Paper: Revisiting DeepFool: generalization and improvement (ICLR-2024)

Reviewer comment (Experiments):
SDF appears to consequently require more gradient steps than DF. As such the comparisons in Tab. 2/3/4 are hardly fair. As an additional row in the table, it would be fair to restrict the number of gradients in SDF to the number of DF steps.

Author response:
> SDF appears to consequently require more gradient steps than DF.

Our claim is that, in comparison to other algorithms, SDF offers the best tradeoff between computational cost and accuracy. As illustrated in Figure 1, compared to DF, SDF incurs a slightly higher computational cost but significantly gains in accuracy.

By design, both SDF and DF do not allow control over the number of gradient computations. They typically stop once a successful adversarial example is found. Terminating the process prematurely could prevent them from finding an adversarial example. One naive way would be the following: limiting SDF to a single iteration would equate its computational cost to DF, but this would essentially make SDF identical to DF, hence not a useful comparison.

Reviewer comment (Experiments):
As the goal is to improve DF, comparisons to DF are missing in Tab. 5/19/20.

Author response:
> As the goal is to improve DF, comparisons to DF are missing in Tab. 5/19/20.

DF, developed nearly eight years ago, has been demonstrated in various instances [1], [2], and [4] to be fast but no longer the SotA in identifying minimal adversarial perturbations. Therefore, we primarily conducted our experiments using SotA $\ell_2$ attacks. Table 1 is the exception, where we included a comparison with DF, as it was pertinent to compare SDF to DF – given that SDF is a modified version of DF.

But for the sake of completeness, we will include DF in the tables as suggested by the reviewer. Here are the corresponding results for DF:

- In Table 5: the median $\ell_2$ norm: 6.1, fooling rate: 96.2%.
- In Table 19:  the median $\ell_2$ norm: 1.51, fooling rate: 100%.
- In Table 20: Naturally trained model: the median $\ell_2$ norm: 0.17, per-sample time: 0.21s. Adversarially trained models (R1): the median $\ell_2$ norm: 2.1, per-sample time: 1.32s.

Reviewer comment (Experiments):
The comparison in Sec. 4.3 against DDN is not fair and thus not meaningful: 1) SDF is trained with different hyperparameters - most notably with more epochs: (200 + 60) instead of (200 + 30). A fair comparison would require training with identical parameters. 2) The results are single-run/seed. Expressive results would require at least 3 runs and error bars - especially for unstable training methods like AT.

Author response:
> The comparison in Sec. 4.3 against DDN is not fair…

Thank you for the suggestion. We reran our experiments using three different random seeds for training, and we set the number of epochs used in the DDN paper. Despite these adjustments, our findings remain consistent: SDF AT continues to outperform DDN AT.

| Attack | SDF Mean (std) | SDF Median (std) | DDN Mean (std)| DDN Median (std)|
|--------|------------------|-------------------|----------|------------|
| DDN    | $1.01~(0.05)$             | $1.00~(0.01)$               | $0.80~(0.08)$     | $0.68~(0.05)$       |
| FAB    | $1.07~(0.06)$             |  $1.01~(0.03)$               | $0.90~(0.1)$     | $0.71~(0.2)$       |
| FMN    | $1.40~(0.2)$             | $1.38~(0.4)$              | $1.41~(0.2)$     | $1.39~(0.3)$        |
| ALMA   | $1.07~(0.03)$             | $1.01~(0.1)$              | $0.80~(0.07)$     | $0.68~(0.06)$        |
| SDF    | $\mathbf{1.00}~(0.01)$         | $\mathbf{0.98}~(0.03)$          | $0.80~(0.02)$       | $0.69~(0.08)$        |

Reviewer comment (Experiments):
"SDF adversarially trained model does not overfit to SDF attack" - this statement can - in general - not faithfully be made on a single training run and should be either backed theoretically or empirically on multiple architectures (with reported error bars).

Author response:
> "SDF adversarially trained model does not overfit to SDF attack”…

We hope that the experiment done above has addressed this issue, too.

Reviewer comment (Novelty):
The research field has largely moved on from minimum-norm- and/or $\ell_2$-based adversarial attacks and is mostly focusing on $\ell_\infty$-bounded attacks (if at all). As such, this submission may not be that relevant to the ICLR community.

Author response:
> The research field has largely moved on from minimum-norm…

We respectfully disagree with the reviewer. The reasons for using $\ell_2$ norm perturbations are manifold:

- We acknowledge that $\ell_2$ threat model may not seem particularly realistic in practical scenarios (at least for images); however, it can be perceived as a basic threat model amenable to both theoretical and empirical analyses, potentially leading insights in tackling adversarial robustness in more complex settings. The fact that, despite considerable advancements in AI/ML, we are yet to solve adversarial vulnerability, motivates part of our community  to return to the basics and work towards finding fundamental solutions to this issue.
    
- In particular, thanks to their intuitive geometric interpretation, $\ell_2$ perturbations provide valuable insights into the geometry of classifiers. They can serve as an effective tool in the "interpretation/explanation" toolbox to shed light on what/how these models learn.

- Moreover, it has been demonstrated that (see, for example,[4] and [9]), $\ell_2$ robustness has several applications beyond security.
      
- While not the most compelling reason, the continued interest of the community in $\ell_2$ perturbations is evidenced by publications in top venues, including FMN [7] in NeurIPS 2021, DDN [5] in CVPR 2019, ALMA [10] in ICCV 2021, FAB [8] in ICML 2021, among many others.

Reviewer comment (Reproducibility):
How are perturbations "renormalized" for AutoAttack++?

Author response:
> How are perturbations "renormalized" for AutoAttack++?

For a given $\epsilon$ for AA++, if the norm of perturbation generated by SDF is greater than $\epsilon$, we apply a scalar multiplication to bring its $\ell_2$-norm down to $\epsilon$. Hence, we ensure that all the norms of all SDF perturbations are at most $\epsilon$.

Reviewer comment (Evaluation):
Why does AA++ perform worse for R4?

Author response:
> Why does AA++ perform worse for R4?

For this particular model, we identified a few samples that SDF could not successfully fool, whereas APGD$^\top$ did. Therefore, we explored an alternative version of AA++ where we included SDF alongside the set of attacks, rather than replacing APGD$^\top$ with it, ensuring the preservation of AA’s original performance.

Reviewer comment (Experiments):
the other attacks are tested with default hyperparameters

Author response:
> The other attacks are tested with default hyperparameters…

To ensure a fair comparison, for each dataset, we selected hyperparameters for each attack based on those recommended in their respective papers. The assumption was that the authors of these papers have either fine-tuned these parameters or claimed that their methods are not highly sensitive to them.

Given that comprehensive hyperparameter tuning for each attack across every model and dataset would be infeasible for us, we experimented with different variations of the attacks by varying their number of iterations (as detailed in Table 3). We consistently aimed to select this parameter so that it would work in favor of their performance. However, we acknowledge the possibility that there may still be hyperparameter settings for each (attack, model, dataset) combination that could equalize the performance of all attack algorithms. Similar scenarios have been observed previously in the context of training algorithms and GANs, (Lucic et al. “Are GANs Created Equal? A Large-Scale Study”, NeurIPS 2018.)

This further highlights the importance of designing algorithms with fewer number of hyperparamters such as SDF.

Reviewer comment (Experiments):
the attack is not adaptive per-se, hence it can be blocked by gradient obfuscation or other defenses that break gradient descent. Is the attack easy to adapt in these cases (e.g., application of EoT to smooth the loss landscape, change of loss to incorporate detectors, ...)

Author response:
> The attack is not adaptive per-se…

We acknowledge that, generally, extending geometric attacks to such cases is not immediately apparent. However, we do not view this as an inherent limitation of geometric attacks like DF and SDF. Instead, we believe the community's focus to obtain adaptive attacks has primarily been on loss-based attacks such as PGD, which allow for easy modification of the loss. Investigating ways to adapt geometric attacks could be of interest, particularly due to their computational benefits

Reviewer comment (Theory):
the attack is still an empirical attack, thus the authors should discuss that even with the best optimization process there are no guarantees that the points found are global minima of the optimization function.

Author response:
> The attack is still an empirical attack…

This indeed can be said about almost any gradient-based optimization technique applied to non-convex problems. As such, we thought it is evident from the context that there is no guarantee for finding the globally optimal perturbations for state-of-the-art neural networks—*neither for us nor for any other attacks we are aware of*. We apologize if our wording caused such confusion. If there is any specific sentence in the text implying otherwise, we would be grateful if the reviewers could point them out to us.

Reviewer comment (Theory):
the attack formulation only works for the L2 norm

Author response:
> The attack formulation only works for the $\ell_2$ norm.

We had reasons to limit the scope of the paper to $\ell_2$ perturbations. We believed this approach would more clearly convey our meta-message, as summarized by Reviewer 34Xw: ”the importance that fundamentally 'classic' approaches, if done right, might still serve as a strong baseline". Anyway, we tried a simple idea to see the potential of our approach in finding $\ell_\infty$ perturbations, and it worked. We replaced the orthogonal projection with the $\ell_\infty$ projection.

We present our findings about the $\ell_\infty$ norm for two robust models M1 and M2 in the following table.

| Attacks | M1    |  FR   | Grads | M2   | FR   | Grads |
|---------|------------|---------|-------|------|------|-------|
|     DF     | 0.031 | 96.7   | 24| 0.043 | 97.4 | 31|
| FAB    | 0.025 | 99.1   | 100   | 0.038 | 99.6 | 100   |
| FMN   | 0.024 | 100 | 100 | 0.035 | 100 | 100 |
| SDF     | **0.019** | 100 | 33  | **0.027** | 100 | 46   |

Reviewer comment (Experiments):
analysis of complementarity with AA, do the two attacks find smaller perturbations for different points? This could suggest whether the best strategy is to add it to the ensemble or to remove directly some of the sub-optimal attacks of AA (e.g., FAB that seems sub-optimal w.r.t. the proposed method). Additionally, in AA the attacks are used in a cascade manner, i.e., if the first attack finds an adversarial perturbation within the eps bound, the other attacks are not launched. Would SDF be launched before or after, e.g., APGD?

Author response:
> Analysis of complementarity with AA, do the two attacks find smaller perturbations for different points? This could suggest whether the best strategy is to add it to the ensemble or to remove directly some of the sub-optimal attacks of AA (e.g., FAB that seems sub-optimal w.r.t. the proposed method). Additionally, in AA the attacks are used in a cascade manner, i.e., if the first attack finds an adversarial perturbation within the eps bound, the other attacks are not launched. Would SDF be launched before or after, e.g., APGD?

Our decision to replace APGD$^{\top}$ with SDF was primarily motivated by the former being a computational bottleneck in AA. As it is shown in Table 8, AA and AA++ achieve similar fooling rates, with AA++ being notably faster. Following your suggestion, we compared the sets of points that were fooled or not fooled by SDF/APGD$^{\top}$ across 1000 samples ($\epsilon=0.5$). The results indicate that both algorithms fool approximately the same set of points, differing only in a handful of samples for this epsilon value. Therefore, the primary benefit of using SDF is the reduction in computation time.

|                      | SDF Can Fool | SDF can't Fool |
|----------------------|--------------|----------------|
| APGD$^{\top}$ Can Fool | 995          | 2              |
| APGD$^{\top}$ Can't Fool| 3            | 5              |

We are currently conducting experiments to provide a comprehensive analysis, which includes substituting SDF with various attacks, integrating SDF into the mix, etc. Given that they are time-consuming, it may not be feasible to complete them all by Nov 22. Anyway, we intend to include the full set of results in the final version of our work.

Reviewer comment (Experiments):
the other attacks are tested with default hyperparameters, and the authors report that the performances degrade when changing the datasets. However, testing the attacks with a set of hyperparameters could potentially reveal that the proposed approach is sub-optimal w.r.t. the other attacks, while still defeating them because of the parameter-free advantage.

Author response:
> The other attacks are tested with default hyperparameters…

To ensure a fair comparison, for each dataset, we selected hyperparameters for each attack based on those recommended in their respective papers. The assumption was that the authors of these papers have either fine-tuned these parameters or claimed that their methods are not highly sensitive to them.

Given that comprehensive hyperparameter tuning for each attack across every model and dataset would be infeasible for us, we experimented with different variations of the attacks by varying their number of iterations (as detailed in Table 3). We consistently aimed to select this parameter so that it would work in favor of their performance. However, we acknowledge the possibility that there may still be hyperparameter settings for each (attack, model, dataset) combination that could equalize the performance of all attack algorithms. Similar scenarios have been observed previously in the context of training algorithms and GANs, (Lucic et al. “Are GANs Created Equal? A Large-Scale Study”, NeurIPS 2018.)

This further highlights the importance of designing algorithms with fewer number of hyperparamters such as SDF.

Reviewer comment (Evaluation):
additionally, it would be interesting to see the query-distortion curves, such as in other related works (e.g., FMN), as the median is only a compact measure of the performances

Author response:
> additionally, it would be interesting to see the query-distortion curves...

Many thanks for this suggestion.

Note that, SDF (and DF) do not allow control over the number of gradient computations. They typically stop once a successful adversarial example is found. Terminating the process prematurely could prevent them from finding an adversarial example. Hence, we opted to plot the median norm of achievable perturbations for a given maximum number of queries. Although this is not directly comparable to the query-distortion curves in FMN, it provides a more comprehensive view of the query distribution than the median alone. The figures are placed in the Appendix K.

Reviewer comment (Experiments):
the attack should also be tested and compared in the targeted version, otherwise, the authors should still list this as a limitation (as it has not been tested, thus it is difficult to evaluate whether this is the best approach in the case of targeted attacks).

Author response:
> the attack should also be tested and compared in the targeted version…

Thanks for this suggestion. If time allows, we will include this experiment; otherwise, we will mention it as a future direction.

Reviewer comment (Evaluation):
to claim that the attack finds perturbations "quickly", the authors should perform a per-query runtime comparison such as the one done in other papers (FMN, ALMA) to compare the efficiency of the attack in a fair manner. The attack seem to win in any case (given the runtimes reported in the appendix), however a per-query comparison would still be interesting to see, given that there are additional operations within the steps (even if they are probably negligible w.r.t. the time for computing the gradients).

Author response:
> to claim that the attack finds perturbations “quickly”…

It may be helpful to differentiate between two distinct objectives:
A) With a fixed “computational budget”, which algorithm finds the smallest perturbation.
B) For a given a level of distortion, which algorithm requires less computation.

While there is not a straightforward method to directly address points A and B for SDF (as mentioned above), our results suggest that SDF is the fastest for “very small” distortions. Also, with a “very small” number of queries, it tends to find the smallest perturbation. It was the message we aimed to convey in Figure 1.

We also measured the number of forward and backward passes separately for a robust WRN-28-10 model. The median values for the forward and backward passes of SDF are 50 and 32 per sample, respectively. The time spent on other operations was less than 1% of the total time. It achieves a median norm of 0.77. While FMN-100 achieves a median norm of 1.43 using 100 forward and 100 backward passes per sample, FMN-1000 reaches a median norm of 0.87 with 1000 forward and 1000 backward passes.

Reviewer comment (Reproducibility):
The attack algorithm should enforce the constraint of clipping pixel-values to [0, 1] "by default", as for the majority of applications there are input space constraints and they should be enforced to produce valid perturbations. The authors should also discuss what happens when they enforce this constraint, as it is probably not possible anymore to enforce the orthogonality with the decision boundary. For this reason, also the plots added in the appendix comparing the orthogonality of FMN and CW might be biased by this additional constraint (while the comment on the line search is not clear, as FMN does not perform line searches unless initialized from the adversarial class).

Author response:
> The attack algorithm should enforce this constraint "by default"...

We report all our results with clipping as the final step in the algorithm. We acknowledge the reviewer's point that this might not be enough IF our focus is on the "real-world" security implications of these attacks. However, if the purpose is to use them for data augmentation, for example, then such a requirement might not be needed anymore.

Anyway, we played with the in-loop clipping as well, yet observed no noticeable difference between the two methods in our experiments.

Reviewer comment (Writing):
The authors should clarify the observation that "for an optimal perturbation, we expect these two vectors to be parallel" to make the paper accessible to a broader audience. Additionally, a figure with a 2D example might also help clarify this observation.

Author response:
> The authors should clarify this aspect to make the paper…

We will clarify this sentence in the text, and will include a figure in the Appendix XX to visualize the concept.

Reviewer comment (Novelty):
The authors should state that the bounded-norm attacks solve a different problem than (1).

Author response:
> The authors should state that the bounded-norm attacks solve a different problem than (1).

Thanks for the suggestion. Indeed. We modify the text to clarify this distinction.

Reviewer comment (Writing):
As it is a scalar multiplied by the gradient, is the first part of eq. 4 an estimation of the step size? Maybe this could be specified in the text to make the description clearer.

Author response:
> As it is a scalar multiplied by the gradient, is the first part of eq. 4 an estimation of the step size? 

Yes, indeed. We will make it clear in the text.

Reviewer comment (Theory):
The authors should discuss why the other attacks are not parallelizable, as they state that attacks for AT should be and CW, for example, is not.

Author response:
> The authors should discuss why the other attacks are not parallelizable, as they state that attacks for AT should be and CW, for example, is not.

Other algorithms usually use perform one backward pass per iteration, resulting in these backward passes being non-parallelizable as they need to be performed sequentially. However, in the case of SDF, some of the backward passes can be executed in parallel, especially the backward passes that are carried out in each iteration of the inner loop in the multi-class case.

Reviewer comment (Novelty):
DeepFool was proposed and evaluated not only for $\ell_2-$adversarial robustness, but also had formulas (Holder's inequality) and evaluations for any $\ell_p$ (including $\ell_0$, $\ell_1$, $\ell_\infty$) norm balls. In contrast, SuperDeepFool is only proposed and evaluated for $\ell_2$, although claims to be more generalized version of DeepFool.

Author response:
It should be noted that the focus of our paper, as stated in the abstract, is on minimal $\ell_2$-norm perturbations.  If the reviewer has identified any sentences that suggest otherwise, please let us know. We would greatly appreciate your feedback. Whenever we mention DF, we refer to its $\ell_2$ variant. Moreover, up to our knowledge, DF was primarily introduced for $\ell_2$-norm, and its application to general $\ell_p$-norm perturbations was not extensively tested in the original paper.

Nevertheless, we tried an $\ell_\infty$ version of SDF by replacing the orthogonal projection with the $\ell_\infty$ projection (Holder's inequality). The table below shows our results for $\ell_\infty$ on M1 [1] and M2 [5]. Our results show that this version of SDF also outperforms other algorithms in finding smaller $\ell_\infty$ perturbations. We will add this result to the Appendix.

| Attacks | M1    |  FR   | Grads | M2   | FR   | Grads |
|---------|------------|---------|-------|------|------|-------|
|     DF     | 0.031 | 96.7   | 24| 0.043 | 97.4 | 31|
| FAB    | 0.025 | 99.1   | 100   | 0.038 | 99.6 | 100   |
| FMN   | 0.024 | 100 | 100 | 0.035 | 100 | 100 |
| SDF     | **0.019** | 100 | 33  | **0.027** | 100 | 46   |

Reviewer comment (Experiments):
Only convolutional networks were used in the experiments, while it is known that vision transformers are robust learners.

Author response:
Many thanks for the suggestion. Given our available computational resources, we conduct experiments on a ViT-B-16 [2] trained on CIFAR-10, achieving 98.5$\%$ accuracy. The results are summarized in the following table:

| Attack | FR   | Median-$\ell_{2}$ | Grads |
|--------|------|--------------------|-------|
| DF     | 98.2 | 0.29               | 19|
| ALMA   | 100  | 0.12               | 100   |
| DDN    | 100  | 0.14               | 100   |
| FAB    | 100  | 0.14               | 100   |
| FMN    | 99.1 | 0.15               | 100   |
| C&W    | 100  | 0.15               | 91,208|
| SDF    | 100  | **0.10**           | 32    |

As seen, this transformer model does not exhibit significantly greater robustness compared to CNNs, with only a negligible difference of 0.01 compared to a WRN-28-10 trained on CIFAR-10 (0.09 in Table 3 of the paper). These results support the notion that there might not be a substantial disparity between the adversarial robustness of ViTs and CNNs. This aligns with the findings of [3]. They argue that earlier claims of transformers being more robust than CNNs stems from an unfair comparison and evaluation methods. We believe that thorough evaluations using minimum norm attacks could be helpful in resolving this debate.

Reviewer comment (Experiments):
Few additional hyperparameters $(n, m)$ are added and there is no methodology how to select them right.

Author response:
We regard $(m,n)$ as a way to parameterize a class of algorithms, where each pair corresponds to an algorithm. As shown in Table 2 of the paper, all these variants yield comparable results. However, SDF($\infty$,1) empirically demonstrates a slightly superior performance (and hence is considered the default algorithm). For a new dataset, it is important to note that SDF($\infty$,1) might not be always the optimal algorithm. This is why we kept the class of algorithms general (it is needless to say that even to train a model on a new dataset, even the selection of architecture, optimization algorithm, etc. are not known apriori, and many methods used to determine those, can be equally applied here.)

Reviewer comment (Presentation):
Lots of space could be saved by combining tables and figures in one row (for example Table 3 and Table 8).

Author response:
Thank you for this comment. ٌe have attempted to improve the presentation by putting Tables 3 and 8 in-line with the text.

Reviewer comment (Evaluation):
Why does white-box $\ell_2$ adversarial robustness matter? What is the practical scenario where high-frequency pixel-level $\ell_2$ perturbations, crafted with full access to the model and gradients, might cause problems? Maybe, it would be nice to show that more $\ell_2$ robust models have some other useful properties.

Author response:
The reasons for using $\ell_2$ norm perturbations are manifold:

- We acknowledge that $\ell_2$ threat model may not seem particularly realistic in practical scenarios (at least for images); however, it can be perceived as a basic threat model amenable to both theoretical and empirical analyses, potentially leading insights in tackling adversarial robustness in more complex settings. The fact that, despite considerable advancements in AI/ML, we are yet to solve adversarial vulnerability, motivates part of our community  to return to the basics and work towards finding fundamental solutions to this issue.
    
- In particular, thanks to their intuitive geometric interpretation, $\ell_2$ perturbations provide valuable insights into the geometry of classifiers. They can serve as an effective tool in the "interpretation/explanation" toolbox to shed light on what/how these models learn.

- Moreover, it has been demonstrated that (see, for example,[4] and [9]), $\ell_2$ robustness has several applications beyond security.
      
- While not the most compelling reason, the continued interest of the community in $\ell_2$ perturbations is evidenced by publications in top venues, including FMN [7] in NeurIPS 2021, DDN [5] in CVPR 2019, ALMA [10] in ICCV 2021, FAB [8] in ICML 2021, among many others.

*A note on the spectral properties of $\ell_2$ perturbations:* It is not entirely accurate to categorize $\ell_2$ perturbations as “high-frequency”. On the contrary, these perturbations tend to align more with "low-frequency" bands (see, e.g., [11]).

Reviewer comment (Evaluation):
Why median $\ell_2$ and number of grads are used as the metric, while DeepFool used $\rho = \frac{1}{|D|}\sum_{x\in D} \frac{\|r(x)\|_2}{\|x\|_2}$?

Author response:
To ensure a fair comparison, we employed the metrics commonly used in recent literature on adversarial robustness. Specifically, we employed the two most prevalent metrics: the median/mean of perturbation norms (taken over dataset samples) to evalaute the method's accuracy, and the number of backward passes to measure the computational complexity.

Nevertheless, one could argue that DF's $\rho$ (which normalizes the perturbation norm by the input sample norm) is conceptually similar to the mean of norms of perturbations. This is especially true given that the norm of samples tend to be quite concentrated for high dimensional data like CIFAR-10 and ImageNet. Hence, it can be said that they are almost equivalent up to a scaling factor. We can compute this metric, though, if the reviewer insists on its importance.

Reviewer comment (Evaluation):
It is not clear why the attack is strongest when the number of projection steps (value of n) is 1 and the number of deep fool attacks (value of m) is as large as possible. A detailed discussion on this would be helpful.

Author response:
Like any other gradient-based optimization method tackling a non-convex problem, providing a definitive explanation for why one algorithm outperforms others is not straightforward. We have the following speculation on why SDF($\infty$,1) consistently outperforms the other configurations: Note that each projection step reduces the perturbation, while each DF step moves the perturbation nearer to the boundary. So when projection is repeated multiple times ($n>1$), it might undo the progress made by DF, potentially slowing down the algorithm's convergence. On the other hand, by first reaching a boundary point through multiple DF steps and then applying the projection operator just once, we at least ensure that the algorithm has reached intermediate adversarial examples. Each subsequent outer loop is hoped to incrementally move the adversarial example closer to the optimal point. (see Figure 3).

Reviewer comment (Experiments):
The comparison is done primarily for the l2 norm, it would be nice if the authors could also try their method for other norms like l-infinity norm.

Author response:
Many thanks for the suggestion. Although, SDF is primarily designed to find minimal $\ell_2$ perturbations, we tried a simple idea to extend it to $\ell_\infty$ norm by substituting the $\ell_2$-projection step (line 5 in Algortihm 2) with the $\ell_\infty$ projection:

$\boldsymbol{x}\gets \boldsymbol{x}_0 + \frac{(\widetilde{\boldsymbol{x}}-\boldsymbol{x}_0)^\top\boldsymbol{w}}{||\boldsymbol{w}||_1} \text{sign}(\boldsymbol{w})$

The table below displays the results obtained for the $\ell_\infty$ norm. We conducted multiple $\ell_\infty$ attacks, namely FMN, FAB, and DF, on M1 [3] and M2 [6] adversarially trained networks on the CIFAR10 dataset. Our findings indicate that this variant of SDF also exhibits superior performance compared to other algorithms in discovering smaller $\ell_\infty$ perturbations.

| Attacks | M1    |  FR   | Grads | M2   | FR   | Grads |
|---------|------------|---------|-------|------|------|-------|
|     DF     | 0.031 | 96.7   | 24| 0.043 | 97.4 | 31|
| FAB    | 0.025 | 99.1   | 100   | 0.038 | 99.6 | 100   |
| FMN   | 0.024 | 100 | 100 | 0.035 | 100 | 100 |
| SDF     | **0.019** | 100 | 33  | **0.027** | 100 | 46   |

We will add this result to the Appendix.

Reviewer comment (Experiments):
Authors should also include comparison with some strong adversarial attacks which are not trying to find the minimum norm. For instance a comparison against guided margin aware attack [1] can help in developing a better understanding. The authors can also try to determine the norm from the proposed super deepfool and then try strong attacks like carlini and wagner attack [2], multi-targeted attack and guided margin aware attack [1] on the threat model with this norm.

Author response:
We appreciate if the reviewer could clarify their point. From our understanding, C\&W is a minimum-norm attack, and we have indeed included a comparison with it in our work. Once we fully grasp the specific type of comparison the reviewer is requesting, we will promptly provide it.

Reviewer comment (Presentation):
It would be nice if the authors consider improving the presentation of tables. For instance, Table-3,8, Fig-3 have a lot of whitespace left on the right and left hand, which does not look good. The quality of the figure could also be improved. Further, I think it would be fine if the authors present merge Algorithm-1 and 2. There is a lot of duplicated content in these algorithms.

Author response:
Thank you for this comment, we have attempted to improve the presentation by putting Tables 3 and 8 in-line with the text. This has removed some of the whitespace. We welcome any additional suggestions for improving the appearance of the paper. Regarding algorithms 1 and 2, the logic for having two separate algorithms is that the first one is for showing the general concept for binary case and the second one shows the multiclass version for SDF($\infty$,1) which is the specific method that we show works best (we thought the general multiclass algorithm adds unnecessary complication and heavy notation).

Reviewer comment (Experiments):
It would be nice if the authors incorporate their attack with the autoattack package and analyze a few more defences. Since Table-8 currently shows mixed trends, therefore a more rigorous analysis is required to justify the claims.

Author response:
As per the reviewer's request, we have conducted experiments on two other robust networks, namely, R5 [5] and R6 [7]. The updated Table 8 is provided below:

| Models | Clean | AA acc | AA Grads | AA++ acc | AA++ Grads |
|--------|-------|--------|----------|----------|------------|
| R1     | 95.7\% | 82.3\%  | 1259.2   | 82.1\%    | 599.5  |
| R2     | 90.3\% | 76.1\%  | 1469.1   | 76.1\%    | 667.7      |
| R3     | 89.4\% | 63.4\%  | 1240.4   | 62.2\%    | 431.5      |
| R4     | 88.6\% | 67.6\%  | 933.7    | 68.4\%    | 715.3      |
| R5     | 89.05\%| 66.4\%  | 846.3    | 62.5\%    | 613.7      |
| R6     | 88.02\%| 67.6\%  | 721.4    | 63.4\%   | 511.1      |
| S      | 94.7\% | 0.00\%  | 208.6    | 0.00     | 121.1      |

Furthermore, in the appendix, an alternative version of AA++ is presented, whereby we add SDF to the set of attacks, instead of substituting it with APGD$^\top$, to ensure the preservation of AA's previous performance. We still see in this case that our modification improves the computational time by a factor of 20$\%$.

[6] Rony, Jerome et al. "Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2019.
[7] Ding, Gavin Weiguang et al. "Mma training: Direct input space margin maximization through adversarial training." arXiv preprint arXiv:1812.02637, 2018.