Automated Discovery of Adaptive Attacks on Adversarial Defenses
Abstract
Reliable evaluation of adversarial defenses is a challenging task, currently limited to an expert who manually crafts attacks that exploit the defenses inner workings, or to approaches based on ensemble of ﬁxed attacks, none of which may be eﬀective for the speciﬁc defense at hand.
Our key observation is that custom attacks are composed from a set of reusable building blocks, such as ﬁne-tuning relevant attack parameters, network transformations, and custom loss functions.
Based on this observation, we present an extensible tool that deﬁnes a search space over these reusable building blocks and automatically discovers an eﬀective attack on a given model with an unknown defense by searching over suitable combinations of these blocks.
We evaluated our approach on 23 adversarial defenses and showed it outperforms AutoAttack (Croce and Hein, 2020), the current state-of-the-art tool for reliable evaluation of adversarial defenses: our discovered attacks are either stronger, producing 3.0%-50.8% additional adversarial examples (10 cases), or are typically 2x faster while enjoying similar adversarial robustness (13 cases).
1. Introduction
To address the challenge of adversarial robustness evaluation (Szegedy et al., 2014; Goodfellow et al., 2015), two recent works approach the problem from diﬀerent perspectives.
Tramer et al.
(2020) outline an approach for manually crafting adaptive attacks that exploit the weak points of each defense.
Here, a domain expert starts with an existing attack, such as
PGD (Madry et al., 2018) (denoted as • in Figure 1), and adapts it based on knowledge of the defense’s inner workings.
This approach was demonstrated to be eﬀective in breaking all of the considered 13 defenses.
However, a downside is that it requires substantial manual eﬀort and is limited by the domain knowledge of the expert – for instance, each of thedefenses came with an adaptive attack which was insuﬃcient, in retrospect.
At the same time, Croce and Hein (2020) proposed to assess adversarial robustness using an ensemble of four diverse attacks.
While these do not require manual eﬀort and have been shown to provide a better robustness estimate for many defenses, the approach is limited by the fact that the attacks are ﬁxed apriori without any knowledge of the particular defense
[Figure]
(cid:46)
[Figure]
at hand.
This is visualized in Figure 1 (b) where even attacks
This work: discovery of adaptive attacks
We present a new method that automates the process of crafting adaptive attacks, combining the best of both prior approaches – the ability to evaluate defenses automatically while producing attacks tuned for the given defense.
Our work is based on the key observation that we can identify common techniques used to build existing adaptive attacks and extract them as reusable building blocks in a common framework.
Then, given a new model with an unseen defense, we can discover an eﬀective attack by searching over suitable combinations of these building blocks.
To identify reusable techniques, we analyze existing adaptive attacks and organize their components into three groups: Attack algorithm and parameters , Network transformations , and Loss functions .
These components collectively formalize an attack search space induced by their diﬀerent combinations.
We present an algorithm that eﬀectively navigates the search space, and implemented in a tool called Adaptive AutoAttack ( A 3 ).
The source code of A 3 and our scripts for reproducing the experiments are available online at: https://github.com/eth-sri/adaptive-auto-attack
2. Automated Discovery of Adaptive Attacks
We use D = { ( x i , y i ) } Ni =1 to denote a training dataset where x ∈ X is a natural input and y is the label.
An adversarial example is a perturbed input x (cid:48) , such that: (i) it satisﬁes an attack criterion c , e.g., a K -class classiﬁcation model f : X → R K predicts a wrong label, and (ii) the distance d ( x (cid:48) , x ) between the adversarial input x (cid:48) and the input x is below a threshold (cid:15) under a distance metric d (e.g., an L p norm).
Formally, this can be written as:
[Equation]
[Equation]
such that
[Equation]
Problem Statement
Given a model f equipped with an unknown set of defenses and a dataset D , our goal is to ﬁnd an adaptive attack a ∈ A that is best at generating adversarial samples x (cid:48)
according to the attack criterion c and the attack capability d ( x
[Equation]
, x ) ≤
[Equation]
[Equation]
where x (cid:48) = a
[Equation]
Here, A denotes the search space of all possible attacks, where the goal of each attack a : X × ( X → R K )
→ X is to generate an adversarial sample x (cid:48)
= a ( x, f ) for a given input x and model f .
For example, solving this optimization problem with respect to the L ∞ misclassiﬁcation criterion corresponds to optimizing the number of adversarial examples misclassiﬁed by the model.
In our work, we consider an implementation-knowledge adversary , who has full access to the model’s implementation at inference time (e.g., the model’s computational graph).
We chose this threat model as it matches our problem setting – given an unseen model implementation, we want to automatically ﬁnd an adaptive attack that exploits its weak points, but without the need of a domain expert.
To solve the optimization problem from
Equation 2, we address two key challenges:
Deﬁning a suitable attacks search space A (Section 3), and Searching over the space A eﬃciently (Section 4 and Appendix A).
3. Adaptive Attacks Search Space
We deﬁne the adaptive attack search space to be A : S × T , where S consists of sequences of backbone attacks along with their loss functions, selected from a space of loss functions L , and
T consists of network transformations.
Given an input x and a model f , the goal of adaptive attack ( s, t ) ∈ S × T is to return an adversarial example x (cid:48) by computing s ( x, t ( f ))
=
x (cid:48) .
That is, it ﬁrst transforms the model f by applying the transformation t ( f ) =
f (cid:48) , and then executes the attack s on the surrogate model f (cid:48) .
Note that the surrogate model is used only to compute the candidate adversarial example, not to evaluate it.
Attack Algorithm & Parameters ( S )
The attack search space consists of a sequence of adversarial attacks.
We formalize the search space with the grammar:
(Attack Search Space)
[Equation]
S
[Equation]
S | randomize S | EOT S , n | , repeat S , n | try S for n | Attack with params with loss
∈ L • S ; S : composes two attacks, which are executed independently and return the ﬁrst adversarial sample in the deﬁned order.
That is, given input x , the attack s 1 ; s 2 returns s 1 ( x ) if s 1 ( x ) is an adversarial example, and otherwise it returns s 2 ( x ).
• randomize S : enables the attack’s randomized components, which correspond to random seed and/or selecting a starting point within d ( x (cid:48) , x ) ≤ (cid:15) , uniformly at random.
• EOT S , n : uses expectation over transformation, a technique designed to compute gradients for models with randomized components (Athalye et al., 2018).
• repeat S , n : repeats the attack n times (useful only if randomization is enabled).
• try S for n : executes the attack with a time budget of n seconds.
• Attack with params with loss ∈ L : is a backbone attack Attack executed with parameters params and loss function loss .
We provide the full list of parameters, including their ranges and priors in Appendix C.
Network Transformations ( T )
At a high-level, the network transformation search space
T takes as input a model f and transforms it to another model f (cid:48) , which is easier to attack.
To achieve this, the network f can be expressed as a directed acyclic graph, where each vertex denotes an operator (e.g., convolution, residual blocks, etc.), and edges correspond to data dependencies.
Note that the computational graph includes both the forward and backward versions of each operation, which can be changed independently of each other.
In our work, we include two types of network transformations:
• Layer Removal , which removes an operator from the graph.
Each operator can be removed if its input and output dimensions are the same, regardless of its functionality.
• Backward Pass Diﬀerentiable Approximation ( BPDA ) (Athalye et al., 2018), which replaces the backward version of an operator with a diﬀerentiable approximation of the function.
In our search space we include three diﬀerent function approximations (i) an identity function, (ii) a convolution layer with kernel size 1, and (iii) a two-layer convolutional layer with ReLU activation in between.
The weights in the latter two cases are learned through approximating the forward function using the test dataset.
Loss Function ( L )
Selecting the right objective function to optimize is an important design decision for creating strong adaptive attacks.
The recent work of Tramer et al.
(2020) uses 9 diﬀerent objective functions to break 13 defenses, showing the importance of this step.
We formalize the space of possible loss functions as follows (see Appendix C for details): (Loss Function Search Space)
L ::= targeted Loss, n with Z | untargeted Loss with Z | targeted Loss, n - untargeted Loss with Z
Z ::= logits | probabilities
Loss ::=
CrossEntropy | HingeLoss | L1 | DLR | LogitMatching
4. Search Algorithm
Here we brieﬂy describe the main components of our search algorithm.
As the search space of attacks S is large, we employ three techniques to improve scalability and attack quality:
• First, to generate a sequence of m attacks, we perform a greedy search – that is, in each step, we ﬁnd an attack with the best score on the samples not circumvented by any of the previous attacks.
Second, we use a parameter estimator model M to select the suitable parameters.
In our work, we use Tree of Parzen Estimators (Bergstra et al., 2011), but the concrete implementation can vary.
• Third, because evaluating the adversarial attacks can be expensive, and the dataset D is typically large, we employ successive halving technique (Karnin et al., 2013; Jamieson and Talwalkar, 2016).
We provide the full algorithm, including a more detailed description and time complexity analysis, in Appendix A.
5. Evaluation
We now evaluate A 3 on 23 models with diverse defenses on CIFAR-10 dataset.
The result shows A 3 ﬁnds stronger or similar attacks than AutoAttack for virtually all defenses:
• In 10 cases, the attacks found by A 3 are signiﬁcantly stronger than AutoAttack , resulting in 3.0% to 50.8% additional adversarial examples.
• In the other 13 cases, A 3 ’s attacks are typically 2x and up to 5.5x faster while enjoying similar attack quality.
The A 3 tool
The implementation of A 3 is based on PyTorch (Paszke et al., 2019), the implementations of FGSM , PGD , NES , and DeepFool are based on FoolBox (Rauber et al., 2017) version 3.0.0, C&W is based on ART (Nicolae et al., 2018) version 1.3.0, and the attacks
APGD , FAB , and SQR are from Croce and Hein (2020).
We use AutoAttack ’s rand version if a defense has a randomization component, and otherwise we use its standard version.
To allow for a fair comparison, we extended AutoAttack with backward pass diﬀerential approximation ( BPDA ), so we can run it on defenses with non-diﬀerentiable components; without this, all gradient-based attacks would fail.
We instantiate our search algorithm by setting: the attack sequence length m =3, the number of trials k =64, the initial dataset size n =100, and we use a time budget of 0 .
5 to 3 seconds per sample depending on the model size.
The only exception is A1 , which uses (cid:15) = 0 . 03, m = 8 and A10 , which uses time budget of 30 seconds and m = 1.
We use TPE for parameter estimation, which is implemented as part of the Hyperopt framework (Bergstra et al., 2013).
All of the experiments are performed using a single RTX 2080 Ti GPU.
Comparison to AutoAttack
Our main results, summarized in Table 1, show the robust accuracy (lower is better) and runtime of both AutoAttack ( AA ) and A 3 over the 23 defenses.
Overall, A 3 signiﬁcantly improves upon AA or provides similar but faster attacks.
We note that the attacks from AA are included in our search space (although without the knowledge of their best parameters and sequence), and so it is expected that A 3 performs at least as well as AA , provided suﬃcient exploration time.
The only case where the exploration time was not suﬃcient was for B14 where our attack is slightly slower (114 min for A 3 vs.
107 min for AA ), yet still achieves the same robust accuracy (5.16% for A 3 vs. 5.15% for AA ).
Importantly, A 3 often ﬁnds better attacks: for 10 defenses, A 3 reduces the robust accuracy by 3% to 50% compared to that of AA .
In what follows, we discuss the results in more detail and highlight important insights.
Defenses based on Adversarial Training.
Defenses A2 , B11 , B12 , B16 , B17 and B18 are based on variations of adversarial training.
A 3 obtains very close results while bringing 1.5–5.5 × speedups.
Closer inspection reveals that AA includes two attacks, FAB and SQR , [Table] which are not only expensive but also ineﬀective on these defenses.
A 3 improves the runtime by excluding them from the generated adaptive attack
[Table]
Obfuscation Defenses.
Defenses A4 , A9 , A10 , B15 , B19 , and B20 are based on gradient obfuscation.
A 3 discovers stronger attacks that reduce the robust accuracy for all defenses by up to 47.21%.
Here, removing the obfuscated defenses in A4 , B19 , and B20 provides better gradient estimation for the attacks.
Further, the use of more suitable loss functions strengthens the discovered attacks and improves the evaluation results for A9 and B15 .
Randomized Defenses.
For the randomized input defenses A9 , B21 , and B22 , A 3 discovers attacks that, compared to AA ’s rand version, further reduce robustness by 8.71%, 7.54%, and 8.84%, respectively.
Detector based Defenses.
For A1 , A5 , and B23 defended with detectors, A 3 improves over AA by reducing the robustness by 50.77%, 3.13%, and 3.18%, respectively.
This is because none of the attacks discovered by A 3 are included in AA .
Namely, A 3 found SQR DLR and APGD Hinge for A1 , untargeted FAB for A5 ( FAB in AA is targeted), and PGD L1 for B23 .
6. Conclusion
We presented the ﬁrst tool that aims to automatically ﬁnd strong adaptive attacks speciﬁcally tailored to a given adversarial defense.
Our key insight is that we can identify reusable techniques used in existing attacks and formalize them into a search space.
Then, we can phrase the challenge of ﬁnding new attacks as an optimization problem of ﬁnding the strongest attack over this search space.
Our approach is a step towards automating the tedious and time-consuming trial-and-error steps that domain experts perform manually today, allowing them to focus on the creative task of designing new attacks.
By doing so, we also immediately provide a more reliable evaluation of new and existing defenses, many of which have been broken only after their proposal because the authors struggled to ﬁnd an eﬀective attack by manually exploring the vast space of techniques.
Appendix A. Search Algorithm
Here, we describe our search algorithm that optimizes the problem statement from Equation 2.
Since we do not have access to the underlying distribution, we approximate Equationusing the dataset D as follows:
[Equation]
where a ∈ A is an attack, l a ∈ R + denotes untargeted cross-entropy loss of a on the input, and λ ∈ R is a hyperparameter.
The intuition behind − λ · l a is that it acts as a tie-breaker in case the criterion c alone is not enough to diﬀerentiate between multiple attacks.
While this is unlikely to happen when evaluating on large datasets, it is quite common when using only a small number of samples.
Obtaining good estimates in such cases is especially important for achieving scalability since performing the search directly on the full dataset would be prohibitively slow.
Algorithm 1: A search algorithm that given a model f with unknown defense, discovers an adaptive attack from the attack search space A with the best score .
def AdaptiveAttackSearch
Input: dataset D , model f , attack search space
A = S × T , number of trials k , initial dataset size n , attack sequence length m , criterion function c , initial parameter estimator model M , default attack ∆ ∈ S
Output: adaptive attack from a [ s,t ] ∈
A achieving the highest score on D t ← arg max t ∈ T score ( f, a [∆ ,t ] , D ) (cid:46) Search for surrogate model t
S ← ⊥ (cid:46) Initialize attack to be no attack, which returns the input image for j ← 1: m do (cid:46) Run m iterations to get sequence of m attacks
D ← D \ { x | x ∈ D ∧ c ( f, a [ S ,t ] ( x, f ) , x ) } (cid:46)
Remove non-robust samples
D sample ← sample ( D , n ) (cid:46)
Initial dataset with n samples
H ← ∅ for i ← 1: k do (cid:46) Select candidate adaptive attacks θ (cid:48) ← arg max θ ∈ S P ( θ | M ) (cid:46) unseen parameters according to the model M q ← score ( f, a [ θ (cid:48) ,t ] , D sample )
H ← H ∪ { ( θ (cid:48) , q ) }
M ← update model M with ( θ (cid:48) , q )
H ← keep |H| / 4 attacks with the best score while |H| > 1 and D sample (cid:54) =
D do (cid:46) Successive halving (SHA)
D sample ← D sample ∪ sample ( D \ D sample , |D sample | )
H ← { ( θ, score ( f, a [ θ,t ] , D sample ))
| ( θ, q ) ∈ H}
H ← keep |H| / 4 attacks with the best score
S ← S ; best attack in H return a [ S ,t ]
Search Algorithm
We present our search algorithm in Algorithm 1.
We start by searching through the space of network transformations t ∈ T to ﬁnd a suitable surrogate model (line 1).
This is achieved by taking the default attack ∆ (in our implementation, we set ∆ to APGD CE ), and then evaluating all locations where BPDA can be used, and subsequently evaluating all layers that can be removed.
Even though this step is exhaustive, it takes only a fraction of the runtime in our experiments, and no further optimization was necessary.
Next, we search through the space of attacks S .
As this search space is enormous, we employ three techniques to improve scalability and attack quality.
First, to generate a sequence of m attacks, we perform a greedy search (lines 3-17).
That is, in each step, we ﬁnd an attack with the best score on the samples not circumvented by any of the previous attacks (line 4).
Second, we use a parameter estimator model M to select the suitable parameters (line 8).
In our work, we use Tree of Parzen Estimators Bergstra et al.
but the concrete implementation can vary.
Once the parameters are selected, they are evaluated using the score function (line 9), the result is stored in the trial history H (line 10), and the estimator is updated (line 11).
Third, because evaluating the adversarial attacks can be expensive, and the dataset D is typically large, we employ successive halving technique Karnin et al.
; Jamieson and Talwalkar (2016).
Concretely, instead of evaluating all the trials on the full dataset, we start by evaluating them only on a subset of samples D sample (line 5).
Then, we improve the score estimates by iteratively increasing the dataset size (line 14), re-evaluating the scores (line 15), and retaining a quarter of the trials with the best score (line 16).
We repeat this process to ﬁnd a single best attack from H , which is then added to the sequence of attacks S (line 17).
A 3 Time Complexity
We give the worst-case time analysis for Algorithm 1. We denote T a to be the attack time and T r to be the search time.
We will show that under the per sample per attack time limit of T c :
[Equation]
Where m , n , k are the number of attacks, initial dataset size, number of trials respectively.
In Algorithm 1, only steps on lines 1,4,8,14 are timing critical as they apply the expensive attack algorithms.
Since line 4 is essentially applying the attack on all the samples, the runtime of line 4 counts as T a .
The runtime of lines 1,8,14 counts as T r .
T a consists of the time to apply m attacks.
The worst-case runtime here is when each of the m attacks use the full time budget T c on all the samples (denoted as N ).
This gives the bound shown in Equation 4.
For T r , we ﬁrst analyze the time in lines 8 and 14 for a single attack.
In line 8, the maximum time to perform k attacks on n samples is: n × k × T c .
In line 14, the cost of the ﬁrst iteration is: 12 n × k × T c as there are k/ 4 attacks and 2 n samples.
By design, the cost of SHA iteration is halved for every subsequent iteration, which leads to time for line 14 to be n × k × T c .
As there are m attacks, the total time bound for linesand 14 is: 2 × m × n × k × T c .
The runtime for line 1 is bounded by N × T fast as we run single attack on all the samples.
Here, we use T fast to denote the maximum runtime of a fast attack that we run at this stage.
This step is typically negligible compared to the subsequent search, i.e., N × T fast (cid:28) 2 × m × n × k × T c . Overall, we can therefore bound the search runtime by considering the lines and 8 and 14, which leads to the bound from Equation 5. In our evaluation, we use m = 3 , k = 64 , n = 100 , N = 10000.
Substituting into
Equation 5 leads to T r ≤ 2 × 3 × 100 × 64 × T c ≤ 4 × N × T c .
This means the total search time is bounded by the time bound of executing a sequence of 4 attacks on the full dataset.
Further, T r ≤ 43 × m × N × T c , which means the search time of an attack is bounded byof the allowed runtime to execute the attack. Appendix B. Evaluation Metrics Details We use the following L ∞ criteria in the formulation:
[Equation]
Misclassification
[Table]
[Equation]
[Table]
For both, we remove the misclassiﬁed clean input as a pre-processing step, such that the evaluation is performed only on the subset of correctly classiﬁed samples (i.e. ˆ f ( x ) = y ).
Sequence of Attacks
Sequence of attacks deﬁned in Section 3 is a way to calculate the per-example worst-case evaluation, and the four attack ensemble in AutoAttack is equivalent to sequence of four attacks [ APGD CE , APGD DLR , FAB , SQR ].
Algorithm 2 elaborates how the sequence of attacks is evaluated.
That is, the attacks are performed in the order they were deﬁned and the ﬁrst sample x (cid:48) that satisﬁes the criterion c is returned.
Algorithm def SeqAttack
Input: model f , data x , sequence attacks S ⊆ S , network transformation t ∈ T , criterion function c for θ ∈ S do
Evaluation Metric
Following Stutz et al.
(2020), we use the robust test error (Rerr) metric to combine the evaluation of defenses with and without detectors.
Rerr is deﬁned as:
[Equation]
(6) where g : X → { 0 , 1 } is a detector that accepts a sample
if g ( x (cid:48) ) = 1, and 1 f ( x (cid:48) )
(cid:54) =
y evaluates to one if x (cid:48) causes a misprediction and to zero otherwise.
The numerator counts the number of samples that are both accepted and lead to a successful attack (including cases where the original x is incorrect), and the denominator counts the number of samples not rejected by the detector.
A defense without a detector (i.e., g ( x (cid:48) )
= 1) reduces Equation 6 to the standard Rerr.
Finally, we deﬁne robust accuracy simply as 1 − Rerr.
Robust Test Error (Rerr)
Rerr in Equation 6 has intractable maximization problem in the denominator, so Equation 7 is the empirical equation used to give an upper bound of
Rerr.
This empirical evaluation is the same as the evaluation in Stutz et al.
[Equation]
Detectors
For a network f with a detector g , the criterion function c is misclassiﬁcation with the detectors, and it is applied in line 3 in Algorithm 2.
This formulation enables per-example worst-case evaluation for detector defenses.
Randomized Defenses
If f has randomized component, f ( x n ) in Equation 7 means to draw a random sample from the distribution.
In the evaluation metrics, we report the mean of adversarial samples evaluated 10 times using f .
Appendix C. Search Space of S × L C.1 Loss function space L
In Figure 2 we deﬁned the ﬁve loss functions we used in the experiments: Cross Entropy ( CE ), HingeLoss ( Hinge ) (Carlini and Wagner, 2017), Diﬀerence in logit ratio ( DLR ) (Croce and Hein, 2020), Logit Matching ( LM ).
For Hinge, the conﬁdence value κ is set to inﬁnity as to encourage stronger adversarial examples, and κ can be a loss parameter in future work.
Recall from Section 3 that the loss function search space is deﬁned as: (
L ::= targeted Loss, n with Z | untargeted Loss with Z | targeted Loss, n - untargeted Loss with Z
Z ::= logits | probabilities
Loss ::=
CrossEntropy | HingeLoss | L1 | DLR | LogitMatching
To refer to diﬀerent settings, we use the following notation:
• U : for the untargeted loss, • T : for the targeted loss, • D : for the targeted − untargeted loss • L : for using logits , and • P : for using probs
For example, we use DLR-U-L to denote untargeted DLR loss with logits .
The loss space in evaluation is shown in Table 2.
Eﬀectively, the search space includes all the
[Table] [Table] [Table] possible combinations expect that the cross-entropy loss supports only probability.
Note that although (cid:96) DLR is designed for logits, and (cid:96) LogitMatching is designed for targeted attacks, the search space still makes other possibilities an option (i.e., it is up to the search algorithm to learn which combinations are useful and which are not).
C.2 Attack Algorithm & Parameters Space S
Recall the attack space deﬁned in Section 3 as:
[Equation]
randomize , EOT , repeat are the generic parameters, and for params are attack speciﬁc parameters.
The type of every parameter is either integer or ﬂoat.
An integer ranges from p [Table] to q inclusive is denoted as Z [ p, q ].
A ﬂoat range from p to q inclusive is denoted as R [ p, q ].
Besides value range, prior is needed for parameter estimator model ( TPE in our case) [Table] which is either uniform (default) or log uniform (denoted with ∗ ).
For example, ∗ Z [1 , 100] means an integer value ranges from 1 to 100 with log uniform prior; R [0 . 1 , 1] means a ﬂoat value ranges from 0 .
1 to 1 with uniform prior.
Generic parameters and the supported loss for each attack algorithm are deﬁned in
Table 3.
The algorithm returns a deterministic result if randomize is False, and otherwise the results might diﬀer due to randomization.
Randomness can come from either perturbing the initial input or randomness in the attack algorithm.
Input perturbation is deterministic if the starting input is the original input or an input with ﬁxed disturbance, and it is randomized if the starting input is chosen uniformly at random within the adversarial capability.
For example, the ﬁrst iteration of FAB uses the original input but the subsequent inputs are randomized (if the randomization is enabled).
Attack algorithms like SQR , which is based on random search, has randomness in the algorithm itself.
The deterministic version of such randomized algorithms is obtained by ﬁxing the initial random seed.
The deﬁnition of randomize for FGSM , PGD , NES , APGD , FAB , DeepFool , C&W is whether to start from the original input or uniformly at random select a point within the adversarial capability.
For SQR random means whether to ﬁx the seed.
We generally set randomize to be True to allow repeating the attacks for stronger attack strength, yet we set DeepFool and C&W to False as they are minimization attacks designed with the original inputs as the starting inputs.
The attack speciﬁc parameters are speciﬁed in Table 4, and the ranges are chosen to be representative by setting reasonable upper and lower bounds to include the default values of parameters.
Note that DeepFool algorithm uses the loss D to take diﬀerence between the predictions of two classes by design (i.e., targeted − untargeted loss).
C&W uses the hinge loss, and FAB uses loss similar to DeepFool .
For C&W and FAB , we just take the library implementation of the loss (i.e. without our loss function space formulation).
C.3 Search space conditioned on network property
In our work, properties of network defenses (e.g. randomized, detector, obfuscation) are used to reduce the search space.
EOT is set to be 1 for deterministic networks.
Repeat is set to be 1 for randomized networks, following the practise of AA setting repeat to 1 in its rand version.
Logit Matching is enabled only when detectors are present since the loss is considered as a loss to bypass detectors.