/EWR-PGD

white box adversarial attack

Efficient Warm Restart Projected Gradient Descent (EWR-PGD)

We propose a new white box adversarial attack method named EWR-PGD which exceeds the state-of-the-art attacks performance. It is more efficient than the state-of-the-art ODI-PGD method.

Code will be available soon.


Comparison of EWR-PGD and ODI-PGD

When reducing the models to the same accuracy, the number of restarts required by the EWR-PGD significantly less than that of the ODI-PGD. EWR-PGD is up to roughly 5 times faster than ODI-PGD.

image

image

Figure 1. On 10 state-of-the-art defense models, comparison of the number of restarts required(the lower the better) when the EWR-PGD and ODI-PGD methods reduce the models to the same accuracy.

The models are available online:


Results on 3 White-box leaderboards

EWR-PGD ranks first on the TRADES white-box MNIST and CIFAR-10 leaderboards, reducing the accuracy of their MNIST model to 92.52% and the accuracy of their CIFAR-10 model to 52.95%. EWR-PGD also ranks first on MardyLab’s White-box CIFAR-10 leaderboard, reducing the accuracy of their CIFAR-10 model to 43.96%.

Table 1. Accuracy(the lower the better) under EWR-PGD and SOTA attacks and corresponding complexity.

dataset model EWR-PGD EWR-PGD complexity SOTA SOTA complexity
MNIST TRADES-SMN 92.53%±0.01% (20+300)×800 92.58% -------------
CIFAR-10 TRADES-WRN 52.98%±0.02% (5+100)×30 53.01% (10+150)×20
CIFAR-10 MadryLab-WRN 43.98%±0.02% (5+100)×30 43.99% (10+150)×20

Results on CIKM2020 Analyticup: Alibaba-Tsinghua Adversarial Challenge on Object Detection

EWR-PGD ranks first among 1701 teams in CIKM2020 Analyticup: Alibaba-Tsinghua Adversarial Challenge on Object Detection. Surpassing the runner-up approach by∼14% in terms of scores.


contact

Please contact liuye_ly94@163.com if you have any question.Enjoy!