Rethinking Classifier and Adversarial Attack

TL;DR

This paper introduces a decouple space method and an iterative optimization technique called ACBI to more accurately evaluate adversarial robustness, revealing that many defenses are less robust than previously estimated.

Contribution

It proposes a novel decouple space approach and ACBI method for more precise adversarial robustness evaluation, challenging existing overestimations.

Findings

ACBI achieves lower robust accuracy across multiple defense models.

The decouple space method effectively separates classifier components for analysis.

Existing robustness evaluations tend to overestimate model robustness.

Abstract

Various defense models have been proposed to resist adversarial attack algorithms, but existing adversarial robustness evaluation methods always overestimate the adversarial robustness of these models (i.e., not approaching the lower bound of robustness). To solve this problem, this paper uses the proposed decouple space method to divide the classifier into two parts: non-linear and linear. Then, this paper defines the representation vector of the original example (and its space, i.e., the representation space) and uses the iterative optimization of Absolute Classification Boundaries Initialization (ACBI) to obtain a better attack starting point. Particularly, this paper applies ACBI to nearly 50 widely-used defense models (including 8 architectures). Experimental results show that ACBI achieves lower robust accuracy in all cases.