Research map / Adversarial robustness and security / Attacks on text and graphs
Composite Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Compose a searched sequence of attacks instead of using a single attack | CAA on CIFAR-10 l∞ defenses · CIFAR-10 l∞ | robust accuracy (%): BestAttack: 50.12, 52.01, 55.23, 41.85, 9.12, 0.84, 60.74 -> CAA_dic: 49.18, 51.10, 54.69, 40.69, 7.28, 0.0, 59.38 | Helped |
| Use proxy-searched CAA rather than state-of-the-art attack baselines | CAA_sub on ImageNet l∞ · ImageNet l∞ | robust accuracy (%): 40.03 -> 38.30 | Helped |
| Compose unrestricted base attacks in a searched policy | CAA_dic · Bird&Bicycle unrestricted | robust accuracy (%): 100.0 -> 7.9; 100.0 -> 4.0 | Helped |
| Use CAA_sub rather than CAA_dic | CAA on CIFAR-10 l∞ · CIFAR-10 l∞ | robust accuracy (%): 49.18 -> 49.18; 51.19 -> 51.10; 54.82 -> 54.69; 40.87 -> 40.69; 7.47 -> 7.28; 0.0 -> 0.0; 59.45 -> 59.38 | No clear effect |
| Replace direct attack-policy search with ensemble aggregation | CAA versus EnsAttack · CIFAR-10 l∞ | robust accuracy (%): CAA_dic: 49.18, 51.10, 54.69, 40.69, 7.28, 0.0, 59.38; EnsAttack: 49.58, 51.51, 55.02, 41.56, 8.33, 0.73, 60.12 | Hurt |
| Use a longer attack policy (ablation) | CAA · l∞, l2, and unrestricted | robust accuracy | Helped |
| Increase policy length beyond 3 (ablation) | CAA unrestricted · unrestricted | robust accuracy | Helped |
| Increase policy length (ablation) | CAA l2 · l2 | robust accuracy | Helped |
| Use NSGA-II rather than Random Search-100 (ablation) | Attack-policy search · CIFAR-10 l∞, AdvTrain | robust accuracy (%): 52.09 -> 49.18 | Helped |
| Use NSGA-II rather than Reinforcement Learning (ablation) | Attack-policy search · CIFAR-10 l∞, AdvTrain | robust accuracy (%): 51.44 -> 49.18 | Helped |
| Use NSGA-II rather than Bayesian Optimization (ablation) | Attack-policy search · CIFAR-10 l∞, AdvTrain | robust accuracy (%): 50.02 -> 49.18 | Helped |
| Search from scratch instead of transferring the proxy policy (ablation) | CAA on DenseNet · CIFAR-10, DenseNet | robust accuracy (%): 49.90 -> 49.90 | No clear effect |
Closest papers by meaning
- Automated Discovery of Adaptive Attacks on Adversarial Defenses (NeurIPS 2021 · similarity 0.86)
- MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks (ICML 2026 · similarity 0.86)
- A2: Efficient Automated Attacker for Boosting Adversarial Training (NeurIPS 2022 · similarity 0.85)
- MOS-Attack: A Scalable Multi-objective Adversarial Attack Framework (CVPR 2025 · similarity 0.85)
- Diversified Adversarial Attacks based on Conjugate Gradient Method (ICML 2022 · similarity 0.85)
- Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack (CVPR 2022 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.