Research map / Adversarial robustness and security / Certified and empirical robustness

SuperDeepFool: a new fast and accurate minimal adversarial attack

NeurIPS 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Robustness-accuracy trade-off analysis · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SuperDeepFool (SDF), a DeepFool-based minimal ℓ2 adversarial attack that alternates DF steps with a geometric projection toward the optimal perturbation, and shows it is more accurate and far cheaper than prior minimum-norm attacks.

Problem

Evaluating robustness to minimal ℓ2 adversarial perturbations is either computationally expensive (C&W, augmented Lagrangian methods) or inaccurate (DeepFool), so a fast and accurate minimum-norm attack is needed.

Approach

Alternate DeepFool steps (until the decision boundary is reached) with a projection step that rotates the perturbation toward the normal of the decision boundary, yielding a family SDF(m,n) whose best member SDF(∞,1) is parameter-free and cheap.

Key results

• SDF reaches median l2 0.09 on naturally trained ImageNet RN-50 using 37 gradient computations, versus 0.31 for DF (23 grads) and 0.10 for ALMA (100 grads).
• On MNIST IBP robust model, SDF achieves 100% fooling rate with median l2 1.37 using 52 gradients, while C&W reaches only 4.63% fooling rate.
• AutoAttack++ (SDF replacing APGD-T) is up to three times faster than AutoAttack with similar robust accuracy on six RobustBench CIFAR-10 models.

Measured effects reported in the paper

Surprising findings

• DeepFool's perturbations are poorly aligned with the decision boundary normal for complex models (cosine 0.14 for ResNet-18), while SDF raises this to about 0.72.
• Max-pooling in network design substantially changes DF's perturbation norm (up to 50%), revealing architecture sensitivity of minimum-norm attacks.

Limitations

• Primarily non-targeted and l2-focused; targeted and l-infinity extensions only partially explored, and targeted SDF does not reach 100% fooling rate.
• No formal global convergence guarantee; only local guarantees for individual DF and projection steps.
• Not yet evaluated against adaptive attacks for gradient masking.

Experimental setup

Datasets: MNIST CIFAR-10 ImageNet

Benchmarks: MNIST CIFAR-10 ImageNet RobustBench models

Metrics: fooling rate median l2 perturbation norm number of gradient computations runtime cosine similarity between perturbation and gradient robust accuracy under AutoAttack

Baselines: DeepFool C&W DDN FMN FAB ALMA AutoAttack

Builds on: DeepFool DDN FMN ALMA AutoAttack

Closest papers by meaning

• Accurate, reliable and fast robustness evaluation (NeurIPS 2019 · similarity 0.91)
• Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR 2018 · similarity 0.90)
• $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.90)
• Adversarial Robustness Against the Union of Multiple Perturbation Models (ICML 2020 · similarity 0.89)
• Increasing Confidence in Adversarial Robustness Evaluations (NeurIPS 2022 · similarity 0.89)
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.89)