[Paper Review] Automated Discovery of Adaptive Attacks on Adversarial Defenses

Chengyuan Yao, Pavol Bielik+2 more|arXiv (Cornell University)|Feb 23, 2021

Adversarial Robustness in Machine Learning48 references4 citations

TL;DR

This paper proposes A3 (Adaptive AutoAttack), an automated framework that discovers strong, defense-specific adaptive attacks by searching over a formalized space of reusable attack components—such as algorithms, network transformations, and loss functions. It outperforms AutoAttack by discovering 3.0%–50.8% more adversarial examples on 10 out of 24 evaluated defenses, significantly improving robustness evaluation while reducing manual effort.

ABSTRACT

Reliable evaluation of adversarial defenses is a challenging task, currently limited to an expert who manually crafts attacks that exploit the defense's inner workings or approaches based on an ensemble of fixed attacks, none of which may be effective for the specific defense at hand. Our key observation is that adaptive attacks are composed of reusable building blocks that can be formalized in a search space and used to automatically discover attacks for unknown defenses. We evaluated our approach on 24 adversarial defenses and show that it outperforms AutoAttack, the current state-of-the-art tool for reliable evaluation of adversarial defenses: our tool discovered significantly stronger attacks by producing 3.0\%-50.8\% additional adversarial examples for 10 models, while obtaining attacks with slightly stronger or similar strength for the remaining models.

Motivation & Objective

• To address the challenge of unreliable evaluation of adversarial defenses, which often fails due to the lack of strong, tailored attacks.
• To automate the manual, expert-intensive process of crafting adaptive attacks that exploit defense-specific weaknesses.
• To formalize reusable attack components—such as algorithms, loss functions, and network transformations—into a search space for automated attack discovery.
• To improve the reliability and strength of adversarial robustness evaluation by discovering attacks tailored to individual defenses.
• To reduce the burden of trial-and-error in attack development while preserving the ability for human experts to innovate on new attack types.

Proposed method

• The method defines a search space composed of three core components: attack algorithms (e.g., PGD, APGD, FAB), network transformations (e.g., BPDA, layer removal), and loss functions (e.g., cross-entropy, DLR, C&W).
• It formulates the attack discovery task as an optimization problem over this search space, where each configuration represents a candidate adaptive attack.
• The search is guided by an algorithm that efficiently explores combinations of attack components, leveraging techniques such as Bayesian optimization or early stopping to balance effectiveness and cost.
• The framework supports dynamic adaptation of hyperparameters (e.g., step size, number of steps) and integrates techniques like EOT (Expectation over Transformations) and randomization to improve attack success.
• The tool, named Adaptive AutoAttack (A3), is implemented to automatically test defenses by searching for the strongest attack within the defined space.
• The approach allows for extensibility: new attack components can be added by experts to expand the search space without re-architecting the system.

Experimental results

Research questions

• RQ1 Can a systematic, automated approach discover stronger adaptive attacks than existing fixed-ensemble methods like AutoAttack?
• RQ2 Can reusable attack components—such as algorithms, loss functions, and network transformations—be formalized into a search space that enables effective attack discovery?
• RQ3 To what extent can automated search outperform manual, expert-crafted adaptive attacks in terms of adversarial success rate?
• RQ4 How does the performance of the automated tool compare across diverse adversarial defenses with varying defense mechanisms?
• RQ5 Can the search process re-discover or improve upon known adaptive attacks even when they are not explicitly included in the search space?

Key findings

• A3 discovered significantly stronger attacks than AutoAttack on 10 out of 24 evaluated defenses, producing 3.0% to 50.8% more adversarial examples.
• For the remaining 14 defenses, A3 achieved attack strength that was slightly better or comparable to AutoAttack, indicating robustness across diverse defense types.
• The tool successfully re-discovered or improved upon handcrafted adaptive attacks not explicitly included in its search space, demonstrating generalization capability.
• The search space design enabled effective exploration of attack configurations, including dynamic step size, modified loss functions, and surrogate model transformations.
• The framework reduces the need for manual trial-and-error in attack development, allowing experts to focus on innovation rather than configuration tuning.
• Despite its success, the search space remains incomplete, and expensive attacks can incur high computational cost due to lack of runtime modeling.