The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the lp-norms for p∈{1,2,∞} aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one lp-norm, and is robust to the phenomenon of gradient masking.
@article{arxiv.1907.02044,
title = {Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack},
author = {Francesco Croce and Matthias Hein},
journal= {arXiv preprint arXiv:1907.02044},
year = {2020}
}