Research map / Adversarial robustness and security / Certified and empirical robustness
A2: Efficient Automated Attacker for Boosting Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace PGD¹⁰ with 20-step A² | MART adversarial training attack · CIFAR-10, MART model attack | attack effect (%): 53.76 -> 53.52 | Helped |
| Use 20-step A²† with expanded η=8/255 search | RST-AWP model attack · CIFAR-10, RST-AWP model attack | attack effect (%): 64.03 -> 63.97 | Helped |
| Train AT with A² instead of PGD¹⁰ | PreActResNet-18 AT · SVHN, Best robustness | robustness (%): 53.36 -> 56.76 | Helped |
| Train AWP with A² instead of PGD¹⁰ | PreActResNet-18 AWP · CIFAR-10, Best robustness | robustness (%): 55.39 -> 55.71 | Helped |
| Train AT with A² instead of PGD¹⁰ | PreActResNet-18 AT · CIFAR-100, Last robustness | robustness (%): 20.82 -> 20.28 | Hurt |
| Train AT with A² instead of PGD¹⁰ | WRN-34-10 AT · CIFAR-10, natural examples | accuracy (%): 87.30 -> 84.54 | Hurt |
| Train AT with A² instead of PGD¹⁰ | WRN-34-10 AT · CIFAR-10, FGSM | robustness (%): 56.10 -> 63.72 | Helped |
| Train TRADES with A² instead of PGD¹⁰ | WRN-34-10 TRADES · CIFAR-10, AutoAttack | robustness (%): 53.08 -> 55.03 | Helped |
| Train AWP with A² instead of PGD¹⁰ | WRN-34-10 AWP · CIFAR-10, AutoAttack | robustness (%): 54.04 -> 54.86 | Helped |
| Increase A² step-size range to η=5/255 (ablation) | 10-step A² attacking TRADES-AWP · CIFAR-10 | attack effect (%): 59.67 -> 59.49 | Helped |
| Increase A² step-size range to η=8/255 (ablation) | 10-step A² attacking TRADES-AWP · CIFAR-10 | attack effect (%): 59.67 -> 59.53 | Helped |
| Set attacker learning rate ξ=10⁻² rather than 10⁻³ (ablation) | 10-step A² attacking TRADES-AWP · CIFAR-10 | attack effect (%): 59.67 -> 59.93 | Hurt |
Closest papers by meaning
- Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack (CVPR 2022 · similarity 0.89)
- The Best Defense Is a Good Offense: Adversarial Augmentation Against Adversarial Attacks (CVPR 2023 · similarity 0.89)
- Automated Discovery of Adaptive Attacks on Adversarial Defenses (NeurIPS 2021 · similarity 0.89)
- Adversarial Attack Generation Empowered by Min-Max Optimization (NeurIPS 2021 · similarity 0.88)
- Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.87)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.