Research map / Adversarial robustness and security / Black-box and transfer attacks
MORA: Improving Ensemble Robustness Evaluation with Model Reweighing Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MORA mt instead of the strongest reported baseline attack | ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 3.34 -> 0.34 | Helped |
| Use MORA mt instead of the strongest reported baseline attack | Dverge-8 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 56.71 -> 55.57 | Helped |
| Use MORA mt instead of the strongest reported baseline attack | GAL-8 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 37.46 -> 27.44 | Helped |
| Use MORA mt instead of the strongest reported baseline attack | ADP-3 voting ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 8.29 -> 0.29 | Helped |
| Use MORA mt instead of the strongest reported baseline attack | GAL-8 logits ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 31.17 -> 30.66 | Helped |
| Use MORA mt instead of the strongest reported baseline attack | PDD+DEG softmax ensemble · CIFAR-100 test, ε=0.01 | robust accuracy (%): 9.19 -> 0.62 | Helped |
| Add momentum to the PGD attack (ablation) | PGD attack on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 8.98 -> 5.98 | Helped |
| Add early stopping (ablation) | Momentum PGD on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 5.98 -> 5.04 | Helped |
| Replace constant step size with a cosine schedule (ablation) | Early-stop momentum PGD on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 5.04 -> 4.14 | Helped |
| Add sub-model logits to the attack loss (ablation) | Cosine-step PGD on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 4.14 -> 0.69 | Helped |
| Normalize logits by the difference of logits (ablation) | Sub-model-logit attack on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 0.69 -> 0.66 | Helped |
| Adaptively reweigh sub-model gradients (ablation) | Normalized sub-model-logit attack on ADP-3 softmax ensemble · CIFAR-10 test, ε=0.01 | robust accuracy (%): 0.66 -> 0.63 | Helped |
Closest papers by meaning
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.92)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.89)
- Understanding Model Ensemble in Transferable Adversarial Attack (ICML 2025 · similarity 0.89)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.89)
- Ensemble Diversity Facilitates Adversarial Transferability (CVPR 2024 · similarity 0.88)
- Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.