Research map / Adversarial robustness and security / Black-box and transfer attacks
Adversarial Perturbations Are Formed by Iteratively Learning Linear Combinations of the Right Singular Vectors of the Adversarial Jacobian
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RisingAttacK, an SQP-based method that solves ordered top-K targeted adversarial attacks directly in image space by iteratively optimizing linear combinations of right singular vectors of the adversarial Jacobian, outperforming QuadAttacK on ImageNet-1k.
Problem
White-box ordered top-K targeted attacks, where K target classes must be fooled in a specified order, and computing the corresponding perturbations directly in image space rather than feature space.
Approach
Linearize the DNN logits around the current perturbed image, compact the ordered top-K constraints into a small set of rows, and solve the resulting QP in the subspace spanned by the right singular vectors of the adversarial Jacobian, alternating anchor points between benign and perturbed images, with an l-infinity percentile projection post-process.
Key results
- RisingAttacK achieves FoM above 2 in most cases versus QuadAttacK across K=1 to 30 on four models, i.e., holistically about 2x better.
- RisingAttacK keeps perturbations under linf 8/255 for ordered top-K up to K=20 on ResNet-50 and DEiT-B, K=15 on ViT-B, and K=10 on DenseNet-121.
- Under a 60-iteration budget, RisingAttacK reaches near-100% ASR at K=30 on ResNet-50 (0.66) versus QuadAttacK at 0.21 for the same budget, and it is faster than QuadAttacK only at K=1.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RisingAttacK60 instead of QuadAttacK60 | ResNet-50 · ImageNet-1k val, Top-30 ordered attack | ASR: 0.2076 -> 0.6642 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ResNet-50 · ImageNet-1k val, Top-20 ordered attack | ASR: 0.8344 -> 0.8306 | Hurt |
| Use RisingAttacK60 instead of QuadAttacK60 | ResNet-50 · ImageNet-1k val, Top-10 ordered attack | ASR: 0.9866 -> 0.9936 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ResNet-50 · ImageNet-1k val, Top-1 ordered attack | ASR: 0.9996 -> 0.9992 | Hurt |
| Use RisingAttacK60 instead of QuadAttacK60 | DenseNet-121 · ImageNet-1k val, Top-30 ordered attack | ASR | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | DenseNet-121 · ImageNet-1k val, Top-20 ordered attack | ASR: 0.8340 -> 0.9812 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ViT-B · ImageNet-1k val, Top-30 ordered attack | ASR: 0.3272 -> 0.9534 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ViT-B · ImageNet-1k val, Top-20 ordered attack | ASR: 0.7828 -> 0.9864 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ViT-B · ImageNet-1k val, Top-10 ordered attack | ASR: 0.9130 -> 0.9936 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | ViT-B · ImageNet-1k val, Top-1 ordered attack | ASR: 0.9998 -> 0.9388 | Hurt |
| Use RisingAttacK60 instead of QuadAttacK60 | DEiT-B · ImageNet-1k val, Top-30 ordered attack | ASR: 0.0640 -> 0.5150 | Helped |
| Use RisingAttacK60 instead of QuadAttacK60 | DEiT-B · ImageNet-1k val, Top-20 ordered attack | ASR: 0.9612 -> 0.9956 | Helped |
Surprising findings
- Lowest-K predictions as attack targets are not harder to attack than randomly sampled targets for either QuadAttacK or RisingAttacK, contrary to prior expectation.
Limitations
- Slower than QuadAttacK for K>1 due to Jacobian computation implementation.
- Results reported for only four ImageNet-1k classifiers and a single benign image set of 1000 images.
- Defensive implications are left for future work.
Experimental setup
Datasets: ImageNet-1k
Benchmarks: ImageNet-1k
Metrics: attack success rate l1 norm l2 norm linf norm figure of merits (FoM) runtime
Baselines: QuadAttacK CWK AdvDistill
Builds on: QuadAttacK CW attack Adversarial Distillation (Zhang & Wu 2020)
Closest papers by meaning
- QuadAttac$K$: A Quadratic Programming Approach to Learning Ordered Top-$K$ Adversarial Attacks (NeurIPS 2023 · similarity 0.91)
- Art of Singular Vectors and Universal Adversarial Perturbations (CVPR 2018 · similarity 0.87)
- Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints (NeurIPS 2021 · similarity 0.87)
- SORA: Free Second-Order Attacks in Fast Adversarial Training (ICML 2026 · similarity 0.86)
- Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability (NeurIPS 2020 · similarity 0.86)
- Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.