Dummy-Aware Weighted Attack (DAWA): Breaking the Safe Sink in Dummy Class Defenses
Yunrui Yu, Xuxiang Feng, Pengda Qin, Pengyang Wang, Kafeng Wang, Cheng-zhong Xu, Hang Su, Jun Zhu

TL;DR
This paper introduces DAWA, a new attack method that more accurately evaluates Dummy Classes-based defenses, revealing their overestimated robustness and emphasizing the need for improved assessment techniques.
Contribution
The paper proposes DAWA, an adaptive attack that targets both true and dummy classes, effectively breaking Dummy Classes-based defenses and providing a more reliable robustness evaluation.
Findings
DAWA reduces the measured robustness of a leading defense from 58.61% to 29.52%.
Extensive experiments validate DAWA's effectiveness across datasets and perturbation settings.
The work highlights the limitations of conventional evaluation strategies for Dummy Classes defenses.
Abstract
Adversarial robustness evaluation faces a critical challenge as new defense paradigms emerge that can exploit limitations in existing assessment methods. This paper reveals that Dummy Classes-based defenses, which introduce an additional "dummy" class as a safety sink for adversarial examples, achieve significantly overestimated robustness under conventional evaluation strategies like AutoAttack. The fundamental limitation stems from these attacks' singular focus on misleading the true class label, which aligns perfectly with the defense mechanism--successful attacks are simply captured by the dummy class. To address this gap, we propose Dummy-Aware Weighted Attack (DAWA), a novel evaluation method that simultaneously targets both the true label and dummy label with adaptive weighting during adversarial example synthesis. Extensive experiments demonstrate that DAWA effectively breaks…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
