projs (w); {( max {wr + 7,
1 isiss otherwise
Furthermore, the regularization Ω (w) has the form:
m
②(w) Σ w Σ (w, - max (wi + +7, 03)2
(5)
With further algebraic manipulations, (w) can be significantly simplified as shown Theorem Theorem 1. The regularization Q (w) has the following dosed--orma
Ω (w)
w
1
W/
(6)
1
The proof of Lemma and Theorem I can found in Appendix B.1 Evidently, the regularization term in Eq. (6) Theorem encourages the weights Whe associated with the goal-achieved tasks to be as small possible and the weights W=+1mm,socciatt with the unacheeed tasks move closer the simplex S, (i.e., Eis+1 W; is closer to 1).
4

---

Published in Transactions on Machine Learning Research (05/2023)
Parameterized TA-MOO. Algorithm 1 summarizes the key steps of our TA-MOO. We use gradient descent to find solution d for the OP in I. steps and at each iteration solve the OP in in K steps using gradient descent solver with the parameterization w = softmax (a). To reduce computational cost, at each iteration we reuse the previous solution a and use a few stops K (i.c., K & 10) to get new solution. We then compule the combined gradient 9t and finally update 6, to 8141 using the combined gradient Dt (or sign( in the case of Loo norm). The projecting operation in step 13 is to project 6 to valid space specifying applications that introduce hereon.
Algorithm Pseudocode for Parameterized TA-MOO.
Input: Multi-objective functions fimm (6). 8's solver with L update steps and learning rate π7- w's Gradient Descent Solver (GD) with K update steps and learning rate fw and variable a. The softmax function denotes by a. Tradeoff parameter X.
Output: The optimal solution 8*
1: Initialize 6, (e.g., 8g u(-c,e)) e)).
Initialize ag |0)]== with oó = 1/m.
for t 0 L do
Collect list of tasks' gradients (V.J(
5: Compute Q with Qú = Voli (6.)² Vofj (6:).
Initialize 0++1 at
for k = 0 to K - do Compute [(a ( (a((4)))) (l((((4411)
Update 0++1 01+1 The v.l(ar))). end for
10:
11:
Compute the combined gradient 9r = - Voot (6).
12:
Update 8,41 = 6, + na9h-
13:
Project de+1 to valid space (specific to domain, e.g., || < t).
14:
end for Output 5" = Ō1.
15:
3.2 Applications in Adversarial Generation
Although TA-MOO general framework, we in this paper focus on its applications in adversarial generation. Following Wang et al. (2021), consider three tasks of generating adversarial examples.
Generating adversarial examples for ensemble model. Considering ensemble classifier with multiple classification models hı, fu,..., Am: where h; (z) E Air { IR ||>||| 1} with the number of classes M. Given data sample our aim is to find an adversarial example I" = x + 6 that can successfully attack all the modcls. Specifically, we consider a set of tasks cach of which, Tr, is about whether x + can successfully atlack model hú, defined as:
(argmaxiseswh,
where y is the ground truth label of I is the indicator function and h; (z, k) returns the probability to predict x to the class k. To find a perturbation that can attack successfully all models, we solve the following multi-objective optimization problem:
[fa (6), (o)),
6:loolsSe
where (8) (/: (x 6) v) with the loss function L which could be the cross-entropy (CE) loss (Madry et al. 2018). the Kullback-Leibler (KL) loss (Zhang et al. 2019), or the Carlini- Wagner (CW) loss (Carlini & Wagner 2017).
Generating universal perturbations. Considering a single classification model with (x) E AM and batch of data samples 3ı, X2, .. TB, would like to find a perturbation 8 with || & such that
5

---

Published in Transactions on Machine Learning Research (05/2023)
27 x, +
are adversarial examples. We define the task To as finding the adversarial example < J; + 8 for data sample Ti. For each task Ti, we can define its goal as finding successfully the adversarial example x7:
I argmax (2f, # argmax (x,,,) k)).
To find the perturbation ò, we solve the following multi-objective optimization problem:
max S
[1i
(m)],
where & vz)
((h (h (xt + 0)) with ys the ground-truth label of Zi-
Generating adversarial examples against transformations. Considering a single classification model h and categories of data transformation Pim (e.g., rotation, lighting, and translation). Our goal is to find an adversarial attack that is robust to these data transformations. Specifically, given a benign example s, we would like to learn a perturbation 8 with ||o] S that can successfully atfack the model after any transformation t, ~ P; is applied. To formulate as an MOO problem, we consider the task T/ as finding the adversarial example xς = to (x 6) with 4 ~ P,. For each task Tú, we can define the goal as finding successfully the adversarial example x;:
(argmax (x & argmax (x,
To find the perturbation 6, we solve the following multi-objective optimization problem:
max SE
Ifi (.. (ö)),
where fi (6)= E, [h (h (t; (x + 0)), y)1 with y the tround-truth label of z.
4 Experiments
In this section, we provide extensive experiments across four scttings: (i) generating adversarial examples for
ensemble of models (ENS, Sec 4.1) (ii) generating universal perturbation (UNI, Sec 4.3 (iii) generating
robust adversarial examples against Ensemble of Transformations (EoT, Sec 4.4 and (iv) adversarial training
for ensemble of models (AT, Sec 4.2 The details of each setting can be found in Appendix C
General settings. Through our experiments, we use six common architectures for the classifier including ResNet18 (He et al., 2016). VGG16 (Simonyan & Zisserman 2014h, GoogLeNet. (Szegedy et al. 2015). EfficientNet (Tan Le 2019), MobileNet Howard et al. (2017), and WideResNet Zagoruyko & Komodakis (2016) with the implementation We evaluate on the full testing set of two benchmark datasets which are CIFAR10 and CIFAR100 (Krizhevsky et al., 2009). We observed that the attack performance saturated with standard training models. Therefore, to make the job of adversaries more challenging, use Adversarial Training with PGD-AT (Madry el al. 2018) to robustify the models and use these robust models as the victim models in our experiments.
Evaluation metrics. We use three metrics to evaluate the attack performance including (i) A-All: the Attack Success Rate (ASR) when an adversarial example can achieve goals in all lasks. This considered as the most important metric to indicate how well one method can achieve in all tasks; Aii)A-Av: the average Attack Success Rate over all tasks which indicate the average attacking performance; (A-)) Attack Success Rate in each individual task. For reading comprehenston purposes, if necessary the highest/second highest performance in each experimental setting is highlighted in Cold/Underline and the most important. metric(s) is emphasized in blue color.
Baseline methods. We compare our method with the Uniform strategy which assigns the same weight for all tasks and the MinMax method [Wang et al. 2021) which examines only the worst-case performance across all tasks. To increase the generality to other tasks, MinMax requires a regularization balance

---

Published in Transactions on Machine Learning Research (05/2023)
Table 1: Evaluation of Attacking Ensemble model on the CIFARIO and CLEAR100 datasets.
CW
CE
KL
A-AIl
A-Avg
A-All
A-Avg
A-All
A-Avg
Uniform
26.37
41.13
28.21
48.34
17.44
32.85
MinMax
27.53
41.20
35.75
51.56
19.97
38.13
CIFAR10
MOO
18.87
34.24
25.16
44.76
15.69
29.54
TA-MOO
30.65
40.41
38.01
51.10
20.56
31.42
Uniform
52.82
67.39
55.86
72.62
38.57
54.88
MinMax
54.96
66.92
63.70
75.44
40.67
53.83
CIFAR100
MOO
51.16
65.87
58.17
73.19
39.18
53.44
TA-MOO
55.73
67.02
64.89
75.85
41.97
53.76
between the average and the worst-case performance. We use the same attack setting for all methods: the attack is the Las untargeted at tack with 100 steps, step size v/s = 2/255 and perturbation limitation e 6= =8/255. The GD solver in TA-MOO uses 10 steps with learning rate The = 0.005. Further detail can be found in Appendix C
4.1 Adversarial Examples for Ensemble of Models (ENS)
Experimental setting. In our experiment, we use an ensemble of four adversarially trained models: ResNet18, VGG16, GoogLeNet, and EfficientNet. The architecture is the same for both the CIFAR10 and CIFAR100 datasets except for the last layer which corresponds with the number of classes in each dataset. The final output of the ensemble is an average of the probability outputs (i.e., output of the softmax layer). We use three different losses an object for generating adversarial examples including CE (Madry et al. 2018 KL (Zhang et al. 2019). and CW (Carlini & Wagner 2017
Results 1: TA-MOO achieves the best performance. Table 1 shows the results of attacking the ensemble model on the CIFARIO and CIFARI00 datasets. It can be seen that TA-MOO significantly outperforms the baselines and achieves the best performance in all the settings. For example, the improvement over the Uniform strategy is around 10% on both datasets with the CE loss. Comparing to the MinMax method, the biggest improvement is around 3% for CIFAR10 with CW loss and the lowest one is around 0.6% with the KL. loss. The improvement. can be observed in all the settings, showing the generality of the proposed method.
Results 2: When does not MOO work? It can be observed that MOO falls behind all other methods, even compared with the Uniform strategy. Our hypothesis for the failure of MOO is that in the original setting with an ensemble of 4 diverse architectures (i.e., ResNet18, VGG16, GoogLeNet, and Efficient.eet) there is one task that dominates the others and makes MOO become trapped (i.c., focusing on improving the dominant task). To verify our hypothesis, each model and the final weight w of 1000 samples and report the results in Table 2 It can be seen that the Elficient.eet has a much lower gradient strength, therefore, it has a much higher weight. This explains the highest ASR observed in EfficientNee and the large gap of 19% (56.11% in Efficient.ee and 37.05% in GeogLeNet).. To further confirm our hesot,esis, we provide an additional experiment on a non-diverse ensemble model which consists of individual ResNet18 models. It can be obscrved that in the non-diverse setting, the gradient strengths are more balanced across models, indicating that no task dominates others. As result, MOO shows its effectiveness by outperforming the Uniform strategy by 4.3% in A-All.
measure the gradient norm [ corresponding to
Results 9: The importance of the Task- Oriented regularization. It can be observed from Table 2 that in the diverse setting, TA-MOO has a much lower gap (4%) between the highest ASR (53.4% at EfficientNet) and the lowest one (49.29% at GoogLeNet) compared to MOO ( 19%). Moreover, while the ASR of EfficientNet is lower by 2.7% the ASRs of all other architectures have been improved considcrably (i.c., 12% in GoogLeNet). This improvement shows the importance of the Oaik-trre regularization, which helps to avoid being trapped by one dominating task, happened in MOO. For the non-diverse
7

---

Published in Transactions on Machine Learning Research (05/2023)
Table 2: Attacking Ensemble model with a diverse set D=(R-ResNet11, V-VGG16, G-GoogLeNet, E- EfficientNet] and non-diverse ND=(4 ResNets). represents the final w of MOO (mean + std). ( represents the gradient norm of each model (mean + std).
A-All A-Avg
R/R1
V/R2
G/R3
E/R4
[Vsf((0)
7.15 + 6.87
4.29 + 4.64
7.35 + 7.21
0.98 + 0.72
D
W
0.15 + 0.14
0.17
+0.13
0.15 + 0.14
0.53 + 0.29
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
[Va((())
8.41 + 8.22
6.68+ 6.95
7.36 + 6.03
5.67
+ 6.09
ND
W
0.23 + 0.21
0.24++011
0.23 + 0.19
0.30 + 0.21
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
Table 3: Evaluation the Transfcrability of adversarial examples. Each cell (row-ith, column-jth) reports SAR (higher is better) of adversarial examples from the same source architecture (RMB) with an adversary at row-ith to attack ensemble at column-jth. Each architecture has been denoted by symbols such as R: ResNet11, M: MobileNet, E: L'fficenttNet, V: VGG16, W: WideResNet. For examples, RME represents for an ensemble of ResNet18, MobileNet and EfficientNet.
RME
RVW
EVW
MVW
REV
MEV
RMEV
RMEVW
Uniform
31.73
25.03
22.13
22.73
29.50
28.44
26.95
20.50
MinMax
40.01
23.75
22.39
23.34
32.57
32.75
31.85
21.99
MOO
35.20
24.25
22.94
23.76
30.65
32.28
29.49
21.77
TA-MOO
40.97
25.13
23.59
24.38
33.00
33.05
32.14
23.04
setting, when no task dominates others, TA-MOO still shows its effectiveness when improving the ASR in all tasks by around 5%. The significant improvement can be obscrved in all settings (excopt the setting on EfficientNet with the CIFARIO dataset) as shown in Table and demonstrates the generality of the regularization.
Results 4: TA-MOO achieves the best transferability
diverse set of ensembles.
Table 3 reports the SAR-All metric of transferred adversarial examples crafted from a source ensemble (RME) on attacking target ensembles (e.g., RMEVW is an ensemble of 5 models). A higher number indicates a higher success rate of attacking target model, therefore, also implies a higher transferability of adversarial examples. It can be seen that our TA-MOO adversary achieves the highest attacking performance on the whitebox attack setting, with huge gap of 9.24% success rate over the Uniform strategy. Our method also achieves the highest transferability regardless diversity of target ensemble. More specifically, on target models such REV, MEV, and RMEV, where members in the source ensemble (RME) are also in the target ensemble, our TA-MOO significantly outperforms the Uniform strategy, with the highest improvement is 5.19% observed target model RMEV. On the target models EVW and MVW which are less similar to the source model, our method still outperforms the Uniform stralegy by 1.46% and 1.65%. The superior performance of our adversary on the transferability shows another benefit of using multi-objective optimization in generating adversarial examples. By reaching the intersoction of all members' adversarial regions, our adversary is capable to generate a common vulnerable pattern on an input image shared across architectures, therefore, increasing the transferability of adversarial examples. More discussion can be found in Appendix D.1
8

---

Published in Transactions on Machine Learning Research (05/2023)
Table 4: Robustness evaluation of Adversarial Training methods on the CIFAR10 dataset. RME represents an ensemble of ResNet18 (R); MobileNet (M) and EfficientNet E), while MobiX3 represents an ensemble of three MobileNets. NAT and ADV measure the natural accuracy and the robust accuracy against PGD--inf attack (tthe higher the better). Other metrics measure the succoss attack rate (SAR) of adversarial examples generated by the same PGD-Linf attack on fooling each single member and all members of the ensemble (Jthe lower the better).
MobiX3
RME
NATT
ADVT
A-AIIL
A-Avgl
NATT
ADVI
A-AII
A-Avgl
PGD-AT
80.43
32.78
54.34
73.89
86.52
37.36
49.01
69.75
MinMax-AT
79.01
37.28
50.28
66.77
83.16
40.40
46.91
65.73
MOO-AT
79.38
33.04
46.28
74.36
82.04
37.48
45.24
70.11
TA-MOO-AT
79.22
38.22
48.21
67.83
82.59
41.32
43.68
65.09
4.2 Adversarial Training with TA-MOO for Ensemble of Models (ENS)
We conduct adversarial training with adversarial examples generated by MOO and TA-MOO attacks verify the quality of these adversarial examples and report results on Table 4 The detailed setting and more experimental results can be found in Appendix D.2 Result 1: Reducing transferability. It can be seen that the SAR-All of MOO-AT and TA-MOO-AT are much lower than that on other methods. More specifically, the gap of SAR-AIl between PGD-AT and TA-MOO-AT is (5.33%) 6.13% on the (non) diverse setting. The lower SAR-All indicating that adversarial examples are harder to transfer among ensemble members on the TA-MOO-AT model than on the PGD-AT model. Result 2: Producing more robust. single members. The comparison of average SAR shows that adversarial training with TA-MOO produces more robust single models than PGD-AT docs. More specifically, the average robust accuracy (measured by 100% A-Avy) of TA-MOO-AT is 32.17%, an improvement of 6.06% over PGD-AT in the non-diverse setting, while there is an improvement of 4.66% in the diverse setting. Result 3: Adversarial training with TA-MOO achieves the best robustness. More specifically, on the non-divese setting, TA-MOO-AT achives 38.22% robust accuracy, an improvement of 1% over MinMax-AT and 5.44% over standard PGD-AT. On the diverse setting, the improvement over MinMax-AT and PGD-AT are 0.9% and 4%, respectively. The root of the improvement is the ability to generate stronger adversarial examples in the the sense that they can challenge not only the entire ensemble model but also all single members. These adversarial examples lie in the joint insecure region of members (i.e., the low confidence region of multiple classes), therefore, making the decision boundarics more scparate. As a result, adversarial training with TA-MOO produces more robust single models (i.e., lower SAR-Avg) and significantly reduces the transferability of adversarial examples among members (i.e., lower SAR-All). These two conditions explain the best ensemble adversarial robustness achieved by TA-MOO.
4.3 Universal Perturbation (UNI)
Experimental setting. We follow the experimental setup in Wang et al. (021) where the full test set (10k images) is randomly divided into equal-size groups (K images per group). The comparison has been conducted on the CIFAR10 and CIFAR100 datasets, with an adversarially trained ResNet18 model and CW loss. We observed that the ASR-All was mostly zero, indicating that is difficult to generate a general perturbation for all data points. Therefore, in Table 5 we use ASR-Avg compare the performances of the methods. More experiments on VGG16 and EfficientNet models can be found in Appendix D.3
Results. [ the evaluation of generating universal perturbations the CIFAR10 and CIFAR100 datascts, respectively. K represents the number of images that are using the same perturbation. The larger the value of K, the harder it is to generate a universal perturbation that can be applied successfully to all images. It can be seen that with a small number of tasks (i.e., K=4), MOO and TA-MOO achieve lower performance than the MinMax method. However, with a large number of tasks (i.c, K 2 8), MOO and TA-MOO show their effectiveness and achieve the best performance. More specifically, on the CIFAR10 dataset, the improvements of MOO over the Uniform strategy are 5.6%, 4%, 3.2%, and 2.5% with K 8,
9

---

Published in Transactions on Machine Learning Research (05/2023)
Table 5: Evaluation generating Universal Perturbation on the CIEARIO and CIFÁRI00 datasets.
CIFAR10
CIFAR100
K=4
K=8
K=12
K=16
K=20
K=4
K=8
K=12
K=16
K=20
Uniform 37.52
30.34
27.41
25.52
24.31
65.40
58.99
55.33
53.02
51.49
MinMax
50.13
33.68
20.46
15.74
14.73
74.73
62.29
52.05
45.26
42.33
MOO
43.80
35.92
31.41
28.75
26.83
69.35
62.72
57.72
54.12
52.25
TA-MOO
48.00
39.31
34.96
31.84
30.12
72.74
68.06
62.33
57.48
54.12
Table 6: Robust adversarial examples against transformations evaluation, 1: Identity, H: Horizontal flip, V: Vertical flip, C: Center crop, G: Adjust gamma, B: Adjust brightness, R: Rotation.
A-All
A- A-Avg
I
V
C
G
B
R
Uniform
25.98
55.33
44.85
41.58
82.90
72.56
45.92
49.59
49.93
MinMax
30.54
52.20
43.31
41.59
78.80
64.83
44.38
46.53
45.97
C10
MOO
21.25
49.81
36.23
33.93
87.47
71.05
37.68
40.21
42.12
TA-MOO
31.10
55.20
44.15
41.86
85.19
71.86
45.53
48.70
49.54
Uniform
56.19
76.23
70.43
69.01
87.66
87.36
71.40
74.25
73.47
MinMax
59.75
75.72
70.13
69.26
87.45
86.03
71.54
73.30
72.32
C100
MOO
53.17
74.21
66.96
65.68
89.16
87.03
68.49
71.11
71.06
TA-MOO
60.88
76.71
70.43
69.37
89.11
87.95
71.70
74.73
73.69
= = 16, and K = 20, respectively. On the same setting, TA-MOO significantly improves MOO by around 4% in all the K settings and consistently achieves the best performance. Unlike the ENS setting, in the UNI setting, MOO consistently achieves better performance than the Uniform strategy. This improvement can be explained by the fact that in the UNT setting with the same architecture and data transformation, no task dominates the others. There will a case (a group) when one sample is extremely close to/far ffa from the decision boundary, and hence easier ausier/harte hardeer to fool. However, in the entire test with large number of groups, the issue of dominating tasks is lessened.
4.4 Robust Adversarial Examples against Transformations (EoT)
Results. Table f shows the evaluation the CIFAR10 and CIFAR100 datasets with 7 common data transformations.. It can be observed that (i) MOO has a lower performance than the baselines, (ii) the Task Oriented regularization significantly boosts the performance, and (iii) TA-MOO method achieves the best performance on both settings and outperforms the MinMax method 0.6% and 1.1% in the CIFAR10 and the CIFAR100 experiments, respectively. The low performance of MOO in observation (i) is again caused by the issue of one task dominating others. the EoT setting, it is because of the V-vertical flip transformation as shown in Table G. Observation (ii) provides another piece of evidence Task- Oriented regularization for MOO. This regularization boosts the ASRs in all the tasks (except V the dominant one), increases the average ASR by 5.45% and 2.5% in the CIFARI0 and CIFAR100 experiments, respectively.
support the effectiveness of the
4.5 Additional Experiments with Multi- Task Learning Methods
In this section would like to provide additional experiments with recent multi-task learning methods to explore how better constrained approaches can improve over the naive MOO. We applied three recent multi-task learning methods including PCGrad Yu el al. (2020). CAGrad Liu el. al. (2021a). and HVM Albuquerque et al. (2019) with implementation from their official repasitories into our adversarial generation task. We apply the best practice Albuquerque et al. (2019) which adaptively updated the Nadir point based on the current tasks' losses. For PCGrad we use the mean as the reduction mode. For CAGrad we parameter 0.5 and rescale in their default setting. We experiment attacking ensemble
10

---

Published in Transactions on Machine Learning Research (05/2023)
Table 7: Attacking Ensemble model with a diverse set D= V-VGG16, G- G-GoogLeNet, E- EfficientNeet and non-diverse ND= ResNets).
A-All
A-Avg
R/R1
V/R2
G/R3
E/R4
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
HVM
29.88
46.98
48.97
48.10
46.88
43.96
PCGrad
28.25
48.28
48.81
49.03
48.13
47.14
CAGrad
30.23
48.34
47.03
48.22
45.92
52.20
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
HVM
28.46
49.87
51.64
50.03
50.72
47.10
PCGrad
28.30
48.75
52.02
45.42
54.35
43.21
ND
CAGrad
35.22
51.07
54.22
47.84
55.24
46.97
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
of models setting with two settings, a diverse set with different architectures including R-ResNet18, V-VGG16, G-GoogLeNet, E-EfficientNet and non-diverse set ND with ResNet18 models.
It can be seen from the Table 7 that in the diverse ensemble setting, the three additional methods HVM, PCGrad and CAGrad significantly outperform the standard MOO method with the improvement gaps of SAR-All around 4.7%, 3% and 5%, respectively. In the non-diverse ensemble setting, while HVM and PCGrad achieve lower performances than the standard MOO method, CAGrad can outperform the MOO method with a 2.7% improvement. On comparison to the naive uniform method, the three methods also achieve better performance in both settings.
The improvement on the diverse set of HVM, PCGrad and CAGrad over the standard MOO method is more noticeable than the non-diverse set. It can be explained by the fact that on the diverse set of model architectures, there is huge difference in gradients among architectures, therefore, requires a better multi-task learning method to handle the constraint between tasks.
On the other hand, on both ensemble settings, our TA-MOO still achieves the best performance, with a huge gap of (5.8%) 7.8% compared to the second best method on the (non) diverse setting. It is because our method can leverage supervised signal from knowing whether task is achieved not focus improving unsuccessful tasks. It is huge advantage compared to unsupervised multi-task learning methods as MOO, HVM, PCGrad, and CAGrad.
5 Additional Discussion
In this section, we would like to summarize some important observations through all experiments while the complete discussion with detail can be found in Appendix
Correlation between the objective loss and attack performance. It is broadly accepted that to fool model, feasible approach is maximizing the objective loss (i.e., CE, KL, CW loss), and the higher the loss, the higher the attack success rate. While it is true when observing the same architecture, we found that it is not necessarily true when comparing different architectures. As shown in Figure [ with CW loss as the adversarial objective, it can be observed that there is a positive correlation between the loss value and the ASR, i.c., the higher the loss, the higher the ASR. However, there is no clear correlation observed when using CE and KL loss. Therefore, the higher weighted loss does not directly imply higher success rate for attacking ensemble of different architectures. The MinMax method (Wang et al.] 2021] which solely
11

---

Published in Transactions on Machine Learning Research (05/2023)
(a) CW
(b)
Figure 1: Loss (left fig) and ASR (right fig) of each task over all attack itcrations with the MinMax method. model0/1/2/3 represents R/V/G/E architecture, respectively.
weighs tasks' losses, therefore, is always appropriate achieve a good performance in all tasks. More discussion can be found in Appendix E.4
When does MOO work? On the one hand, the dominating issue is observed in all three settings (ENS, UNI, EoT). The issuc can be recognized by the gap of attack performance among tasks or by observing the dominating of one task's weight over others which is caused by a significant small gradient strength of one task on comparison with other tasks' strength as discussed in Section 4.1 The root of the dominating issue can be the natural of the setting (i.e., as EoT setting, when the large gap can be observed all methods) or the MOO solver.
On the other hand, if overcoming this issue, MOO outperform the Uniform strategy shown in Section 4.1 As discussed in Appendix 4.4 a simple memory can helps to overcome the infinite gradient issue and significantly boosts the performance of MOO or TA-MOO. Therefore, we believe that developing a technique to lessen the dominating issue might be potential exlension.
More efficient MOO solvers. Inspired by Sener Koltun (0018) in this paper we use multi-gradient descent algorithm (Deb] 2011) as MOO solver which casts the multi-objeetive problem to a single-objective problem. However, while Senerr & Koltun (2018) used Frank-Wolfe algorithm to project the weight into the desired simplex, than Frank-Woll algorithm, it has some weaknesses that might be target for future works. First, it cannot handle well the edge case which is the root of the dominating issue. Second, it does not work well in the case of a non-convex objective space as similar as other MOO scalarizing methods (Deb) 2011
parameterization with softmax to do the job. While this technique is much faster
6 Conclusion
In this paper, we propose Task Oriented Multi-Objective Optimization (TA-MOO), with specific applications adversarial generation tasks. We develop a geometry-based regularization term to favor the goal-unachieved tasks, while trying to maintain the the goal-achieved tasks. We conduct comprehensive experiments to showcase the merit of our proposed approach on generating adversarial examples and adversarial training. On the other hand, there are acknowledged limitations of our method such as weaknesses of the gradient-based solver and lacking theory on algorithm's convergence which might be target for future works.
Acknowledgements
This work was partially supported by the Australian Defence Science and Technology (DST) Group under the Next Generation Technology Fund (NGTF) scheme. The authors would like thank the anonymous reviewers for their valuable comments and suggestions.
12

---

Published in Transactions on Machine Learning Research (05/2023)
References
Isabela Albuquerque, Joao Montciro, Thang Doan, Breandan Considine, Tiago Falk, and Toannis Mitliagkas. Multi-objective training of generative adversarial networks with multiple discriminators. In International Conference on Machine Learning, pp. 202-211. PMLR, 2019.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 974-283,20 2018.
Emil Björnson and Eduard Jorswieck. Optimal resource allocation in coordinated multi-cell systems. Now Publishers Inc, 2013.
Emil Bjornson, Eduard Axel Jorswieck, Mérouane Debbah, and Bjorn Outersten. Multiobjective signal processing optimization: The way to balance conflicting metrics in 5g systems. IEEE Signal Processing Magazine, 31(6):14 23, 2014.
Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. Cambridge university press, 2004.
Wieland Brendel, Jonas Rauber, Matthias Kümmerer, Ivan Ustyuzhaninov, and Matthias Bethge. Accurate, reliable and fast robustness evaluation. In Advances in Neural Information Processing Systems, pp. 12861- 12871, 2019.
Anh Bui, Trung Le, He Zhao, Paul Montague, Olivier deVel, Tamas Abraham, and Dinh Phung. Improving adversarial robustness by enforcing local and global compactness. In Computer Vision- ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part XXVII, pp. 209 223. Springer, 2020.
Anh Bui, Trung Le, He Zhao, Paul Montague, Seyit Camtepe, and Dinh Phung. Understanding and achieving efficient robustness with adversarial supervised contrastive learning, arXiv preprint arXiv:2101.10027, 2021a.
Anh Tuan Bui, Trung Le, He Zhao, Paul Montague, Olivier deVel, Tamas Abraham, and Dinh Phung. Improving ensemble robustness by collaboratively promoting and demoting adversarial robustness. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 6831 6839, 2021b.
Anh Tuan Bui, Trung Lc, Quan Hung Tran, He Zhao, and Dinh Phung. A unified wasserstein distributional robustness framework for adversarial training, In International Conference on Learning Representations, 2022.
Rafael Caballero, Lourdes Rey, Francisco Ruiz, and Mercedes González. An algorithmic package for the resolution and analysis of convex multiple objective problems. In Multiple criteria decision making, pp. 275-284. Springer, 1997.
Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39 57. IEEE, 2017.
Carlos A Coello Coello. A comprehensive survey of evolutionary-baseed multiobjective optimization techniques. Knowledge and Information systems, 1(3):269 308, 1999.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. arXiv preprint arXiv:2003.01690, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateck Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fitth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021. URI. wttp://weww..e.eeee..ooooa.aaaan
13

---

Published in Transactions on Machine Learning Research (05/2023)
Kalyanmoy Deb. Multi-objective optimisation using evolutionary algorithms: an introduction. In Multi-objective evolutionary optimisation for product design and manulacturing, pp. 3-34. Springer, 2011.
Jean-Antoine Désidéri. Multiple-gradient descent algorithm (mgda) for multiobjective optimization. Comptes Rendus Mathematique, 350(5-6):313331) 2012.
Shangchen Du, Shan You, Xiaojie Li, Jianlong Wu, Fei Wang, Chen Qian, and Changshui Zhang. Agroe to disagree: Adaplive ensemble knowledge distillation in gradient space. Advances Neural Information Processing Systems, 33, 2020.
Matthias Ehrgott. Multicriteria optimization, volume 491. Springer Science & Business Media, 2005.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Represenlations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http:
Pengxin Guo, Yuancheng Xu, Baijiong Lin, and Yu Zhang. Multi-task adversarial attack. arXiv preprint MrXiv:2011.098241 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016.
G. Hinton, L. Deng, D. Yu, G. E. Dahl, A. Mohamed, N. Jaitly, A. Senior, V. Vanhoucke, P. Nguyen, T. N. Sainath, and B. Kingsbury. Deep neural nelworks for acoustic modeling in speech recognition: The shared views of four research groups. IEEE Signal Processing Magazine, 29(6))82-8)) 97, 2012.
Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andrectto, and Hartwig Adam. Mobilenets: Efficient convolutional noural networks for mobile vision applications. arXiv preprint EXXiv1174.00480) 2017.
Alex Krizhevsky Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Sany Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC 2018.
Xi Lin, Hui-Ling Zhen, Zhenhua Li, Qing-Fu Fu Zhang, and Sam Kwong, Pareto multi-task learning. Advances in neural information processing systems, 32, 2019.
Bo Liu, Xingchao Liu, Xiaojie Jin, Peter Stone, and Qiang Liu. Conflict-averse gradient descent for multi-task learning. Advances in Neural Information Processing Systems, 34:18878-1888 2021a.
Qiang Liu and Dilin Wang. Stein variational gradient descent: A general purpose bayesian inference algorithm. Advances in neural information processing systems, 29, 2016.
Xingchao Liu, Xin Tong, and Qiang Liu. Profiling pareto front with multi-objective stein variational gradient descent. Advances in Neural Information Processing Systems, 34, 2021b.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep lcarning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Debabrata Mahapatra and Vaibhay Rajan. Multi-task learning with user preferences: Gradient descent with controlled ascent in pareto optimization. International Conference on Machine Learning, pp. 15597-600 PMLR, 2020.
Kaisa Miettinen. Nonlinear multiobjective optimization, volume 12. Springer Science & Business Media, 2012.
14

---

Published in Transactions on Machine Learning Research (05/2023)
Seyed-Mohsen Moosavi-Dezfooli; Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEFE conference on computer vision and pattern recognition, pp- 1765 1773, 2017.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In Kamalika Chaudhuri and Ruslan Salakhuldinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, PMLR, 09-15 Jun 2019.
pp.
Haoxuan Qiu, Yanhui Du, and Tianliang Lu. The framework of cross-domain and model adversarial attack against deepfake. Future Internet, 14(2):46, 2022.
Hadi Salman, Andrew Iyys,, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533 3545, 2020.
Ozan Sener and Vladlen Koltun. Multi-task learning multi-objective optimization. Advances in neural information processing systems, 31, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:140% 14tiv:1409.15555 1556, 2014.
M. Spencer, Fickholt, and Cheng. A deep learning network approach to ab initio protein secondary structure prediction. JEEE/ ACM Trans. Comput. Biol. Bioinformatics, 12(1):103 112, January 2015. ISSN 1545-5963.
Takahiro Suzuki, Shingo Takeshita, and Satoshi Ono. Adversarial example generation using evolutionary multi-objective optimization. In 2019 IEEE Congress on evolutionary computation (CEC), pp. 2136 2144. IEEE, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http://arxiv. wrtps/////..baa//.2...... 6199
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanct, Scott Reed, Dragomir Anguclov, Dumitru Erhan, Vincent. Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1-9, 2015.
Mingxing Tan and Quoe Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, pp. 6105 6114. PMLR, 2019.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-600 6008, 2017.
Jingkang Wang, Tianyun Zhang, Sijia Liu, Pin- Yu Chen, Jiacen Xu, Makan Fardad, and Bo Li. Adversarial attack generation empowered by min-max optimization. Advances in Neural Information Processing Systems, 34, 2021.
Weiran Wang and Miguel A Parreira-Perpinán. Projection onto the probability simplex: An efficient algorithm with a simple proof, and an application. arXiv preprint ar arXiv:1309 130..154, 2013.
Eric Wong, Loslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2019.
Feiyang Ye, Baijiong Lin, Zhixiong Yue, Pengxin Guo, Qiao Xiao, and Yu Zhang. Multi-objective meta learning. Advances in Neural Information Processing Systems, 34, 2021.
15

---

Published in Transactions on Machine Learning Research (05/2023)
Tianhe Yu, Saurabh Kumar, Abhishek Gupta, Sergey Levine, Karol Hausman, and Chelsea Finn. Gradient surgery for multi-task learning. Advances in Neural Information Processing Systems, 33:5824-5836, 2020.
S. Zagoruyko and N. Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07144 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 7472 7482, 2019.
16

---

Published in Transactions on Machine Learning Research (05/2023)
APPENDIX
The Appendix provides technical and experimental details as well auxiliary aspects to complement the main paper. Briefly, it contains the following:
Appendix Discussion related work.
Appendix
B
Detailed proof and an illustration of our methods.
Appendix
Detailed description of experimental settings.
Appendix
D.1
Additional experiments on transferability of adversarial examples in the ENS setting.
Appendix D
Additional experiments on adversarial training with our methods.
Appendix
D.3
Additional experiments on the UNI setting.
Appendix D.4
Additional experiments on the EoT setting.
Appendix
D.5
Additional comparison on speed of generating adversarial examples.
Appendix 9
Additional experiments on sensitivity to hyper-parameters:
Appendix
D.7
Additional comparison with standard attacks attacking performance.
Appendix D.g
Additional experiments on allacking the ImageNet. dataset.
Appendix
Additional discussions on the dominating issue and when MOO can work.
Appendix
summary on the importance of Task- Sesk-Oriented regularization.
Appendix
Discussion on the limitation of MOO solver.
Appendix
Discussion on correlation between the objective loss and attack performance.
Appendix
E,5
Discussion on the conflicting between gradients in the adversarial generation task.
Appendix
E.6
Discussion on the convergence of our methods.
Appendix
B.7
Additional experiments with MOO with different initializations.
A
Related Work
proposed a multi-gradient descent algorithm for multi-objective optimization (MOO) which opens the door for the applications of MOO in machine learning and deep learning. Inspired by Désidéri (2012). MOO has been applied in multi-task learning
Oblti-Objective Optimization for multi-task learning.
Désidéri
2012)
(MTL) (Sener & Koltun 2018 Mahapatra Rajan 2020), few-shot learning (Ye al., 2021) ) and knowledge distillation (Du et al. 2020). Specifically, the work of (ener Koltun (2018) viewed multi-task learning
multi-objective optimization problem, where task network consists of shared feature extractor and task-specific predictor. The work of Mahapatra & Rajan (2020) developed gradient- based multi-objective MTL algorithm to find solution that satisfics the user preferences. The work of Lin et al. (2019) proposed a Pareto MTL to find set of well-distributed Pareto solutions which can represent different trade-ofls among different tasks. Recently, the work of Liu et al. (2021b) leveraged MOO with Stein Variational Gradient Descent (Liu Wang 2016) diversify the solutions of MOO. Additionally, the work of Ye et al. (2021)
proposed bi-level MOO which can be applied to few-shot learning. Finally, the work of Du al. applied MOO to enable knowledge distillation from multiple teachers.
2020
17

---

Published in Transactions on Machine Learning Research (05/2023)
Generating adversarial examples with single-objective and multi-objective optimizations.
Gen-
erating qualified adversarial examples is crucial for adversarial training (Madry et al. 2018 Zhang et al. 2019
Bui et al. 2021a 2022j. Many perturbation based attacks have been proposed, notably FGSM
[Goodfellow
ct al. 2015). PGD Maddy et al. 2018 TRADES (Zhang et al. 2019). CW (Carlini & Wagner
2017]. BIM
(Kurakin et al. 2018), and AutoAlaack (Croce& & Hein| 2020). Most adversarial allacks aim to maximize a
single objective, o-g,, maximizing the cross-entropy (CE) loss w.r.t. the ground-truth label (Madry et al.,
2018), maximizing the Kullback-Leibler (KL) divergence w.r.t. the predicted probabilities of a benign example
(Zhang et al.) 2019), or maximizing the CW loss (Carlini & Wagner 2017). However, in some contexts, we
need to generate adversarial examples maximizing multiple objectives or goals, e.g., attacking multiple models
Pang et al. 2019 Bui et al. 2020) or finding universal perturbations (Moosavi-Dezfooli et al. 2017).
The work of Suzuki et al. 2019 was a pioneering attempt to consider the generation of adversarial examples as a multi-objective optimization problem. The authors proposed a non-adaptive method basod on Evolutionary Multi- Multi-Objective Optimization (EMO0) Deb (2011) to generate sets of adversarial examples. However, the EMOO method is computationally expensive and requires a large number of evaluations, which limits its practicality. Additionally, the authors applied MOO without conducting an extensive study on the behavior of the algorithm, which could limit the effectiveness of the proposed method. Furthermore, the experimental results presented in the work are limited, which could weaken the evidence for the effectiveness of the proposed method.
To this end, the work of Wang et al. 2021 examined the worst-case scenario by casting the problem of interest as a min-max problem for finding the weight of each task. However, this principle leads to a problem of lacking generality in other tasks. To mitigate the issue, Wang et al. (2021) proposed regularization to strike balance between the average and the worst-case performance. The final optimization was formulated
as follow:
K Σ
w. wif((d) + 7 I| 1/K
max min Si WEA...
Where S((v) is the victim model's loss (i.e., cross entropy loss or KI. divergence) and 7 > 0 is the regularization parameter. The authors used the bisection method (Boyd et al.] 2004) with project gradient descent for the inner minimization and project gradient ascent for the outer maximization. There are several major differences in comparison to MOO and TA-MOO methods: (i) In principle, MinMax considers the worst-case performance only while our methods improve performance of all tasks simultaneously. (fi) MinMax weighs the tasks' losses to find the minimal weighted sum loss in its inner minimization, however, discussed in Section E.4 the higher weighted loss does not directly imply the higher success rate in attacking multi-lasks simultaneously. In contrast, our methods use multi-gradient descent algorithm (Deb) 2011) in order to increase losses of all tasks simultancously. (iit) The original principle of MinMax leads to the biasing problem to the worst-case task. The above regularization has been used to mitigate the issue, however, it considers all tasks equally. In contrast, our TA-MOO takes goal-achievement status of each task into account and focuses more on the goal-unachieved tasks.
Recently, Guo et al. (0200) proposed multi-task adversarial attack and demonstrated on the universal perturbation problem. However, Waig et al. (2021) | and ours can be classified as iterative optinization- based attack, Guo et al. (2020) requires a generative model in order to generate adversarial examples. While this line of attack is faster than optimization- ceimizatioonbaaed attacks at the inference phase, it requires to train a generator on several tasks beforehand. Due to the difference in setting, we do not compare with that work in this paper.
More recently, Qiu et al. (0022 proposed framework to attack a generative Deepfake model using the multi- gradient descent algorithm in their backpropagation step. While their method also use the multi- objective optimization for generating adversarial examples, there are several major differences to ours. Firstly, their method aims for a generative Deepfake model while our method aims for the standard classification problem which is the most common and important setting in AML, Secondly, we conduct comprehensive experiments to show that a direct and naive application of MOO to adversarial generation tasks does not work satisfactorily because of the gradient dominating problem. Most importantly, we propose the TA-MOO method which employs geometry-basel regularization term to favor the unsuccessful tasks, while trying to
18

---

Published in Transactions on Machine Learning Research (05/2023)
maintain the performance of the already successful tasks. We have conducted extensive experiments to show that our TA-MOO consistently achieves the best attacking performance across different settings. We also conducted additional experiments with SOTA multi-task learning methods which are PCGrad (Yu et al.) 2020) and CAGrad (Liu et al. 2021a) in Section 4.5 Compared to these methods, our TA-MOO still achieves the best. alacc performance thanks the Task Oriented regularization.
B Further Details of the Proposed Method
B.1 Proofs
Lemma 1. Sorting Wm into Us+1im such that uss1 2 Us+2 2 2 um Defining P =
max { + 1 S < m u, - Ej=ot1 us) > 00.
Denoting 7
1 (1 -2 Li u²), the projection
projs (w) can be computed as
0 - max {w, + 7,00
1 1sisa otherwise
projs (w);
Furthermore, the regularization Q (w) has the form:
(w))
(w; max (w; + +2 ?
(5)
Proof. The proof is based on Wang & Carreira- Perpinán 2013 with modifications. We need to solve the following OP:
1
min
2 w
2
s.t. : 2
|||||| 1.
We note that J = = T.
The OP of interest reduces to
min Te+1om
Σ
(Ti
w))
2
(=8+1
s.t. 1T++1mm 2 0
Σ nT 1.
i=
Using the Karush-Kuhni Kuhn-Tucker (KKT) theorem, we construct the following Lagrange function:
C C 7.
1
Σ ( - (m--w,)2 -
Σ
T
Σ
m
3
2
1=+1
1=++1
Sctting the derivative w.r.t. to zeros and using the KKT conditions, we obtain:
T::
- B, = 0, Vi = = 1,..,m
m
Σ T =1
i=++1
8; 0, प > 0,3,T
= 0, 1,...
19

---

Published in Transactions on Machine Learning Research (05/2023)
If n. > 0, B= = 0, hence TH W/ +
> O. Otherwise, if n. = 0, Ws +y= -B; < 0. Therefore, #s+ma has the same order as Im and we can arrange them as:
xst1 2 x22 2 ... 2 T > p- = mm 0.
Us+1 = Wo+1 2 Us+2 = Wo+2 2. uup = up 2 Up-1 =wp-1 2 2 um = um 20. 0.
It appears that 1 = Ei=st1 T3 = Σi=--1 _ = Σ 1= (wi +7) = Eissti wi + (0 8) 7-
Hence, we gain Y
-
p-s [ Σ Li=st1 wi]
1 p-s [1 - Σ 1=s+1 Ui] We now prove that p
max/ s + 1 i S m : Us +
1 Σラ 2j Uj > }
i-s
For i p, we have
1
p
Up
1-
Σ
Uj
Up + w + > O.
p
s
==++
For i < p, we have
u1 +
1
Σ
i
Uj
1
(i
s):
u + 1
Σ Uj
i s
s
j=8+1
j=st1
1
Σ
T2y
Wj
1=
==8+1
1
(Ty ws)
jmi+1
1
(i 8) (w) + +7)+ +
Σ T
j=i+1
p-1
1
(i 8) m +
> 0.
j=1+1
For i > p. we have
14
1-
Σ
Uj
1
(i 14 + 1
Uj
8
8
j=s+1
j=st1
P-1
1
(i 8) m
Σ
Σ Wj
j=st1
j=st1
w
Σ j=8+1
(TT - -wy)
Σ w/
s=p
(1 smws + (p 8 8-11 1)7
Σ w/
j=p
1
(p - 8 1)(w1 + +7) + >
(w) - w))
S 0.
==p
20

---

Published in Transactions on Machine Learning Research (05/2023)
V moo
Imoo
ma-ooo
1
2
V/
Vf2
V/1
V22
V/1
V
V
Visualization of standard MOO and TA-MOO solutions in a scenario of 2 goal-achieved tasks (V.i.2) and 2 goal-unachieved tasks (Vf(.)) (left) MOO; (middle) MOO on the set of goal-unachieved tasks only; (right) TA-MOO with a solution focuses more on the goal-unachieved lasks.
Figure 2:
Therefore, P max + Si m: un r (1 Ei-E)=tt1 uz) > 00. Finally, we also have max + 7,0), s 1,.., m and गं = 0, 1....
Theorem 1. The regularization 52 (w) has the following closed- foseed-form::
Ω (ww) = Σ w
1
1 -
Σ
W/
(6)
1=0+1
Proof. Recall = max 8 + 1 1 u4 + i-s
1
(1-i uz} > 0). Therefore, = m because we have
1
Ej Wj 0.
Um
1
Σ
Mj
Wm +
Wi
= +
m72
j=0t1
j=++1
It follows that
m
1
Σ
Wi
2 0.
i=st1
i=
1siss
projs (w);
max {wo, +,,0) = w. + otherwise
((w)=
W
2
(w, max {w, + 7,))2
W
2
u + (m s)??
i=8-1
2
m
2
Σ i=st1
W
Wi
171
B.2 Illustrations of How MOO and TA-MOO Work
Figure iillsttrates solutions of MOO and TA-MOO in scenario of 2 goal-achieved tasks (with corresponding gradients fff.2) and goal-unachieved tasks (with corresponding gradients Vffi,). As illustrated in the left figure, with standard MOO method, where all the tasks' gradients have been considered regardless their status and the solution associated with the minimal norm is the perpendicular vector as suggested by geometry (Sener& & Koltun 2018). If considering the goal-unachieved tasks only in the middle case, the MOO solution
21

---

Published in Transactions on Machine Learning Research (05/2023)
Table 8: Robustness performance models in the experiments
CIFARIO
CIFARIO0
Nat-Acc
Adv-Acc
Nat-Acc
Adv-Acc
R8sNet18
86.47
42.14
59.64
18.62
VGG16
84.24
40.88
55.27
16.41
GoogLeNet
88.26
41.26
63.10
19.16
EfficiintNett
74.52
41.36
57.67
19.90
MobileNet 76.52
31.12
WideResNet 88.13
48.62
is the edge case. However, this extreme strategy ignores all the goal-achieved tasks which might lead to the instability. The Task Oriented regularization strikes a balance bet ween the two aforementioned strategies as illustrated in the right figure. The method focuses more on improving the goal-unachieved tasks while spend less effort to maintain the goal-achieved tasks. With À 0 the TA-MOO optimal solution is equivalent to the standard MOO optimal solution while it becomes the MOO solution in the case of the goal-umachieved tasks only when X + co.
C
Experimental settings
General settings.
Through our experiments, we use six common architectures including ResNet18 HHe
et al.
2016), VGG16 (Simonyan & Zisserman, 2014), GoogLeNet (Szegedy et al., 2015), EfficientNet (B0)
(Tan & Le 2019), MobileNet Howard el al. (2017), and WideResNNel (with depth 34 and widen factor 10)
com We evaluate on the full testing set (10k) of two benchmark datasots which are CIFAR10 and CIFARI00
Zagoruyko & Komodakis 2016) with the implementation ofhttps://gittt
cifar
(Krizhevsky al. 2009). More specifically, the two datasets have 50k training images and 10k testing images, respectively, with the same image resolution of 32 32 x 3. However, while the CIFAR10 dataset has 10 classes, the CIFAR100 dataset has 100 classes and fewer images per class. Therefore, in general, an adversary is casier to attack a CIFAR100 model than a CIFAR10 one as shown in Table S We observed that the attack performance is saturated with standard training models. Therefore, to make the job of adversaries more challenging, we use Adversarial Training with PGD-AT (Madry et al.) 2018) to robustify the models and use these robust models as victim models our experiments. Specifically, we use the SGD optimizer (momentum 0.9 and weight decay
10=4) and Cosine Annealing Scheduler to adjust the learming rate with an initial value of 0.1 and train model in 200 epochs as suggested in the implementation above. We use PGD-AT Loo Maddy et al. 2018) with the same setting for both CIFAR10 and CIFAR100 datasets, ie., perturbation limitation e = 3/255, k = 20 steps, and step size = 2/255.
Method settings. In this work, we evaluate all the methods in the unlargeted allack setting with Lx norm. The attack parameters are the same among methods, i.e., number of attack steps 100, attack budget = 8/255 and step size Ti- 2/255. In our method, we use K=10 to update the weight in each step with learning rate nw = 0.005. Tradcoff parameter À = 100 all experiments. In MinMax (Wang et al. 2021 we use the same 7 = 3 for all settings and use the authors' implementation
Attacking ensemble model settings. In our experiment, we use an ensemble of four adversarially trained models: ResNet18, VGG16, GoogLeNet, and EfficientNet. The architecture is the same for both the CIFAR1O and CIFAR100 datasets except for the last layer which corresponds with the number of classes in each dataset. The final output of the ensemble is an average of the probability outputs (i.c., output of the softmax layer). We use three different losses as an object for generating adversarial examples including Cross Entropy (CE) (Madry et al. 2018 Kullback- Leibler divergence (KL) (Zhang et al. 2019). and CW loss CCrlini & Wagner 2017).
2https://gtthubaee http:://gghhbbbbbmmmmmmgggg/////
22

---

Published in Transactions on Machine Learning Research (05/2023)
Table 9: Data transformation setting. represents uniform sampling function and p represents probability excuse a transformation (e.g., flipping).
Deterministic
Stochastic
Identity
Identity
Identity
Horizontal flip Vertical flip
p
p 0.5
p 1
p 0.5
Center crop
scale 0.6
scale = UO0.6, 1.0)
Adjust brightness
factor = 1.3
factor = U(100, 1.3)
Rotation
angle 10
angle = U
Adjust gamma
gamma = 1.3
gamma = 1.3.7,1.3)
Universal perturbation settings. We follow the experimental setup in Wang et al. (2021). such that the full test set (10k images) is randomly divided into equal-size groups (K images per group). The comparison has been conducted on the CIFAR10 and CIFAR100 datasets, and CW loss. We use adversarial trained RosNet18, VGG16 and Efficient.Net as base models. We observed that the ASR-All was mostly zero, indicating that it is difficult to generate a general perturbation for all data points. Therefore, we use ASR-Avg compare the performances of the methods.
our experiment, we use common data transformations including I-Identity, H-HHriizntal flip, V-Vertical flip, C-Center crop, B-Adjust. brightness, R- R-Rotation, and G-Adjust gamma. The parameter setting for each transformation has been shown in Table g In the deterministic setting, a transformation has been fixed with one specific parameter, c.g., center cropping with scale of 0.6 adjusting brightness with factor of 1.3. While in the stochastic setting, a transformation has been uniformly sampled from its family, e.g., center cropping with a random scale in range (0.6, 1.0) or adjusting brightness with a random factor in range (1.0, 1.3). The experiment has been conducted on adversarially trained ResNet18 model with the CW loss.
Robust adversarial examples against transformations settings.
D Additional Experiments
D.1 Transferability of adversarial examples in the ENS setting
We conduct additional experiment to evaluate the transferability of our adversarial examples. We use ensemble (RME) of three models: ResNet18, MobileNet, and EfficientNet as source model and apply different adversaries to generale adversarial examples to this ensemble. We then use these adversarial examples to attack other ensemble architectures (target models), for example, RMEVW an ensemble of 5 models including ResNet18, MobileNet, EfficientNet,, VGG16 and WideResNeet. Table I0 reports the SAR-AIl metric of transferred adversarial examples, where higher number indicates a higher success rate of attacking target model, therefore, also implies higher transferability of adversarial examples. The first column (heading RME) shows SAR-All when adversarial examples attack the source model (i.e., the whitebox attack setting).
The Uniform strategy achieves the lowest transferability. It can be observed from Table 10 that the Uniform strategy achieves the lowest SAR in the whitebox attack setting. This strategy also has the lowest transferability in attacking other ensembles (except an ensemble RVW).
MinMax's transferability drops dissimilar target models. While MinMax achieves the second- best performance in the whitebox attack setting, its adversarial examples have low transfcrability when larget models are different from the source model. For example, in the larget model RVW where there is only one member of the target model from the source model (RME) (i.e., R or ResNet18), MinMax achieves a 93.75% success rate which is lower than the Uniform strategy by 1.28%. Similar obsorvation can be observed on target models EVW and MVW, where MinMax outperforms the Uniform strategy by just 0.2% and 0.6%, respectively.
23

---

Published in Transactions on Machine Learning Research (05/2023)
Table 10: Evaluation on the Transferability of adversarial examples. Each cell (row-ith, column-jth) reports SAR (higher is better) of adversarial examples from the same souree architecture (RME) with an adversary at row-ith to attack an ensemble column-jth. Each architecture has been denoted by symbols such as R: ResNet18, M: MobileNet, E: EfficientNet, V: VGG16, W: WedeRosNet. For examples, RME represents for ensemble of 18 MobileNet and Net. The highest/second highest performance is highlighted in Bold/ Underline, The table is copied from Table 3 in the main paper for reading comprehension purpose.
RME
RVW
EVW
MVW
RFV
MEV
RMEV
RMEVW
Uniform
31.73
25.03
22.13
22.73
29.50
28.44
26.95
20.50
MinMax
40.01
23.75
22.39
23.34
32.57
32.75
31.85
21.99
MOO
35.20
24.25
22.94
23.76
30.65
32.28
29.49
21.77
TA-MOO
40.97
25.13
23.59
24.38
33.00
33.05
32.14
23.04
TA-MOO achieves the highest transferability on a diverse set of ensembles Our TA-MOO adversary achieves the highest attacking performance on the whitebox attack setting, with a huge gap of 9.24% success rate over the Uniform strategy. Our method also achieves the highest transferability regardless diversity of target ensemble. More specifically, on target models such as REV, MEV, and RMEV, where members in the source ensemble (RME) are also in the target ensemble, our TA-MOO significantly outperforms the Uniform strategy, with the highest improvement is 5.19% observed target model RMEV. On the target models EVW and MVW which are less similar to the source model, our method still outperforms the Uniform strategy by 1.46% and 1.65%. The superior performance of our adversary on the transferability shows another benefit of using multi-objective optimization in generating adversarial examples. By reaching the intersection of all members' adversarial regions, our adversary is capable to generate a common vulnerable pattern on an input image shared across architectures, therefore, increasing the transfcrability of adversarial examples.
D.2 Adversarial Training with TA-MOO
Setting. We conduct adversarial training with adversarial examples generated by MOO and TA-MOO attacks to verify the quality of these adversarial examples. We choose an ensemble of MobileNet architectures (non-diverse set) and ensemble of 3 different architectures including ResNet18, MobileNet and EfficientNet (diverse set). To evaluate the adversarial robustness, we compare natural accuracy (NAT) and robust accuracy (ADV) against PGD-Linf attack of these adversarial training methods (the higher the better). We also measure the success atlack rale (SAR) of adversarial examples generated by the same PGD-Linf atlack on fooling each single member and all members of the ensemble (the lower the better). We use & = 10, e = 8/255, 77 = 2/2255 for adversarial training and PGD-Linf with & 20,c 8/255, 17 = 2/255 for robustness evaluation. We use SGD optimizer with momentum 0.9 and weight decay 5e-4. Initial learning rale 0.1 with Cosine Annealing scheduler and train 100 epochs.
Result 1. Reducing transferability. It can be seen that the SAR-All of MOO-AT and TA-MOO-AT are much lower than that on other methods. More specifically, the gap of SAR-AIl between PGD-AT and TA-MOO-AT is (5.33%) 6.13% on the (non) diverse setting. The lower SAR-AIl indicating that adversarial examples are harder to transfer among ensemble members on the TA-MOO-AT model than on the PGD-AT model.
Result 2. Producing more robust single members. The comparison of average SAR shows that adversarial training with TA-MOO produces more robust single models than PGD-AT does. More specifically, the average robust accuracy (measured by 100% A-Aug) of TA-MOO-AT 32.17%, an improvement of 6.06% over PGD-AT in the non-diverse setting, while there an improvement of 4.66% in the diverse selting.
Result 3. Adversarial training with TA-MOO achieves the best robustness. More specifically, the non-divese setting, TA-MOO-AT achives 38.22% robust accuracy, an improvement of 1% over MinMax-
24

---

Published in Transactions on Machine Learning Research (05/2023)
Table 11: Robustness evaluation of Adversarial Training methods on the CIFAR10 dataset. RME represents an ensemble of ResNet18 (R); MobileNet (M) and EfficientNet E), while MobiX3 represents an ensemble of three MobileNets. NAT and ADV measure the natural accuracy and the robust accuracy against PGD--inf attack (fthe higher the better). Other metrics measure the succoss attack rate (SAR) of adversarial examples generated by the same PGD-Linf attack fooling each single member and all members of the ensemble (Lthe lower the better). The highest/secone highest robustness is highlighted in Bold/Une Underline. The most important metric is emphasized in blue.
Arch
NAT1
ADV1
A-AlII
A-Avgl
R/M1
M/M24
E/M3/
PGD-AT
MobiX3
80.43
32.78
54.34
73.89
76.17
74.35
71.14
MinMax-AT
MobiX3
79.01
37.28
50.28
66.77
65.27
70.27
64.78
MOO-AT
MobiX3
79.38
33.04
46.28
74.36
71.25
74.53
77.29
TA-MOO-AT
MobiX3
79.22
38.22
48.21
67.83
68.04
67.37
68.07
PGD-AT
RME
86.52
37.36
49.01
69.75
65.81
75.24
68.21
MinMax-AT
RME
83.16
40.40
46.91
65.73
65.22
68.28
63.70
MOO -AT
RME
82.04
37.48
45.24
70.11
69.00
75.43
65.90
TA-MOO-AT
RME
82.59
41.32
43.68
65.09
63.77
68.98
62.51
AT and 5.44% over standard PGD-AT. On the diverse setting, the improvement over MinMax-AT and PGD-AT are 0.9% and 4%, respectively. The root of the improvement is the ability generate stronger adversarial examples in the the sense that they can challenge not only the entire ensemble model but also all single members. These adversarial examples lic in the joint insecure region of members (i.c., the low confidence region of multiple classes), therelore, making the decision boundaries more separate. As result, adversarial training with TA-MOO produces more robust single models (i.e., lower SAR-Avg) and significantly reduces the transforability of adversarial examples among members (i.c., lower SAR-AlI). These two conditions explain the best ensemble adversarial robustness achieved by TA-MOO.
D.3 Universal Perturbation (UNI)
Additional experimental results. In addition to the experiments on ResNet18 reported in Table 5 would like to provide additional experimental results on two other adversarial trained models VGG16 and EfficientNet shown in Table 12 It can be seen that, TA-MOO consistently achieves the best attacking performance on ResNet18 and VGG16, on both CIFAR10 and CIFAR100 datasets, with K 2 8.
Why does MOO work? As shown in Table 12 MOO consistently achieves better performance than the Uniform strategy (except for the setting with Efficient.Net on the CIFAR100 dataset). To find out the reason for the improvement, we investigate the gradient norm [f and weight w for the first, and second groups (as an example) and the average over 100 groups the testset as shown Table 13 can be seen that in the first. and second groups, there are some tasks that. have significantly low gradient strengths than other tasks. The gap of the strongest weakest gradient strength can be magnitude of 10 indicating the domination of one task over others. While this issue can cause the failure as in the ENS setting, however, in the UNI setting, the lowest gradient strengths in each group correspond to unsuccessful tasks (unsuccessful adversarial examples) and vice versa. Recall that we use the multi-gradient descent algorithm to solve MOO, which in principle assigns a higher weight for a weaker gradient vector. Therefore, in the UNI setting, while the dominating issue still exists, fortunately, the result still fits our desired weighting strategy (i.e., higher weight for an unsuccessful task and vice versa). Moreover, when there are a large number of groups (i.e., 100 groups), the issue of dominating tasks is alleviated. The average gradient strength is more balanced as shown in Table B This explains the improvement of MOO over the Uniform strategy in the UNI setting.
25

---

Published in Transactions on Machine Learning Research (05/2023)
40
PGD-AT
PGD-AT
40
MOO-AT
MOO-AT
35
TA-MOO-AT
TA-MOO-AT
35
30
Robust (%6
25
30
20
Robust
25
15
20
10
15
5
10
20
30
70
80
70
Natural Acc (%)
Natural Acc (%)
(a) MobiX3
(b) RME
Figure 3: Comparison progress three adversarial training mothods. The bigger marker size represents the later epoch. Each point represents the natural accuracy and robust accuracy against PGD-Linf attack on the testing set.
Table 12: Evaluation of generating Universal Perturbation on the CIFARIO and CIFAR100 datasets. R: ResNet18, V: VGG16, E: EfficientNet.
CIFAR10
CIFAR100
K=4
K=8
K=12
K=16
K=20
K=4
K-8
K=12
K=16
K=20
Uniform
37.52
30.34
27.41
25.52
24.31
65.40
58.99
55.33
53.02
51.49
MinMax
50.13
33.68
20.46
15.74
14.73
74.73
62.29
52.05
45.26
42.33
R.
MOO
43.80
35.92
31.41
28.75
26.83
69.35
62.72
57.72
54.12
52.25
TA-MOO
48.00
39.31
34.96
31.84
30.12
72.74
68.06
62.33
57.48
54.12
Uniform
37.76
30.81
27.49
25.94
24.46
66.87
61.49
58.53
56.29
54.98
MinMax
47.96
30.88
20.20
16.93
16.25
78.58
69.14
58.85
51.81
48.09
V
MOO
43.04
34.56
30.07
27.43
25.42
73.46
66.51
61,28
57.88
56.09
TA-MOO
46.58
38.33
32.32
29.16
26.56
75.57
71.86
67.22
62.99
59.19
Uniform
44.86
39.03
36.37
34.65
33.49
67. 07.55
60.99
57.35
54.84
53.57
MinMax
44.47
32.96
28.86
27.01
26.47
69.69
57.99
50.93
45.59
43.87
E
MOO
45.31
39.28
36.44
34.72
33.51
66.68
59.69
54.95
53.20
51.43
TA-MOO
46.74
37.95
33.95
31.71
30.41
70.40
63.78
58.17
53.26
50.66
26

---

Published in Transactions on Machine Learning Research (05/2023)
Table 13: Evaluation of generating Universal Perturbation (K=8) on the CIFAR1O dataset with ResNet18 architecture and MOO method. {Ti),=1 represents value for cach task (i.e., sample in a group). wi w1/w2 represents the weight of the first/second group of K samples, while w represents the the statistic of weight over all groups (mean VV, f(()i f((22) represents the gradient norm of the first group of K samples, while |Vsi(())|l represents the statistic of gradient norm over all groups (mean=tstd). Io/I1 represents the indicator function for successful (1) unsuccessful (0) task, while represents the the statistic of successful rate over all groups.
Ti
T2
T3
T4
T3
Te
T7
1.15el
3.45e-5
1.97--2
1.26e-4
1.27e0
1.0c-1
1.0ee1
9.91e0
wo To
0.0238 1
0.1861
0.1859
0.1861
0.1763
0.1862
0.0257
0.0299
0
0
0
0
0
1
9.70e0
1.59e1
4.32e-4
4.27c-4
1.25el
6.23e-5
2.91e-5
6.17e-6
0.0341
0.0167
0.1854
0.1854
0.0222
0.1854
0,1854
0.1854
0
0
0
4.93:6..6
4.23-6.97
5.1827.42
3.84
4.39:6604
6.6627.64
4.8247.48
5.25=7.17
w I
0.12#0.08
0.14=0.09
0,1240008
0.1320.08
0.1240.09
0.10=0.08
0.14+0.10
0.11=0.08
0.38.10.9
0.46
0.36:10.48
0.32.1048
0.38
0.48
0.32:10.17
0.40-10.49
D.4 Robust Adversarial Examples against Transformations (EoT)
We observed that FoT with the stochastic setting, adjusting gamma sometimes has the overflow issue resulting in an infinite gradient. Recall that our method using MGDA to solve MOO which relics on the stability of gradient strengths. Therefore, in the case of having infinile gradients, learning weight w is unstable, resulting lower performance in both MOO and TA-MOO.
To overcome the overflow issue, allocate memory to cache the valid gradient of each task in the previous iteralion and replace the infinite value in the current iteration with the valid one in the memory. The storage only requires a tensor with the same shape as the gradient (i.e., as the exact size of the input), therefore, it does not increase the computation resource significantly. As shown in Table [4] this simple technique helps to improve performance of TA-MOO by 5.3% on both the CIFAR10 and CIFAR100 datasets. also helps to improve performance of MOO by 0.8% and 4.8%, respectively. Finally, after overcoming the gradient issue, the TA-MOO achieves the best performance on the CIFARI00 dataset and the second best performance on the CIFAR10 dataset (0.4% lower in ASR-All but 0.8% higher in ASR-Avg when comparing to MinMax). This result provides additional evidence of the advantage of our method.
D.5 Generating Speed Comparison and Experiments' Stability
Generating Speed Comparison. Table 16 shows the average time to generate one adversarial example in each setting. The results are measured on the CIFARIO dataset with ResNet18 architecture in the Ensemble of Transformations (EoT) and Universal Perturbation (Uni) settings. We use 1 Titan RTX 24GB for the EoT experiment and Tesla V100 16GB each for the other experiments. is worth mentioning that our primary focus in this paper is showing the advantage of MOO and the Task-Oriented regularization in generating adversarial examples. Therefore, we did not try to optimize our inplementation in terms of generating time.
Experiments' Stability. We conduct an experiment with 5 different random seeds to generate adversarial examples for the ENS setting to evaluate the stability of experimental results on choosing random seed. The experiment on the CIFAR10 dataset, with an ensemble of 4 architectures including ResNet18, VGG16, GoogLeNet, and NfficientNet. We report mean and variation values in Table 17, can be observed that there is slight variation in attack performances across methods. The variation small enough compared to
27

---

Published in Transactions on Machine Learning Research (05/2023)
Table 14: Robust adversarial examples against transformations evaluation. The highest/second highest performance is highlighted in Bold/ hald//nderline. MOO* and TA-MOO* represent version with memory to overcome the infinite gradient issue in the stochastic setting.
Deterministic A-Avg
Stochastic
A-All
A-All
A-Avg
Uniform
25.98
55.33
31.47
50.55
MinMax
30.54
52.20
33.35
49.44
MOO
21.25
49.81
26.97
43.84
C10
TA-MOO
31.10
55.26
28.26
45.67
MOO
27.79
45.91
TA-MOO*
32.96
50.27
Uniform
56.19
76.23
59.89
73.73
MinMax
59.75
75.72
61.30
73.59
MOO
53.17
74.21
54.96
69.26
C100
TA-MOO
60.88
76.71
56.23
69.91
MOO
58.79
72.81
TA-MOO*
61.54
74.07
Table 15: Robust adversarial examples against. transformations evaluation. The highest/second highest performance is highlighted in Bold/Underline. The most important metric is emphasized in blue color. MOO and TA-MO0 represent version with memory to overcome the infinite gradient issue in the stochastic setting. I: Identity, H: Horizontal flip, V: Vertical flip, C: Center crop, G: Adjust gamma, B: Adjust brightness, R: Rotation.
A-All
A-Avg
1
H
V
C
G
B
R
Uniform
25.98
55.33
44.85
41.58
82.90
72.56
45.92
49.59
49.93
MinMax
30.54
52.20
43.31
41.59
78.80
64.83
44.38
46.53
45.97
D-C10
MOO
21.25
49.81
36.23
33.93
87.47
71.05
37.68
40.21
42.12
TA-MOO
31.10
55.26
44.15
41.86
85.19
71.86
45.53
48.70
49.54
Uniform
56.19
76.23
70.43
69.01
87.66
87.36
71.40
74.25
73.47
MinMax
59.75
75.72
70.13
69.26
87.45
86.03
71.54
73.30
72.32
D-C100
MOO
53.17
74.21
66.96
65.68
89.16
87.03
68.49
71.11
71.06
TA-MOO
60.88
76.71
70.43
69.37
89.11
87.95
71.70
74.73
73.69
Uniform
31.47
50.55
48.58
44.70
65.52
51.14
47.43
48.76
47.70
MinMax
33.35
49.44
47.35
44.45
62.78
51.75
46.32
47.13
46.34
MOO
26.97
43.84
40.62
38.45
57.65
48.55
40.41
40.71
40.47
S-C10
TA-MOO
28.26
45.67
42.80
39.66
61.98
47.92
41.80
43.01
42.54
MOO
27.79
45.91
42.43
39.65
62.11
51.44
41.62
42.21
41.92
TA-MOO
32.96
50.27
48.18
45.26
62.97
52.49
47.03
48.22
47.76
Uniform
59.89
73.73
73.19
71.15
79.73
74.81
72.05
73.10
72.10
MinMax
61.30
73.59
72.44
70.55
80.04
75.55
71.99
72.49
72.10
MOO
54.96
69.26
67.62
66.11
75.88
72.72
66.87
68.11
67.49
S-C100
TA-MOO
56.23
69.91
68.52
66.92
76.70
72.71
67.57
68.97
67.97
MOO
58.79
72.81
71.58
69.08
80.17
75.01
70.78
71.71
71.33
TA-MOO
61.54
74.07
72.95
70.95
80.94
76.22
72.22
73.21
72.00
28

---

Published in Transactions on Machine Learning Research (05/2023)
Table 16: Average time per sample for generating adversarial example. All experiments are measured on the CIFAR10 dataset, EoT and Uni are with ResNet18 architecture.
Ensemble (K=4)
EOT (K=7)
UniaK=12
Uni@K=20
Uniform MinMax
640ms
350ms
1850ms
3030ms
1540ms
610ms
1210ms
2080ms
MOO
1770ms
1130ms
5600ms
9280ms
TA-MOO
1960ms
1200ms
5870ms
9500ms
Stability of experiments' evaluation on different random seeds. Experiment on the ENS setting, with an ensemble of 4 models: Resnet18, VGG16, GoogleNet and EfficientNet.
Table 17:
A-All
A-Avg
R
V
G
E
Uniform
28.12 + 0.09
48.29 + 0.05
48.81 + 0.08
49.06 + 0.08
48.27 + 0.10
47.06 + 0.03
MOO
25.61 + 0.36
45.13 + 0.30
39.84 + 0.62
47.29
+ 0.36
37.51
+ 0.36
55.90
+ 0.17
TA-MOO
37.56 + 0.32
51.15 + 0.21
49.37 + 0.15
52.80 = 0.45
48.98 + 0.25
53.24 = 0.13
the gap between methods (i.e., the biggest variation is 0.32% in SAR-AIl while the smallest gap is 2.51% between MOO and the Uniform approach), therefore, making the comparison still reliable.
D.6 Sensitivity to Hyper-parameterr
In this section we provide an analytical experiment on the sensitivity of our TA-MOO method to the tradeoff x. The study has been conducted with the ENS setting with CE loss and the EoT setting with deterministic transformations using 18 architecture. All experiments are on the CTFAR10 dataset. The value of X is changed from 1 to 1000. It can be observed from Figure 4a (the ENS setting) that (i) increasing À reduces the performance of dominated task (i.e., ASR the EfficientNet decreases from 54.49% at X to 53.40% at A = 100) while increases performances of other tasks. In overall, it significantly increases the ASR-All performance of the entire ensemble from 29.14% at X = 1 to 38.01% at X = 100. (ii) However, over-high À (i.e., X >>>> 200) leads to the drop of performance in all lasks, resulting in a lower overall performance.
A similar observation can be seen in the EoT setting in Figure 4b The attack performance on the dominated task (V-Vertical flipping) decrcases from 86. 11% at X 50 to 83.67% at 200. In contract, in the same range of À the overall performance increases from 32.85% 34.36%. The performances of all tasks decrease when using too large À (i.e., À 200). Based on the result of this study, we choose X 100 in all the other experiments.
D.7 Comparison with Standard Attacks
We conducted additional comparison the ENS sctting to further confirm the effectiveness of method over standard adversarial attacks (which consider entire ensemble single model). More specifically, we compare with AutoAttack (Croce & Hein 2020), Brendel-Bethge attack (BB) (Brendel et al., 2019), Carlini-
attack (CW) (Carlini & Wagner 2017), and PGD attack (Madry et al. 2018). For AutoAttack, we use the standard version which includes 4 different attacks. For BB attack, we initialized with the PGD attk with 20 steps. For CW attack, we set the confidence factor to 1.0. We evaluate these attacks on 2 ensemble settings, a diverse (D) ensemble set with 4 diffcrent architectures (ResNet18, VGG16, GoogLeNet, and EfficientNet) and a non-diverse (ND) ensemble set with 4 ResNet18 architectures.
It can be seen from the Table 18 that our TA-MOO attack consistently achieves the best attack performance, with significant gap compared to the best standard attack. More specifically, our TA-MOO method achieves 38.01% (SAR-AIl metric) on the diverse ensemble set, while the second best allack is AuloAttack with 30.71% (a gap of 7.3%). On the non-diverse set, the gap between our TA-MOO and AutoAttack still notably large at 4%. These standard attacks consider an entire ensemble as a single model, i.c., aim optimize a single objective given a single ensemble output. Therefore, they cannot guarantee a successful attack on each member.
29

---

Published in Transactions on Machine Learning Research (05/2023)
all
all
55
50
86
50
85
45
ASR- V only (%)
ASR (%)
ASR (%)
84
40
35
83
35
30
82
30
0.0
0.5
1.0
1.5
2.0
2.5
3.0
0.0
0.5
1.0
1.5 log1olA)
2.0
2.5
3.0
10g1o(A)
ENS setting
(b) EoT setting
Figure 4: Sensitivity to the parameter X.
Table 18: Attacking Ensemble model with diverse set D= (R-RReeNeee V-VGG16, G-GoogLeNet, F- EfficientNet) and non-diverse set ND=(4 ResNets). Experiment the CIFAR10 dataset with cross-entropy objective loss. The most important metric is emphasized in blue.
A-All
A-Avg
R/R1
V/R2
G/R3
E/R4
PGD
28.21
48.34
48.89
49.08
48.38
47.03
CW
6.10
16.63
13.53
15.76
11.74
25.47
B&B
6.67
38.03
37.95
38.92
35.58
39.68
D
AutoAttack
30.71
45.49
48.32
45.83
47.25
40.56
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
PGD
28.17
48.75
51.94
45.55
54.15
43.34
CW
4.71
13.86
14.92
12.71
17.51
10.31
B&B
5.29
40.51
49.06
35.19
48.63
29.16
ND
AutoAttack
37.00
49.32
51.07
48.58
51.08
46.55
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
D.8 Attacking the ImageNet dataset
Experimental Setting. We conduct experiments on the ENS setting using the adversarial pre-trained models on the RobustBench (Croce et al. 2021). We use two sets of an ensemble to verify the importance of our Lask-oriented stralegy. The first set the robust ensemble (RE) set including robust. models: ResNet 18 (model ID: Salman2020Do. R18 (Salman et al., 2020), robust accuracy 25.32%), ResNet50 (model ID: Salman2020Do R50 (Salman et al. (2020). robust accuracy 34.96%) and ResNet50 (model ID: Wong2020Fast. [Wong et al. 2019), robust accuracy 26.24%). The second set is the less-robust ensemble (LE) which includes
models: ResNet18 (model ID: Salman2020Do R18), ResNet50 (model ID: Salman2020Do R50) and the
30

---

Published in Transactions on Machine Learning Research (05/2023)
Table 19: Evaluation attacking performance on the ImageNet dataset, RE/LE/TAR/UNTAS represents Targeted Attack/Untargen Attack, respectively. R18/ R18/R50/STD
Robust Ensemble/Less-Roon Robsst Ensemble/ Enseeble/Targeted represents robust ResNet18, robust ResNet50 and standard ResNet50 pre-trained model, respectively, The most important metric is emphasized in bluc.
A-All
A-Avg
R18/R18
R50/R50
R50/STD
RE-TAR
Uniform
29.58
39.38
42.50
32.22
43.42
MOO
29.66
39.73
42.86
32.32
44.00
TA-MOO
29.68
39.73
42.90
32.26
44.02
LE-TAR
Uniform
30.30
58.14
42.36
32.06
100.0
MOO
30.66
58.37
42.70
32.48
99.94
TA-MOO
30.68
58.25
42.54
32.36
99.86
RE-UNTAR
Uniform
48.58
60.11
64.22
51.72
64.38
MOO
48.68
60.20
64.30
51.82
64.48
TA-MOO
49.80
59.71
63.80
52.38
62.94
LE-UNTAR
Uniform
34.24
61.01
46.98
36.28
99.78
MOO
44.76
68.29
58.42
46.64
99.80
TA-MOO
49.46
70.74
61.26
51.14
99.82
standard training ResNet50 (model ID: Standard R50, robust accuracy 0%). We use both targeted attack and untargeted attack settings, with 4/255 and n 1/255 with 20 steps. We use 5000 images of the validation set to evaluate.
Experimental Results. We report experimental results with different settings in Table 19 where RE/LE/- TAR/UNTAN represents Robust Ensemble/ Besemble/Less-Roee Less-Robust Ensemble/ Targette Attack Attack/Untargeted Untargeted Attack, respectively. It can be seen that, in the robust ensemble setting (RE-TAR and RE-UNTAR), our MOO achieves similar performance compared to the baseline, while TA-MOO has further improvement over MOO, The gap of SAR-All between TA-MOO and the uniform weighting strategy is 0.1% in the targeted attack setting (RE-TAR), while that in the untargeted attack setting is 1.2%. In the less-robust ensemble setting (LE-TAR and LE-UNTAR), the improvement of our methods over the baseline higher than in the robust ensemble setting. With the gap of SAR-All between TA-MOO and the uniform strategy is 0.38% with the targeted attack setting (LE-TAR), while the gap in the untargeted setting (LE-UNTAR) is 15.22% a significantly higher. While it acknowledged that the targeted attack is more common protocol in attacking the ImageNet dataset (Athalye et al. 2018). however, we believe that significant improvement the untargeted attack is still worth noting.
We conduct an additional experiment on the EoT setting with the ImageNet dataset and report result in Table 20 In this experiment, we use the robust pretrained ResNet18 model (model ID: Salman2020Do R18) as the victim model. We use the standard attack setting, i.e., targeted attack with e = 4/255, v = 1/255 with 20 steps. can be seen that both MOO and TA-MOO could obtaín a better attack performance than the uniform strategy. It is a worth noting that, in the experiment on the CIFAR1O CIFARIO/CIFARIOO CCFFAR10 datasets (i.e., Table 6 in the main paper) the dominating issuc of the vertical filliping exists and prevents MOO to obtain belter performance. In the ImageNet dataset, the dominating issue is less serious, therefore, explains the improvement of MOO and corroborates our hypothesis on the issue of dominating task.
31

---

Published in Transactions on Machine Learning Research (05/2023)
Table 20: Evaluation on the EoT setting with the ImageNet dataset. The most important metric emphasized in blue.
A-AIl
A-Avg
H
V
G
B
Uniform
31.52
46.59
41.12
40.98
67.42
41.60
43.20
41.82
49.96
MOO
31.92
47.19
41.92
41.78
67.64
42.10
43.66
42.74
50.48
TA-MOO
32.00
47.21
41.94
41.80
67.66
42.06
43.70
42.80
50.52
Table 21: Evaluation of Attacking Ensemble model on the CIFAR10 (C10) and CIFAR100 (C100) datasets.
The highest/secore highest performance is highlighted in /old/Unne Underline. The table copied from Table in the main paper for reading comprchension purpose.
CW
CE
KL
A-All
A-Avg
A-All
A-Avg
A-All
A-Avg
Uniform
26.37
41.13
28.21
48.34
17.44
32.85
MinMax
27.53
41.20
35.75
51.56
19.97
33.13
C10
MOO
18.87
34.24
25.16
44.76
15.69
29.54
TA-MOO
30.65
40.41
38.01
51.10
20.56
31.42
Uniform
52.82
67.39
55.86
72.62
38.57
54.88
MinMax
54.96
66.92
63.70
75.44
40.67
53.83
C100
MOO
51.16
65.87
58.17
73.19
39.18
53.44
TA-MOO
55.73
67.02
64.89
75.85
41.97
53.76
Table 22: Attacking Ensemble model with a diverse set (= V-VGG16, G-GoogLeNet, E- EfficientNet] and non-diverse set ND=(4 ResNets). w represents the final w of MOO (mean + std). [[V]]( represents the gradient norm of each model (mean + std). The table copied from Table 2 in the main paper for reading comprehension purpose.
A-All A-Avg
R/R1
V/R2
G R/R3
E/R4
[Vs)((()
7.15 + 6.87
4.29 + 4.64
7.35 + 7.21
0.98 + 0.72
D
W
0.15 + 0.14
0.17
+...3
0.15 + 0.14
0.53 + 0.29
Uniform
28.21
48.34
48.89
49.08
48.38
47.03
MOO
25.16
44.76
39.06
46.83
37.05
56.11
TA-MOO
38.01
51.10
49.55
52.15
49.29
53.40
[Vff(())
8.41 + 8.22
6.68.L 6.95
7.36 + 6.03
5.67
+ 6.09
ND
w
0.23 + 0.21
0.24
0.23 + 0.19
0.30 + 0.21
Uniform
28.17
48.75
51.94
45.55
54.15
43.34
MOO
32.50
52.21
53.25
49.05
56.80
49.76
TA-MOO
41.01
57.33
58.88
55.32
60.81
54.29
32

---

Published in Transactions on Machine Learning Research (05/2023)
E
Additional Discussions
E.1 When does MOO Work?
The dominating issuc. On one hand, there is the dominating issue that happens in all the three settings. The issue can be recognized by the gap of atlack performance among lasks. For example, in Table 22 (i.e., the ENS setting with the diverse ensemble and MOO method), the gap between highest ASR (at EfficientNet) and lowest ASR (at GoogLeNet) is 19%. In the EoT setting, the problem is even worse: The largest gap observed 53.6% as shown in Table 15 (the highest ASR is 69%19 with Vertical flipping and the lowest ASR is 34.54% with Horizontal flipping in with MOO D-C10 setting). The dominating issue is also be recognized by the observation that significant small gradient strength of one task on comparison with other lasks' strength. For example, in Table 22 it can be seen that the gradient strength corresponding to the EfficientNet architecture (mean value is 0.98) is much lower than those of other architectures (mean values are at least 4.29). As the result, the weight corresponding to the EfficientNet. architecture is much higher than those of others.
The root of the dominating issue can be the natural of the setting (i.e., as shown in Table 15 with the EoT sctting, when the domination of the Vertical flipping task can be observed in all methods) because of the MOO solver which is discussed in Section
Overcoming the dominating issue. On the other hand, if overcoming this issue, MOO can outperform the Uniform strategy. For example, on attacking the non-diverse ensemble model (i.e., 4 ResNets) MOO surpasses the Uniform strategy by 4.3% and 3.5% in the ASR-AIl and ASR-Avg metrics, respectively. On generating universal perturbations, MOO outperforms the Uniform strategy in most of the settings. As discussed in Section D.4 a simple memory caching trick can helps to overcome the infinite gradient issue and significantly boosts the performance of MOO or TA-MOO. Therefore, we believe that developing a technique to lessen the dominating issue might be potential extension to further improve the performance.
Balancing among goal-unachived tasks. We observed in the EoT setting, the dominating issue is strictly serious when gradients of some tasks are much weaker than others. It is because of the natural of the transformation operations, therefore, this issue happens regardless status of the tasks. In the set of goal-unachieed tasks' gradients can exist a dominated one, resulting to a much higher weight of the dominated task. Therefore, in order to strike a more balance among goal-unachieved tasks, we apply an additional regularization which minimizes the entropy of goal-unachieved weights H(w) = -i=++1 -w; log wr, If all tasks have been achieved (i.e,, s = m) then the additional regularization will be ignored. This additional regularization helps to improve further 2% in the EoT setting.
E.2 Importance of the
Regularization.
In this discussion, we would like to provide more experimental results in the ENS and EoT scttings to further emphasize the contribution of the Task-Oriented regularization. Figure 5 shows the ASR of each individual task in the ENS setting with three losses and the FoT setting with ResNet18 architecture and deterministic transformations. As shown in Figure 5a] in the ENS setting, the MOO adversary produces much higher ASR on the EfficientNet architecture than other architectures with any losses. In contrast, the TA-MOO adversary has a lower ASR on the Efficient architecture but a much higher ASR on other architectures. Similar observation can be seen in Figure 5b such that the ASR corresponding to the V-flipping of MOO is slightly higher than that of TA-MOO, however, the ASR on other transformations of MOO is much lower than those of TA-MOO.
E.3 More Efficient MOO Solvers
Discussions on the weighted-sum method. One of the most common approaches to solve the MOO problem is the scalarizing method, which formulates a singlo-objective optimization (S00) such that the optimal solutions to the SOO problem are Pareto optimal solutions to the MOO problem. While this line of approach (e.g,, weighted-sum method) is suitable for end-to-end learning such deep learning, there are
33

---

Published in Transactions on Machine Learning Research (05/2023)
R-CE
MOO TA-MOO
Identity
MOO TA-MOO
80
50
V-CE
40
G-KL
H-Flip
60
Retation
30
20
20
10
G-CE
V-KL
V-Flip
Brightness
E-CE
R-KL
Crop
Gamma
(a) ENS setting
(b) BoT setting
Figure Comparison on the ASR of each individual task. R: ResNet18, V: VGG16, G: GoogLeNet, E: EfficientNet. CE: Cross-entropy loss, KL: Kullback-Leibler divergence, CW: Carmili- Carnili-Wagner loss
several acknowledged weaknesses: (i) the choice of utility function has a large impact on the computational complexity of the resulted SOO problem (Bjornson et al.) 2014 Björnson & Jorswicck] 2013); (ii) a small
change in weights may results in big changes in the combined objective (Caballero el al. 1997), and vice
versa, huge different weights may produce nearly similar result (Coello Coello 1999 (iii) does not work
well in the case of non-convex objective space (Deb) 2011).
One of the most common replacement for the weighted-sum method is the constraint method which is applicable to either convex or non-convex problem. Applying more efficient MOO solver might be one of the potential extensions of this work.
Discussions on the gradient descent solver. Inspired by Sener & Koltun (2018), in this paper we use multi-gradient descent algorithm (Deb 2011 MOO solver which casts the multi-objective problem to single-objective problem. While Sener & Koltun (2018) used Frank- Wolfe algorithm to project the weight into the desired simplex, we use parameterization with softmax instcad. Although this technique is much faster than Trank-Wolfe algorithm, it has some weaknesses that will be addressed in our future work. More specifically, the GD solver with softmax parameterization cannot handle well the edge case which is the root of the dominating issue. The snippet code E.3 provides minimal example of quadratic optimization problem similar in MGDA, where the goal to find w" = argmin Σ l|..g,112. The solver the Gradient weA..
Solver with softmax parameterization. With input, where none of elements dominates others, the solver works quite reasonable with the weights corresponding to 4 first elements one (corresponding to bigger strength). With input, where 95 > 91, the solver still works well where corresponding to the minimal strength Ø1 = 0.1. However, with inputy, the solver fails to find good solution (which should be = [1, 0, 0, 0J given that input). It is a worth noting that the main goal of this paper is to show the application of Multi-objective Optimization for generating adversarial examples and the impact of the Task-Oriented regularization. Therefore, while the issue of the gradient descent solver well recognized, did not take effort to try with better solver.
equal and less than the last 1
import torch
import torch functional F import torch optim optim
input_1 [0.1, 0.1, 0.1, 0.1, 0.21 normal case
input_2 [0.01, 0.1, 0.1, 0.1, 2c3]
34

---

Published in Transactions on Machine Learning Research (05/2023)
1aput_3 [0.001, 0.002, 0.002, 0.002. 2e3] doninating issue
init aaitaaaphaaai 20 0.2, 0.2, o.2, 0.2]
10 8 tensor (input_3)
11 alpha torch. tensor (init_alpha, requires_grad-Trus
12 opt Optin.80D(aalphaa 1r=1.0)
13
14 for step in range (20):
15
v aalotmaa dim=0)
16
loss = torch, square (torch. sum * g))
17
opt (e
18
loss. (ackvard))
10
opt.step()
print 20
formatt (step, w. detath () numpy ())
Result with input_1
step=19, =- [o. 20344244 0. 20344244 o. 20344244 0. 20344244 0 1862303)
24
Result with input_2
26
step-19, x- 999992222-- 5.582609e-07 5. 58586609e-07
5. 582609e-07 o.]
28
Result with 1nput_
27
19 w- -0 28042433 23985887 o 23985887
0 23985887 o.]
Listing 1: Python example of the Gradient Solver with softmax parameterization
E.4 Correlation between the Objective Loss and Attack Performance.
It broadly accepted that to fool a model, a feasible approach is maximizing the objective loss (i.e., CE, KT, CW loss), and the higher the loss, the higher the attack success rate. While it is true with the architecture, we found that it does not hold when comparing different architectures. Figure G shows the adversarial loss and the attack success rate for each model in the ENS setting. With the CW loss as the adversarial objective, it can be observed that there is a positive correlation between the loss value and the ASR, i.., the higher the loss, the higher the ASR. For example, with the same adversarial examples, the adversarial loss on Efficient.Ne is the highest and so is ASR. However, there is no clear correlation observed when using CE and KL losses. Therefore, the higher weighted loss does not directly imply higher success rate for attacking ensemble of different architectures. The MinMax method (Wang et al.) 2021) which solely weighs the tasks' losses, therefore, does not always achieve a good performance in all the tasks.
E.5 Conflicting between gradients in the adversarial generation task
In multi-task learning setting, conflicting between gradicnt is the common issuc to tackle with. More specifically, the gradients with respect to the (shared) model parameter of task Ji and lask Jj can have a negative correlation (i.e., cosine similarity between fe 8) and (0,)(0 is negative). However, in the adversarial generation task, consider the gradient with respect to the input (e.g., Vsf(6, 8)) to update the adversarial examples. As we explore through empirical experiments, the issue that we to deal with is not the gradient confliction problem but the gradient domination problem. These gradients with respect to the inputs can have a positive correlation but also have a huge difference in their strengths. In this specific challenge, the standard MOO which solely relies on the gradient strengths to calculated the weight for each task is strongly sensitive to the gradient domination problem and in some cases cannot. lead to a good solution as discussod in Appendix
To further support our hypothesis, we would like to provide a measurement on the cosine similarity between gradients different ensemble members on the ENS setting in Table 23 Each cell (row-ith, column-jth) of the Table reports the cosine similarity between gradient Vofi(ō) of model ith and gradient (ofz(8) of model jih (w.r.t. the same input 8). It can be seen that the gradients between different architectures has the positive correlation instead negative correlation. On the other hand, as shown in the last row, the gradient norm [f)] varies widely among architoctures. While this obscrvation is line with the widely accepted phenomenon about the transferability of adversarial examples, also does support our motivation to derive the TA-MOO method to improve the standard MOO.
35

---

Published in Transactions on Machine Learning Research (05/2023)
-09
2491
4100
4690
160
28
150
(a) CW
77
150
(b) CE
(c) KL
Figure 6: Loss (left fig) and ASR (right fig) of each task over all attack iterations with the MinMax method. model0/1/2 112/33 represents R/V/G/E architecture, respectively.
36

---

Published in Transactions on Machine Learning Research (05/2023)
Table 23: Correlation between gradients of ensemble members on ENS setting, Each cell (row-ith, column-jth) reports the cosine similarity (mean + std) between gradient (6)((6) of model ith and gradient (of of model jth (w.r.t. the same imput 6). The last row VVff( reports the gradient norm of each model. R: R8sNet18, V: VGG16, E: EfficientNet, G: G-GoogLeNet.
R
G
E
R
1.00++0.00
0.34+F0.15
0.44
0.35-F0.19
V
0.34+0.15
1.00
0.36:10.19
0.41#0.22
G
0.44+0.17
0.36+0.19
1.00=+0.00
0.41+00.18
E
0.35+0.19
0.41
0.41
1.00=
7.15 6.87
4.29 + 4.64
7.35 + 7.21
0.98 + 0.72
16
14
12
Uniform
10
PCGrad
CAGrad
8
MOO
6
TAMOO
4
2
0
20
40
60
80
100
Figure 7:
Norm of the gradient Vaf(E) over all attack iterations. Measure on the diverse set of the ENS
setting, with CE loss.
E.6 Discussion on the Convergence of our methods
In multi-task learning, the gradient of each task calculated with respect the (shared) model parameter (e.g., (0)(). Therefore, quantify the convergence of multi-task learning method, we can measure the gradient norm of the comment gradient direction to quantify the convergence of the model. The gradient norm is expected to be very small value when the model reaches to the Pareto optimality points. However, in adversarial generation problem, the gradient of each task is calculated with respect to the input (e.g., V (0) Therefore, unlike in the multi-task learning, there is a different behavior of gradient in the adversarial generation task. To verify our hypothesis, we mcasure the gradient norm of the gradient over allack iterations and visualize in Figure It. can be seen that the gradient norm of all attacks tends converge large value. It worth noting that we use projected gradient descent with loo in all attacks. Therefore, in cach attack iteration, the amount to update is not the gradient V,f 5) but the sign of it scaling with step size n7. However, there is still an interesting observation such that MOO and TA-MOO attack have a much lower gradient norm than other attacks.
We would like propose a simple alternative approach to quantify the convergence of our method in the adversarial generation setting. More specifically, leverage the advantage of the adversarial generation task
37

---

Published in Transactions on Machine Learning Research (05/2023)
48
45
35'
35
45
30-
30
43
20
modelll
model0
20
modell
modell
modelz
15
model2
modele
model3
40
10
10
all
100
80
100
artack heeration
attack Iteration
attack iberattion
attack Iteration
(a) MOO
(b) TA-MOO
Figure 8: Loss (left fig) and SAR (right fig) of each task over all attack iterations. modcl0/1/2/3 represents R/V/G/E architecture, respectively. The CW loss is used as the adversaries's objective function.
such that access to the label audit whether the task is successful or not. Therefore, we simply measure the loss and the success allack rate over all atlack iteralions as shown in Figure g
First, we would like to recall the definition of the Pareto optimality. Given m objective function f(ö) & fm (6)), the Parcto optimality 8* of the multi-objective optimization 8 = argmaxf(6) there no
feasible solution 8' such that is strictly better than 8* in some tasks (i.e., f((6') > fi(6") for some i) while equally good as d in all other tasks (i.e., f5(8") f8(),, * i). Bear this definition in mind, it can be seen from the loss progress of MOO attack in Figure Sa that (i) from iteration 1st to around itcration 10th all the losses are increased quickly showing that the method optimize elficiently; (ii) after iteration 10th, the loss w.r.t. the NeficientNet model (i.e., model3 in the legend) continually increases while other losses continually decrease. Therefore, any solution after iteration 10th do not dominate each other indicating that the method reaches the Pareto front.
On the other hand, can be seen from Figure 8b that the loss progress of our TA-MOO more stable. TA-MOO also can optimize to the optimal point efficiently as MOO does, however, after reaching the peak, the losses in all tasks are more stable than those in MOO. This observation indicates that the solutions after the peak point are also in the Pareto front but are more concentrated than those in MOO. It can explain the stability of the success attack rate in TA-MOO in Figure 8b) Comparing across both MOO and TA-MOO at their last iteration shows that while the loss w.r.l. the EfficientNel model (model3) in MOO is a bit higher than that in TA-MOO, these other losses w.r.t. V/G/E models in MOO is lower than those in TA-MOO, This observation indicates that term of losses, the solutions of MOO and TA-MOO do not dominate each other. However, the solution of TA-MOO more stable and leads better final atlacking performance.
E.7 Additional Experiments with Different initializations for MOO
In our method, the default initialization for the weight w is 1/m equally for all tasks. Therefore, one raising valid concern is that Might better initialization can help to boost the performance?. To answer this question, we first find the optimal initital weight by using the weight at the last iteration when running MOO and TA-MOO attacks with the default initialization. For example, as shown architectures, the average weight that MOO assigns for model R/V/G/E converging to 0.15/0.17/0.15 10.5// (sel A), respectively. The average weights' distribution learned by TA-MOO 0.19/0.25/0.19///// respectively. It is a worth noting that, consider each set of weights for each data sample separately, and the above weights are just the average over entire testing set (e.g., 10K sample), while the full statistic (mean + std) of weights can be seen in Table 2. In order to make the experiment to be more comprehensive with diverse initializtionss we use two additional sets including set C=(0.22, 0.23, 0.22, 0.33] and set. D=(0.24, 0.25, 0.24, 0.27].
Figure Da for the ENS setting with diverse
(set B),
Given these above four weights sets A/B/C/D, we then init the standard MOO with one of these above sets and adjust the learning rate The with three options 5e-3, 5e-5, 1e-8 and report results in Table 24 The
38

---

Published in Transactions on Machine Learning Research (05/2023)
0.375
0.50
50
0.350
0.40
40
0.300
0.35
3:30
0.2275
3:30
modelo
modell
0.25
20
modell
20
modell
modelz
0.225
model2
0.20
model3
model3
10
0.200
10
artack teeratinn
attbck Iteration
attack iterattoo
attack iteration
(a) MOO
(b) TA-MOO
0.7
50
0.5
30
30
0.2
10
sar
10
sar
20
40
60
80
100
20
40
60
80
100
20
40
60
80
100
20
40
60
80
100
atrack toration
attack
(c) MOO A with fw 5e-3
(d) MOO 8 with fw 5e-3
0.55
50
0.50
0.5
0.4
40
0.00
3
50.35
3030
modelo
0.30
modelo
20
20
modell
0.20
10
sar
0.15
60
80
100
20
60
80
100
20
40
60
80
100
20
40
60
80
100
(6) MOOC with
5e-3
(f) MOOD with 5e-3
Figure 9: Weight (left fig) and SAR (right fig) of each task over all attack iterations. model0/1/2/3 represents R/V/G/E architecture, respectively.
complete attacking progress can be seen in Figure g can be seen from Table 24 that better initialization does help to improve the performance of the standard MOO. The best setting is the initialization with set D and Na 5e-3 achieves 29.53% in A-All metric, 4.37% improvement over the default MOO initialization. It can be seen from the ion of the weights in Figure Do that even initializing with the converged weights (i.e., set A) from the pre-running attack, the weight of each task does not stand still but converges to a different value. It is another different bchavior adversarial generation task compared to the multi-task learning problem. On the other hand, despite of the exlensive luning, the performance of MOO still far below the TA-MOO approach, with the gap of 8.48% in A-All metric.
39

---

Published in Transactions on Machine Learning Research (05/2023)
Table 24: Attacking Ensemble model with a diverse set D=(R-ResNet18, V-VGG16, G-GoogLeNet, E- Neti.. MOO4/B/C/D is MOO with initial weights from set A/B/C/D, respectively. The denotes the learning rate to update for the weight w.
5e-3
?w = 5e-5
= 1e-8
4
28.64
29.18
29.12
MOO "
29.13
28.75
28.65
MOO
29.38
28.46
28.33
MOO
29.53
28.37
28.18
MOO
25.16
TA-MOO
38.01
40


Reviews:
[{"review_id": "9LYcf5hVuD", "reviewer": "Reviewer_z4J4", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\n\nPros.\n\n1. The paper is well-written and easy to follow.\n2. Sufficient technical and implementation details are presented, which is very helpful.\n3. Various setups of MMO in adversarial example generation are examined.\n4. The literature is sufficient, which is good.\n\n\n\nCons.\n\n1. No large-scale experiments. For example, investigations on ImageNet/Tiny-ImageNet are needed.\n2. The statement of C2 is unclear. For example, \"What is a comprehensive study\", \"What are the different aspects\", \"What is the particular focus\", and \"What are the dominant issues\". I feel the C1 and C2 overlapped.\n3. The biggest concern I have is the comparisons between Wang et al., 2021 and this paper. (A) The authors should unify the setups and enable the direct comparisons to the number listed in Wang et al., 2021; (B) The authors said \"the MinMax methods (Wang et al. 2021) which examine only the worst-case performance across all tasks\". It is not true. The min-max and regularization in Wang et al. 2021 will lead to a non-one-hot w vector to reweight all tasks. Therefore, Wang et al., 2021 also considers all tasks and assign more weight to tasks with the worse performance; (C) Actually, in my opinion, this paper is conceptually the same as Wang et al. 2021, which pays more attention to tasks that are goal-unachieved or have worse performance. Although their specific forms of regularizations are different, there still exists a need for more distinguishable designs. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Summary.\n\nThis paper is dedicated to developing improved approaches to generate adversarial examples. The authors point out that directly applying multi-objective optimization (MOO) is sub-optimal for adversarial example generation to achieve multiple objectives simultaneously. Because this naive fashion tends to maximize all goals equally. Instead, they design the task-oriented MOO to only maintain the goal-achieved tasks, and let the optimizer spend more effort on improving the goal-unachieved tasks. Comprehensive experiments with various setups are conducted.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Refer to the previous section.", "broader_impact_concerns": "I do not see any ethical concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "vMfCFPgB7Z", "reviewer": "Reviewer_7EC8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written and easy to follow.\n- A comprehensive study is presented in the paper to show the superior performance of the proposed TA-MOO framework.\n\nWeaknesses:\n- Selected baselines are not sufficient to support the advantages of TA-MOO.\n- The effects of the regularizer are not explicitly discussed in the paper. However, this is an essential part considering contributions claimed by the authors. At least the authors should provide some analyses of how $w$ is modified during the training, and whether the task is goal-achieved or not.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposed a new task-oriented multi-objective optimization, i.e., TA-MOO, framework, in which aims at reaching a balance between goal-achieved and goal-unachieved tasks. By introducing a geometry-based regularization term, TA-MOO demonstrated advantages in representative tasks in generating adversarial examples under different scenarios.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- It would be good if the authors can provide a detailed analysis of the convergence after introducing the regularization term. The existing analysis in the paper mainly focuses on how to derive the regularizer instead of its effects on the optimization problem.\n- More stronger baseline methods should be compared. In current form, only three simple and straightforward algorithms are not sufficient to show the effectiveness of TA-MOO. For example, multi-objective approaches in [1, 2, 3].\n- Multi-objective optimization should not be restricted to the domain of adversarial learning, and there are many other tasks involved in multiple training objectives. I am wondering how TA-MOO would perform on those different tasks such as image classification on different datasets.\n\n\n[1] Albuquerque et al. \"Multi-objective training of generative adversarial networks with multiple discriminators\", 2019.\n[2] Miranda et al. ”Single-solution hypervolume maximization and its use for improving generalization of neural networks”, 2016.\n[3] Navon et al. “Multi-Task Learning as a Bargaining Game”, 2022.", "broader_impact_concerns": "This paper investigates some small-scale datasets for academic use only, and does not arouse any ethical concerns from my perspective.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ZtkIc0A6Go", "reviewer": "Reviewer_gsLX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n\nThe method is well-motivated, generally applicable, and easy to understand. TA-MOO outperforms traditional MOO in different tasks.\n\nWeakness or suggestions:\n\n1. [Baselines] For the experiments, I think more baselines should be included for a comprehensive comparison. 1) The universal perturbation generation method [Moosavi-Dezfooli 2017] should be included. Although this method generates unbounded perturbations, you can always force the perturbations within an adversarial budget by projection. 2) For attacking ensemble models, I suggest the authors include the attack methods in https://openreview.net/forum?id=rkZvSe-RZ for a more comprehensive evaluation.\n\n2. Although the authors include the results of standard auto-attack in the appendix, it is still very meaningful to incorporate the adaptive step size in APGD in AutoAttack into TA-MOO to see if it can further improve the performance. If I understood correctly, the authors are using constant step size as said in the beginning of Section 4.\n\n3. I do not know why we need to fool all the sub-models in an ensemble model. If the output of the ensemble model is based on the vote of its sub-models, then successfully attacking the majority of the sub-models is enough to fool an ensemble model.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper reviews the limitations of current methods generating adversarial examples for multiple tasks, which uniformly treat different tasks. By contrast, this work proposes task-oriented multi-objective optimization (TA-MOO), which uses simplex regularizations to make the attack algorithms focus more on the unachieved tasks and therefore improve the attack success rate. Extensive experiments demonstrate the effectiveness and the advantages of TA-MOO over the traditional MOO methods.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "In general, this paper is interesting and well-written. I encourage the authors to address the concerns pointed out in the \"weakness\" part of the last section.\n\nIn addition, there are some minor typos in this manuscript. For example, in the \"generating universal perturbations\" section in page 5, the optimization problem should be to maximize $[f_1(\\delta), ..., f_B(\\delta)]$ instead of $[f_1(\\delta), ..., f_m(\\delta)]$, since there are $B$ data points in total. I suggest the authors do a comprehensive check on notation consistency.", "broader_impact_concerns": "From my point of view, there is no ethical implications or concerns raised by the methods in this work.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposed a new task-oriented multi-objective optimization (TA-MOO) framework to reach a balance between goal-achieved and goal-unachieved tasks. By introducing a geometry-based regularization term, TA-MOO demonstrated advantages in tasks of generating adversarial examples under different scenarios.

After author response, it received 2 Leaning Accept, and 1 Leaning Reject recommendations. On the one hand, reviewers agree that the paper is well written and a comprehensive study with many experiments is presented. The reviewers have raised many useful questions, and the authors have provided good answers to them during rebuttal. The additional results added during rebuttal are especially helpful. On the other hand, one reviewer mentioned that the questions regarding how w is changed during training and and whether the task is goal-achieved or not are not well answered. Also, the results on ImageNet seem limited. 

On balance, due to the careful writing and the comprehensive results that have already been provided in the paper (though mostly focused on small-scale CIFAR10 and CIFAR100), the editor thinks that the merits of this paper slightly outweigh the flaws, therefore, would like to recommend acceptance of the paper. The authors are encouraged to add more ImageNet results if bandwidth allows.
Decision: Accept (poster)