Research map / Adversarial robustness and security / Certified and empirical robustness
Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FMN instead of BB for minimum-norm attack | attacks on ImageNet ResNet18 and VGG16 · ImageNet, ℓ1 ε=1.0 | success rate (%): 31.4 -> 38.4; 30.4 -> 39.8 | Helped |
| Use FMN instead of PGD | attacks on ImageNet ResNet18 and VGG16 · ImageNet, ℓ2 ε=0.15 | success rate (%): 61.7 -> 65.8; 61.4 -> 66.2 | Helped |
| Use FMN instead of PGD | attacks on ImageNet ResNet18 and VGG16 · ImageNet, ℓ∞ ε=4 · 10^-4 | success rate (%): 51.0 -> 55.2; 49.0 -> 49.0 | Mixed |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on MNIST M2 · MNIST M2 untargeted, ℓ0 | median perturbation: 8 -> 9 | Hurt |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on MNIST M2 · MNIST M2 untargeted, ℓ1 | median perturbation: 3.08 -> 2.95 | Helped |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on MNIST M2 · MNIST M2 untargeted, ℓ2 | median perturbation: 1.34 -> 1.23 | Helped |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on MNIST M2 · MNIST M2 untargeted, ℓ∞ | median perturbation: .330 -> .339 | Hurt |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on CIFAR10 C1 · CIFAR10 C1 untargeted, ℓ0 | median perturbation: 8 -> 8 | No clear effect |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on CIFAR10 C1 · CIFAR10 C1 untargeted, ℓ1 | median perturbation: 3.75 -> 3.04 | Helped |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on CIFAR10 C1 · CIFAR10 C1 untargeted, ℓ2 | median perturbation: 0.63 -> 0.61 | Helped |
| Apply FMN rather than the strongest listed baseline | minimum-norm attacks on CIFAR10 C1 · CIFAR10 C1 untargeted, ℓ∞ | median perturbation: .032 -> .032 | No clear effect |
| Use dataset-level hyperparameter tuning with FMN rather than BB | minimum-norm attacks across MNIST and CIFAR10 · dataset-level hyperparameter tuning | median perturbation | Helped |
Closest papers by meaning
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.93)
- Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (ICML 2020 · similarity 0.91)
- Understanding and Improving Fast Adversarial Training against $l_0$ Bounded Perturbations (NeurIPS 2025 · similarity 0.90)
- Accurate, reliable and fast robustness evaluation (NeurIPS 2019 · similarity 0.89)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.89)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.