Research map / Adversarial robustness and security / Certified and empirical robustness
GSE: Group-wise Sparse and Explainable Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GSE, a two-phase group-wise sparse adversarial attack that uses a 1/2-quasinorm proximal step with adaptive per-pixel regularization to select pixels, then projected Nesterov accelerated gradient descent with l2 regularization to minimize perturbation magnitude.
Problem
Generating group-wise sparse adversarial perturbations that are low-magnitude, concentrated on semantically important image regions, and explainable, which is a non-convex optimization challenge.
Approach
Select perturbed pixels by a heuristic that lowers the 1/2-quasinorm regularization weight near already-perturbed pixels (AdjustLambda with Gaussian-blurred masks), then solve a restricted l2-regularized problem over the selected coordinates with projected NAG.
Key results
- Achieves 100% ASR with d_{2,0} reduced by 50.9% on CIFAR-10 and 38.4% on ImageNet versus baselines in average-case targeted attacks.
- On ImageNet ResNet50 untargeted attack, GSE reaches ACP 1629 and d_{2,0} 3428 versus StrAttack's 7265 and 11693 at 100% ASR.
- GSE runs substantially faster, e.g., 3.18s per batch-100 untargeted ImageNet ResNet50 vs 15.2s for StrAttack (reported per-image time in table).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GSE instead of StrAttack | ResNet20 untargeted attack · CIFAR-10 | ACP: 118 -> 41.7 | Helped |
| Use GSE instead of StrAttack | ResNet20 untargeted attack · CIFAR-10 | d_{2,0}: 428 -> 177 | Helped |
| Use GSE instead of FWnucl | ResNet20 untargeted attack · CIFAR-10 | ASR: 94.6% -> 100% | Helped |
| Use GSE instead of StrAttack | ResNet50 untargeted attack · ImageNet | ACP: 7265 -> 1629 | Helped |
| Use GSE instead of StrAttack | ResNet50 untargeted attack · ImageNet | d_{2,0}: 11693 -> 3428 | Helped |
| Use GSE instead of FWnucl | ResNet50 untargeted attack · ImageNet | ASR: 47.4% -> 100% | Helped |
| Use GSE instead of StrAttack | ViT_B_16 untargeted attack · ImageNet | ACP: 3589 -> 941 | Helped |
| Use GSE instead of StrAttack | ViT_B_16 untargeted attack · ImageNet | d_{2,0}: 8152 -> 1964 | Helped |
| Use GSE instead of FWnucl | ViT_B_16 untargeted attack · ImageNet | ASR: 57.9% -> 100% | Helped |
| Use GSE instead of StrAttack | attack on adversarially trained ResNet50 · ImageNet | ASR: 100% -> 98.5% | Hurt |
| Increase k-hat (ablation) | GSE · ImageNet, ResNet50 | ANC: 16.3 at k-hat=10; 4.36 at k-hat=100 | Helped |
| Increase k-hat (ablation) | GSE · ImageNet, ResNet50 | d_{2,0}: 3529 at k-hat=10; 2656 at k-hat=100 | Helped |
Surprising findings
- SAPF and Homotopy-Attack achieve slightly lower l2 perturbation norms than GSE, which the authors argue is secondary for group-wise sparse attacks.
- FWnucl achieves 0% worst-case targeted ASR on ImageNet, and GSE's transferability is comparable to StrAttack and FWnucl rather than clearly superior.
Limitations
- Achieves slightly larger l2 perturbation norms than SAPF and Homotopy-Attack on CIFAR-10.
- Hyperparameters (q, sigma, mu, k-hat) are tuned by grid search per dataset, and SAPF could not be replicated on ImageNet due to floating-point overflow.
- Transferability performance is comparable to baselines rather than clearly superior.
Experimental setup
Datasets: CIFAR-10 ImageNet NIPS2017
Benchmarks: CIFAR-10 ImageNet NIPS2017
Metrics: attack success rate average number of changed pixels average number of clusters l2 norm d_{2,0} group-wise sparsity interpretability score computation time
Baselines: StrAttack FWnucl Homotopy-Attack SAPF PGD0 Sparse-RS
Builds on: forward-backward splitting 1/2-quasinorm regularization StrAttack FWnucl Homotopy-Attack
Closest papers by meaning
- Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training (CVPR 2024 · similarity 0.92)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.86)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.86)
- Adversarial generalization of unfolding (model-based) networks (NeurIPS 2025 · similarity 0.86)
- BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.85)
- High-dimensional (Group) Adversarial Training in Linear Regression (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.