Research map / Adversarial robustness and security / Certified and empirical robustness
Accurate, reliable and fast robustness evaluation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Follow the adversarial boundary toward the clean input using gradient-estimated local geometry | Proposed gradient-based attacks · L2 untargeted and targeted across six models | median perturbation distance: 1.15 vs 3.24; 1.70 vs 4.79 | Helped |
| Use the proposed L∞ boundary-following attack instead of PGD or AdamPGD | L∞ attacks · Untargeted and targeted model evaluations | model accuracy: 0.1% to 14.0% | Helped |
| Use the proposed L1 attack instead of EAD | L1 attacks · Models in Table 1 and Table 2 | median perturbation distance: up to a factor six | Helped |
| Use the proposed attack instead of SaliencyMap or SparseFool | L0 and L1 attacks · Defended models | attack success | Helped |
| Use the proposed L∞ attack instead of AdamPGD | L∞ attack · LP targeted | model accuracy: 0.6% vs 0.9% | Hurt |
| Use the proposed L2 attack rather than C&W | L2 attacks · Query-limited evaluations | queries to approach convergence: 10 to 20 queries; several hundred iterations | Helped |
| Use the proposed L∞ attack rather than PGD or AdamPGD | L∞ attacks · After around 10 queries | attack success: around 10 queries | Helped |
| Use one hyperparameter instead of eight (ablation) | Proposed attacks · L2 and L∞ hyperparameter robustness evaluation | performance drop: 4% | Hurt |
| Use one repetition instead of five (ablation) | Proposed attacks · L2 and L∞ hyperparameter robustness evaluation | performance drop: 15% - 19% | Hurt |
| Use the same trust-region hyperparameter across models instead of tuning it per model (ablation) | Proposed attacks · L2 and L∞ hyperparameter robustness evaluation | performance | No clear effect |
| Change the trust region two orders of magnitude above or below its optimum (ablation) | Proposed attacks · L2 and L∞ hyperparameter robustness evaluation | performance drop: less than 15% | Hurt |
| Change C&W's optimal parameter by one order of magnitude (ablation) | C&W · L2 and L∞ hyperparameter robustness evaluation | performance drop: almost 50% | Hurt |
Closest papers by meaning
- Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples (NeurIPS 2022 · similarity 0.92)
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.92)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.91)
- Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.90)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.90)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.