标题： 扩大随机梯度自由对抗攻击揭示了使用现有攻击方法对鲁棒性的高估 显示英文标题

标题： Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks

摘要： 现代神经网络在对抗性操作下表现出高度的不鲁棒性。 大量工作已经投入到通过形式化保证来计算鲁棒性的下界以及构建可证明鲁棒的模型的技术中。 然而，对于更大的网络或对更大的扰动的鲁棒性，仍然难以获得保证。 因此需要攻击策略来提供实际鲁棒性的紧致上界。 我们显著改进了针对ReLU网络的随机梯度无关攻击[9]，特别是将其扩展到大型网络。 我们表明，我们的攻击在鲁棒准确性方面与最先进的攻击如PGD或Carlini和Wagner的方法相当或显著更低，从而揭示了这些最先进的方法对鲁棒性的高估。 我们的攻击不基于梯度下降方案，从这个意义上说是梯度无关的，这使得它对超参数的选择不太敏感，因为不需要仔细选择步长。 显示英文摘要

摘要： Modern neural networks are highly non-robust against adversarial manipulation. A significant amount of work has been invested in techniques to compute lower bounds on robustness through formal guarantees and to build provably robust models. However, it is still difficult to get guarantees for larger networks or robustness against larger perturbations. Thus attack strategies are needed to provide tight upper bounds on the actual robustness. We significantly improve the randomized gradient-free attack for ReLU networks [9], in particular by scaling it up to large networks. We show that our attack achieves similar or significantly smaller robust accuracy than state-of-the-art attacks like PGD or the one of Carlini and Wagner, thus revealing an overestimation of the robustness by these state-of-the-art methods. Our attack is not based on a gradient descent scheme and in this sense gradient-free, which makes it less sensitive to the choice of hyperparameters as no careful selection of the stepsize is required.