Research map / Adversarial robustness and security / Certified and empirical robustness
Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Decouple perturbation direction and norm, updating the norm according to whether the current sample is adversarial | DDN attack · MNIST, CIFAR-10, and ImageNet untargeted attacks | iterations for comparable or better L2 distortion: 100 iterations; C&W required 54,007 | Helped |
| Use 100 DDN iterations instead of C&W 1×100 | Untargeted MNIST attack · MNIST test | mean L2: 1.5917 -> 1.4563 | Helped |
| Use DDN 1,000 iterations instead of C&W 9×10,000 | Untargeted CIFAR-10 attack · CIFAR-10 test | mean L2: 0.1543 -> 0.1480 | Helped |
| Use DDN 1,000 iterations instead of C&W 9×10,000 | Untargeted ImageNet attack · ImageNet validation | mean L2: 0.4692 -> 0.3617 | Helped |
| Use DDN 100 instead of C&W 9×10,000 | Targeted MNIST attack, average case · MNIST targeted, average case | mean L2: 1.9481 -> 1.9763 | Hurt |
| Use DDN 100 instead of C&W 9×10,000 | Targeted CIFAR-10 attack, average case · CIFAR-10 targeted, average case | mean L2: 0.2798 -> 0.2925 | Hurt |
| Use DDN 1,000 instead of C&W 9×10,000 | Targeted ImageNet attack, average case · ImageNet targeted, average case | mean L2: 0.96 -> 0.8444 | Helped |
| Train on adversarial examples generated by DDN, bounded by a maximum L2 norm | MNIST classifier · MNIST, attack norm ≤ 1.5 | model accuracy: 67.3 -> 87.2 | Helped |
| Train on adversarial examples generated by DDN, bounded by a maximum L2 norm | CIFAR-10 classifier · CIFAR-10, attack norm ≤ 0.5 | model accuracy: 56.1 -> 67.6 | Helped |
| Train using DDN-generated adversarial examples | MNIST classifier · MNIST clean test | accuracy: 98.53% -> 99.01% | Helped |
| Train using DDN-generated adversarial examples | CIFAR-10 classifier · CIFAR-10 clean test | accuracy: 87.3% -> 89.0% | Helped |
Closest papers by meaning
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.88)
- Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints (NeurIPS 2021 · similarity 0.88)
- Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (ICML 2020 · similarity 0.87)
- Adversarial Robustness through Local Linearization (NeurIPS 2019 · similarity 0.87)
- Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning (CVPR 2024 · similarity 0.86)
- The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for $\ell_2$ Norm Estimation (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.