[Paper Review] Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco Croce, Matthias Hein|arXiv (Cornell University)|Mar 3, 2020

Adversarial Robustness in Machine LearningComputer Science51 references434 citations

TL;DR

The paper introduces AutoAttack, a parameter-free ensemble of diverse attacks (APGD CE, APGD DLR, FAB, Square Attack) that reliably evaluates adversarial robustness without hyperparameter tuning, and demonstrates it identifies weaker defenses across 50+ models.

ABSTRACT

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness. Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art. Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking. In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function. We then combine our novel attacks with two complementary existing ones to form a parameter-free, computationally affordable and user-independent ensemble of attacks to test adversarial robustness. We apply our ensemble to over 50 models from papers published at recent top machine learning and computer vision venues. In all except one of the cases we achieve lower robust test accuracy than reported in these papers, often by more than $10\%$, identifying several broken defenses.

Motivation & Objective

• Motivate and fix unreliable evaluations of adversarial defenses due to hyperparameter tuning and attack weaknesses.
• Propose a robust, parameter-free evaluation protocol that combines complementary attacks.
• Show that the ensemble yields lower robust accuracy than many defenses reported in top venues, highlighting broken defenses.
• Demonstrate scalability and generality across datasets (MNIST, CIFAR-10/100, ImageNet) and threat models (l_infty, l_2).

Proposed method

• Extend PGD with Auto-PGD (APGD) that removes the need to choose a step size and budget-aware adaptation of step size.
• Introduce a loss-function variant (DLR loss) that is shift and rescaling invariant to mitigate gradient masking effects.
• Combine APGD CE, APGD DLR with white-box FAB and black-box Square Attack into a parameter-free ensemble called AutoAttack.
• Use a fixed budget of iterations and restarts to ensure parameter-free operation across models and datasets.
• Attack variants include APGD CE, APGD T DLR (targeted), FAB T, and Square Attack, with 100 iterations per run.
• AutoAttack selects the worst-case robust accuracy over its component attacks to estimate robustness.

Experimental results

Research questions

• RQ1 Can a parameter-free ensemble of attacks reliably estimate adversarial robustness across diverse models and datasets?
• RQ2 Do newer variants of PGD (APGD) and a gradient-invariant loss (DLR) improve attack effectiveness and robustness estimation compared to standard PGD?
• RQ3 Is combining APGD CE, APGD DLR, FAB, and Square Attack sufficient to reveal weaknesses in defenses that were previously reported as robust?
• RQ4 How does AutoAttack perform on l_infty and l_2 threat models across MNIST, CIFAR-10/100, and ImageNet?
• RQ5 Does the ensemble identify broken defenses and reduce overestimation of robustness in reviewed papers?

Key findings

• AutoAttack reduces robust accuracy relative to many defenses reported in the literature, in most cases by more than 10 percentage points.
• APGD outperforms standard PGD (with momentum) across CE, CW, and DLR losses on multiple models.
• DLR loss is more stable than cross-entropy and often comparable to CW loss, with fewer failure cases.
• Targeted versions of APGD DLR and FAB generally yield stronger attacks and lower robustness than untargeted variants on CIFAR-10/ImageNet benchmarks.
• Across 50+ classifiers from 35 defenses, AutoAttack provides reliable robustness estimates using limited预算 and no hyperparameter tuning.
• AutoAttack identifies several broken defenses and offers a practical minimal test for new defenses.