Research map / Adversarial robustness and security / Certified and empirical robustness

MOS-Attack: A Scalable Multi-objective Adversarial Attack Framework

CVPR 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Provable robust learning guarantees · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MOS-Attack, a parameter-free smooth set-based multi-objective adversarial attack built on APGD that jointly optimizes multiple surrogate losses with fewer adversarial examples, and mines loss synergy patterns to design a tri-objective MOS-3* attack.

Problem

Adversarial attacks rely on single surrogate losses to approximate the non-differentiable 0-1 loss; existing multi-loss attacks lack a systematic way to combine losses and understand their interactions efficiently.

Approach

Formulates multi-loss adversarial attack as a smooth set-based optimization over K adversarial examples (K < m losses) using log-sum-exp smooth max/min with an all-ones weight vector, solved by an APGD-style optimizer; then mines synergistic loss patterns via sparse relaxation over the example set to build a compact attack.

Key results

• MOS-8 Attack (K=5) achieves average rank 1.33 on CIFAR-10 and 1.60 on ImageNet, beating ACG-CW and APGD-All in the overall ASR comparison (APGD-All uses 8 examples).
• MOS-8 with K=1 reaches near the per-image upper bound on CIFAR-10 (e.g., 42.59 vs 42.92 for ID 0), and K=8 closes the gap to under 0.35% ASR.
• The tri-objective MOS-3* attack (losses 5,6,7) with K=1 outperforms MOS-3 with K=3 and is comparable to MOS-8.

Measured effects reported in the paper

Surprising findings

• Around 61.3% (CIFAR-10) and 57.8% (ImageNet) of adversarial examples contribute to all loss functions, suggesting low conflict among losses and that a single loss with K=1 can yield near-optimal results.

Limitations

• Gains over APGD-All are slight (often within ~0.1 to 0.5 ASR points)
• Synergy analysis relies on thresholds (T=0.85, C=0.75, lambda=1) chosen by hand
• Evaluated only on l-infinity white-box attacks on CIFAR-10 and ImageNet subsets

Experimental setup

Datasets: CIFAR-10 ImageNet

Benchmarks: RobustBench CIFAR-10 RobustBench ImageNet

Metrics: attack success rate average rank upper bound gap

Baselines: APGD-CE ACG-CW APGD-All MOS-3 Attack

Builds on: APGD AutoAttack Tchebycheff decomposition smooth max/min operators ACG

Closest papers by meaning

• AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples (AAAI 2025 · similarity 0.85)
• SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.84)
• Efficient Adversarial Training in LLMs with Continuous Attacks (NeurIPS 2024 · similarity 0.84)
• Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.84)
• Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability (ICML 2025 · similarity 0.83)
• $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.83)