Paper:
There are two major paradigms of white-box adversarial attacks that attempt to impose input perturbations. The first paradigm, called the fix-perturbation attack, crafts adversarial samples within a given perturbation level. The second paradigm, called the zero-confidence attack, finds the smallest perturbation needed to cause misclassification, also known as the margin of an input feature. While the former paradigm is well-resolved, the latter is not. Existing zero-confidence attacks either introduce significant approximation errors, or are too time-consuming. We therefore propose MARGINATTACK, a zero-confidence attack framework that is able to compute the margin with improved accuracy and efficiency. Our experiments show that MARGINATTACK is able to compute a smaller margin than the state-ofthe-art zero-confidence attacks, and matches the state-of-the-art fix-perturbation attacks. In addition, it runs significantly faster than the Carlini-Wagner attack, currently the most accurate zero-confidence attack algorithm.

Review:
The authors propose a new method for constructing adversarial examples called MarginAttack. The method is inspired by Rosen's algorithm, a classical algorithm in constrained optimization. At its core, Rosen's algorithm (instantiated for adversarial examples) alternates between moving towards the set of misclassified points and moving towards the original data point (while ensuring that we do not move too far away from the set of misclassified points). The authors provide theoretical guarantees (local convergence) and a broad set of experiments. The experiments show that MarginAttack finds adversarial examples with small distortion (as good as the baselines or slightly better), and that the algorithm runs faster than the Carlini-Wagner (CW) baseline (but slower than other methods).
The authors make a distinction between "fixed perturbation" attacks and "zero confidence" attacks. The former finds the strongest attack within a given constrained set, while the latter finds the smallest perturbation that leads to a misclassification. Method such as projected gradient descent fall into the "fixed perturbation" category, while MarginAttack and CW belong to the "zero confidence" category. The authors claim that zero confidence attacks pose a harder problem and hence mainly compare their experimental results to the CW attack. Indeed, their results show that MarginAttack is 3x - 5x faster than CW and sometimes achieves smaller perturbations.
First of all, I would like to emphasize that the authors conducted a thorough experimental study on multiple datasets using multiple baseline algorithms. Unfortunately, the comparison to CW and PGD still leaves some questions in my opinion:
- The authors state that CW does an internal binary search over the Lagrangian multiplier, and that this search goes for up to 10 steps. As a result, it is not clear whether the running time benchmarks are a fair comparison since MarginAttack does not automatically tune its parameters. To the best of my knowledge, the CW implementation in Cleverhans is specifically set up so that the user does not need to tune a large number of hyperparameters (the implementation accepts a running time overhead to achieve this). Since MarginAttack also contains multiple hyperparameters (see Table 4), it would be interesting to see how the running time of MarginAttack compares to that of a tuned CW implementation without the binary search.
- The authors explicitly state that the step sizes for CW were tuned for best performance, but do not mention this for PGD. For a fair comparison, the step sizes used for PGD should also be (approximately) tuned. Moreover, it is not clear why PGD is only used for an l_inf comparison and not a l_2 comparison.
- In the introduction, the authors emphasize the distinction between fixed perturbation attacks and zero confidence attacks. However, from an optimization point of view, these two notions are clearly related and a fixed perturbation attack can be converted to a small perturbation / zero confidence attack via a binary search over the perturbation size. While one would indeed expect an overhead due to the binary search, it is not clear a priori how large this overhead needs to be to achieve a competitive zero confidence attack with PGD (especially with a tuned step size for PGD, see above).
I would be grateful if the authors could provide their view on these points. Until then, I will assign a rating of 5 since tuning the parameters of optimization algorithms is crucial for a fair comparison.
Additional comments:
- In the introduction, the authors equate white-box attacks with access to gradient information. But generally a white-box attack is understood as an attack that has arbitrary access to the target network. It may be helpful for the reader to clarify this.
- In the second paragraph of the introduction, the authors claim that fixed perturbation attacks and zero confidence attacks differ significantly. But as pointed out above, it is possible to convert a fixed perturbation attack to a zero confidence attack via a binary search. So it is not clear that there is a large gap in difficulty. Moreover, the authors state that fixed perturbation attacks often come with theoretical guarantees. But to the best of my knowledge, there is no comprehensive theory that describes when a fixed perturbation attack should be expected to succeed in attacking a commonly used neural network.
- On top of Page 2, the authors claim that zero-confidence attacks are a more realistic attack setting. Why is that?
- The authors state that JSMA (Papernot et al., 2016) is one of the earliest works that use gradient information for constructing adversarial examples. However, L-BFGS as employed by Szegedy et al., 2013 also uses gradient information. Moreover, the authors may want to cite the work of Biggio et al. from 2013 (see the survey https://arxiv.org/abs/1712.03141).
- Since all distances referred to by d(x, y) seem to be norms (and the paper relies on the existence of dual norms), it may be more clear for the reader to use the norm notation || . || from the beginning.