Research map / Adversarial robustness and security / Certified and empirical robustness
Efficient Robustness Evaluation via Constraint Relaxation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Constraint Relaxation Attack (CR Attack), an adversarial attack that temporarily relaxes the l-inf perturbation bound during optimization, and reports higher success and ~38x/16x lower forward/backward cost than AutoAttack on 105 RobustBench models.
Problem
Evaluating adversarial robustness with AutoAttack is computationally expensive, limiting its practicality for fast robustness evaluation of defended models.
Approach
Temporarily expand the perturbation bound (epsilon + alpha) during the attack's gradient steps, with periodic partial resets, and then clip back to the original bound, building on the multi-targeted attack framework to find adversarial examples more efficiently than AutoAttack.
Key results
- CR Attack reduces forward and backward propagation cost by 38.3x and 15.9x versus AutoAttack across 105 robust models, achieving a higher ASR on 95 of 105 models.
- On CIFAR-10 top-30 models, CR Attack achieves lower robust accuracy than AutoAttack on most models and surpasses several best-known RobustBench values (e.g., 67.55% vs 67.73% for Cui et al. 2023).
- On the two WRN-28-10 models, CR finds 18 and 15 adversarial examples that AutoAttack misses, with only 0 and 5 misses in the reverse direction.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CR Attack instead of AutoAttack | Robust models evaluated on CIFAR-10, CIFAR-100, and ImageNet · 105 robust models | number of models with higher attack success rate: 95 / 105 | Helped |
| Use CR Attack instead of AutoAttack | Robust models evaluated on CIFAR-10, CIFAR-100, and ImageNet · 105 robust models | forward propagation speedup: 38.3× | Helped |
| Use CR Attack instead of AutoAttack | Robust models evaluated on CIFAR-10, CIFAR-100, and ImageNet · 105 robust models | backward propagation speedup: 15.9× | Helped |
| Add constraint relaxation to CR Attack (ablation) | CR Attack · CIFAR-10, CIFAR-100, and ImageNet robust-model subsets | robust accuracy (%): 73.71 -> 73.59; 72.12 -> 71.85; 71.61 -> 71.42; 42.76 -> 42.57; 39.27 -> 39.13; 38.85 -> 38.67 | Helped |
| Add APGD-CE to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Cui et al. 2023 model | robust accuracy (%): 70.36 -> 67.73 | Helped |
| Add APGD-DLR to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Cui et al. 2023 model | robust accuracy (%): 67.78 -> 67.73 | Helped |
| Add FAB to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Cui et al. 2023 model | robust accuracy (%): 68.26 -> 67.73 | Helped |
| Add Square Attack to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Cui et al. 2023 model | robust accuracy (%): 74.05 -> 67.73 | Helped |
| Add APGD-CE to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Wang et al. 2023 model | robust accuracy (%): 70.05 -> 67.31 | Helped |
| Add APGD-DLR to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Wang et al. 2023 model | robust accuracy (%): 67.35 -> 67.31 | Helped |
| Add FAB to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Wang et al. 2023 model | robust accuracy (%): 67.81 -> 67.31 | Helped |
| Add Square Attack to AutoAttack (ablation) | AutoAttack on WRN-28-10 · CIFAR-10, Wang et al. 2023 model | robust accuracy (%): 73.73 -> 67.31 | Helped |
Surprising findings
- Removing constraint relaxation only slightly degrades results, and integrating CR into AutoPGD yields only modest gains, suggesting the benefit depends on the base optimizer.
Limitations
- Performance gain over AutoAttack is modest in robust accuracy (often a few tenths of a percent).
- Constraint relaxation integrated into AutoPGD gives only modest improvements, suggesting attack-specific adaptation is needed.
- Evaluation limited to l-inf attacks on RobustBench image classifiers (CIFAR-10, CIFAR-100, ImageNet).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: RobustBench CIFAR-10 RobustBench CIFAR-100 RobustBench ImageNet
Metrics: robust accuracy attack success rate average forward propagations average backward propagations
Baselines: AutoAttack APGD-CE APGD-DLR FAB Square Attack
Builds on: AutoAttack PGD MultiTargeted attack RobustBench
Closest papers by meaning
- Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack (CVPR 2022 · similarity 0.91)
- Accurate, reliable and fast robustness evaluation (NeurIPS 2019 · similarity 0.90)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.88)
- ROME is Forged in Adversity: Robust Distilled Datasets via Information Bottleneck (ICML 2025 · similarity 0.88)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.87)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.