Attacking the Madry defense model with L1-based adversarial examples

1. 01What problem does this paper attempt to solve?

   The authors question the Madry competition's use of only L∞ (ε=0.3)-constrained attacks, and use EAD to generate adversarial examples that are transferable and have little visual distortion.

   Core problem: the evaluation competition for the Madry adversarially trained defense constrains attacks only by L∞ distortion (ε=0.3); the authors consider this unreasonable and attempt to break the defense with an L1-type attack after relaxing this constraint.

   • Setting and importance: DNNs are susceptible to adversarial examples that are nearly imperceptible to human perception, and adversarial examples can transfer between models for the same task (transferability). Madry et al. (2017) obtained an adversarially trained MNIST model via robust optimization (which the authors call the Madry Defense Model) and held an attack competition.
   • Shortcomings of existing evaluation (according to the authors): the competition restricts attacks to an L∞ perturbation of at most ε=0.3 per pixel; the authors state that this greatly weakens attacks not optimized under L∞ and imposes an unrealistic constraint on attackers.
   • Core observation: the authors argue that L∞ alone cannot characterize visual distortion—examples with large L∞ are not necessarily visually obvious; the key is L1/L2 distortion.
   • Approach proposed in the paper: after relaxing the L∞ constraint, use EAD (Elastic-net Attack to DNNs) to generate adversarial examples on undefended models and transfer-attack the Madry Defense Model, comparing with PGD, I-FGM, and C&W.
   • Threat model:
     • Goal: generate adversarial examples that transfer to the Madry Defense Model and cause it to misclassify, in both targeted and non-targeted settings.
     • Knowledge and capability: the attacker constructs examples on naturally trained undefended models of the same architecture (a single model or an ensemble of 3 models), then transfers them to the defense model; the paper does not use terms such as black-box to describe this setting.
     • Victim system: the adversarially trained MNIST model released by Madry Lab (trained with 40-step PGD, ε=0.3).
     • Constraint: the competition's original constraint is L∞ ε=0.3; the authors deliberately relax this constraint to test attacks under other norms.

   Collapse this answer

2. 02What related research exists?

   Related work centers on adversarial examples and transferability, Madry robust optimization defense, and attack methods such as EAD, C&W and PGD/FGM.

   Adversarial examples and transferability

   • Szegedy et al. (2013), Goodfellow et al. (2015)—proposed and explained the phenomenon of adversarial examples in DNNs; this is the background of the paper's problem.
   • Liu et al. (2016), Papernot et al. (2016)—studied the transferability of adversarial examples and black-box attacks; the paper cites their view that if an example remains adversarial against multiple models, it is more likely to transfer to an unseen model, which supports the authors' design of generating examples with an ensemble of 3 models.

   Madry defense (the attack target of this paper)

   • Madry et al. (2017)—studied adversarial robustness from the perspective of robust optimization, adversarially trained a high-capacity MNIST model using PGD starting from random perturbations as the strongest adversary, and held an attack competition (constraint L∞ ε=0.3). The paper argues that this constraint weakens non-L∞ attacks and is unrealistic for attackers; this paper attacks that model after relaxing the constraint.

   Attack methods (used or compared in this paper)

   • Carlini & Wagner (2017)—the C&W L2 attack; EAD generalizes it to elastic-net regularization, and when β=0 EAD is equivalent to the C&W L2 attack; this paper uses C&W as a comparison method.
   • Chen et al. (2017)—proposed EAD, which linearly combines L1 and L2 penalties, with β controlling the trade-off between the two; this paper uses and tunes this method.
   • FGM of Goodfellow et al. (2015) and I-FGM of Kurakin et al. (2016)—fast attacks based on the gradient sign; the authors note that I-FGM is essentially projected gradient descent on the negative loss function, and this paper uses PGD (with random start) and I-FGM (without random start) as representatives of L∞ attacks.
   • Tramèr et al. (2017)—ensemble adversarial training; its step size setting (ε/40) is used in this paper for I-FGM.

   Baselines and benchmarks: the comparison methods are PGD, I-FGM, C&W (i.e., EAD β=0), and EAD (β=0.01); the dataset is MNIST, with 1000 random test examples.

   Positioning: according to the paper, its distinction lies in relaxing the competition's L∞ constraint, systematically comparing the transferability of each attack under targeted/non-targeted settings, and arguing that L1/L2 should supplement L∞ to measure visual distortion.

   Collapse this answer

3. 03How does the paper address this problem?

   Use EAD to generate examples on undefended models (a single model or an ensemble of 3 models), transfer-attack the Madry model after relaxing the L∞ constraint, and compare ASR and distortion under each norm.

   Overall approach: relax the competition's L∞ constraint, use EAD to generate adversarial examples on undefended models with the same architecture as the defense model (a single model or an ensemble of 3 models), transfer-attack the Madry Defense Model, and compare with PGD, I-FGM, and C&W on ASR and L1/L2/L∞ distortion.

   Attack target and transfer setting

   • Madry Defense Model: a high-capacity network adversarially trained with what the authors call the strongest adversary—PGD starting from random perturbations (40 steps, step size 0.01, L∞ norm, ε=0.3).
   • Transfer setting: generate examples on a single undefended model or an ensemble of 3 undefended models, then evaluate their success rate on the defense model; the undefended models share the defense model's architecture (provided by the competition) and are naturally trained. The main text reports ensemble results; single-model results are in the supplementary material (Table 3).
   • The authors' rationale: if an example remains adversarial against multiple models, it is more likely to transfer to an unseen model (citing Liu et al. 2016, Papernot et al. 2016).

   EAD attack

   • Objective function: min_x c · f(x,t) + β|x−x₀|₁ + |x−x₀|₂², subject to x ∈ [0,1]^p; where f(x,t) = max{max_{j ≠ t}[Logit(x)]_j − [Logit(x)]_t, −κ}. β controls the trade-off between L1 and L2; when β=0 it is equivalent to the C&W L2 attack; κ controls the margin between the predicted probability of the target class and the remaining classes.
   • Properties given by the authors: increasing κ improves transferability but harms visual quality.
   • Implementation: a 9-step binary search over the regularization parameter c (starting from 0.001), with I=1000 iterations per step and an initial learning rate of 0.01; C&W uses the ADAM optimizer, EAD uses projected FISTA with a square-root decaying learning rate.

   PGD / I-FGM attacks

   • FGM: x = x₀ − ϵ · sign(∇ J(x₀, t)); I-FGM iteratively applies FGM with ε-ball clipping, and the authors note that it is essentially projected gradient descent on the negative loss.
   • Settings: 40 steps; I-FGM (no random start) step size ε/40 (citing Tramèr et al. 2017), PGD (with random start) step size 2ε/40; ε grid-searched from 0.1 to 1.0 in steps of 0.1.

   Evaluation method

   • Examples: 1000 random examples from the MNIST test set; in the targeted case, a target class different from the original class is randomly chosen for each image.
   • Metrics: ASR (attack success rate, %) and L1, L2, L∞ distortion, with distortion averaged over successful examples.
   • Visual comparison: EAD (β=0.01, κ=10, average L∞ of 0.8) is directly compared with PGD (ε=0.8) at similar average L∞ distortion by comparing the generated images (Figure 1; for the targeted case see Figure 3).

   Collapse this answer

4. 04What experiments did the paper conduct?

   On 1000 MNIST samples, EAD (κ=50) ensemble transfer targeted ASR is 98.5%, higher than PGD's 68.5%; when ε>0.3, adversarial training fails.

   Experimental setup

   • Model under test: Madry Defense Model (adversarially trained MNIST model); examples are generated with naturally trained undefended models of the same architecture, either a single model or an ensemble of 3 models.
   • Dataset: 1000 random examples from the MNIST test set; in the targeted case, a target class is randomly chosen.
   • Comparison methods: PGD, I-FGM, C&W (EAD β=0), EAD (β tuned; the main text reports β=0.01).
   • Metrics: ASR (%); L1, L2, L∞ distortion, averaged over successful examples.
   • Tuning: for EAD/C&W, κ ∈ {10, 30, 50, 70}; for EAD, β ∈ {1e-4, 1e-3, 1e-2}; for PGD/I-FGM, ε from 0.1 to 1.0 in steps of 0.1.
   • Number of repetitions: not reported in the paper.

   Main results

   Table 1 (transfer from the 3-model ensemble to the Madry Defense Model; PGD/I-FGM use the lowest ε that achieves the highest ASR):

   Swipe horizontally to read the table

   Method	Confidence κ	Targeted ASR	Targeted L1/L2/L∞	Non-targeted ASR	Non-targeted L1/L2/L∞
   PGD	None	68.5	188.3 / 8.947 / 0.6	99.9	270.5 / 13.27 / 0.8
   I-FGM	None	75.1	144.5 / 7.406 / 0.915	99.8	199.4 / 10.66 / 0.9
   C&W	50	92.9	117.45 / 8.041 / 0.987	99.1	78.65 / 5.598 / 0.937
   EAD	30	85.8	49.64 / 5.179 / 0.995	94.5	34.28 / 4.192 / 0.971
   EAD	50	98.5	93.46 / 7.711 / 1	99.6	57.68 / 5.839 / 0.999
   EAD	70	67.2	148.9 / 10.36 / 1	99.8	90.84 / 7.719 / 1

   (According to Table 1; C&W and EAD are reported for each row of κ ∈ {10,30,50,70}; some rows are omitted here.)

   • EAD outperforms C&W: the authors state that in both the targeted and non-targeted cases, EAD has a higher ASR than C&W at all κ; and in the targeted case at κ=50, EAD's average L2 distortion is lower than C&W's, which the authors call an unexpected result.
   • Targeted case: the authors state that at κ=30, EAD beats PGD and I-FGM with lower L1 and L2 distortion.
   • Non-targeted case: PGD and I-FGM achieve similar ASR at lower L∞ distortion; the authors argue that their greatly increased L1 and L2 distortion implies greater visual distortion and that the examples are "less adversarial".

   Visual comparison (Figures 1, 2, 3)

   • Figure 1 (non-targeted): EAD (β=0.01, κ=10, average L∞=0.8) compared with PGD (ε=0.8) at similar average L∞; the authors state that EAD examples have less visual distortion, and argue that this shows there is a problem with measuring visual distortion with L∞ alone.
   • Figure 2: PGD examples for ε from 0.1 to 1.0; the caption states that at ε≤0.3 the examples fail to transfer to the defense model. The authors state that at ε=0.3 the noise is already visually obvious, and that at high ε PGD appears to change "1" into "3", but the distortion is too large to be entirely certain.
   • Figure 3 (targeted): EAD (average L∞=0.876) compared with PGD (ε=0.8, 0.9); the authors state that targeted attacks require greater distortion, but the improvement in visual quality from elastic-net regularization remains clear.

   Adversarial retraining (Table 2)

   • Procedure: retrain the Madry model adversarially with a PGD adversary for ε from 0.1 to 1.0 (step 0.1), step size 2ε/40, 40 steps.
   • Results: at ε=0.3, Nat Test Accuracy 98.16% and Adv Test Accuracy 91.14%; at ε=0.4 both drop to 11.35%, at ε=0.7 to 10.28%, and for all other ε≥0.5 both are 11.35%.
   • The authors' interpretation: these results show that the Madry model cannot be successfully adversarially trained with a PGD adversary at ε>0.3; the authors consider this understandable because at such large ε the visual distortion is already clearly discernible.

   Other ablations and analyses

   • Single-model transfer (Table 3): EAD outperforms C&W at all κ; in the targeted case at κ=50, both EAD and C&W beat PGD/I-FGM with lower L1/L2 distortion; at κ≥50 EAD's average L2 distortion is lower than C&W's; in the non-targeted case, PGD/I-FGM have higher ASR (99.7/99.3) than EAD (highest 94.7 at κ=70).
   • β search (Tables 4, 5): β=0.01 (the largest β tested) gives the highest ASR in both cases; tuning β at the optimal κ has little effect on ASR, while increasing β at lower κ improves ASR more; the authors conclude from this that when generating transferable examples with low visual distortion, minimizing L1 is more important than L2 (or even L∞).
   • ε search (Figures 4, 5): the transfer ASR of PGD/I-FGM rises as ε increases; the authors state that compared with EAD their examples transfer less well, and when successful the perturbations are more visually discernible (at high ε the L1/L2 distortion increases greatly).

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically discuss limitations; the experiments cover only four attacks on MNIST and 1000 examples, and the authors state that the method can be generalized to color datasets.

   Limitations and future directions noted by the authors

   • The paper does not specifically discuss limitations (no Limitations/Discussion section).
   • Generalization to other datasets: The Experiment Setup section writes that if the goal of visually imperceptible attacks is achieved on MNIST, the method can be applied to more realistic color datasets such as CIFAR-10 and ImageNet—the paper did not run experiments on these datasets.
   • Suggested defense direction: In the Conclusion section, the authors suggest incorporating L1 or L2 into the analysis of adversarial example subspaces to complement L∞, for possible defenses such as adversarial training and adversarial example detection.

   Scope of experiments

   • Dataset: MNIST only (Experiment Setup explains MNIST was chosen because its grayscale simplicity makes generating visually imperceptible samples harder).
   • Defense tested: only the MNIST version of the Madry Defense Model; the undefended models used to generate samples share its architecture, and the ensemble size is fixed at 3.
   • Attack methods: four—PGD, I-FGM, C&W and EAD; sample size is 1000 random test samples.
   • Not reported in the paper: number of repeated experiments, statistical significance tests, human evaluation of visual distortion (visual comparison is based only on the examples shown in Figures 1–3).
   • Retraining experiments: cover only adversarial retraining against the PGD adversary with ε from 0.1 to 1.0 (Table 2).

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors relax the Madry competition's L∞ constraint, use EAD to generate transferable adversarial examples with low visual distortion, and question measuring distortion with L∞ alone.

   This is an attack paper: the authors attack the Madry Lab adversarially trained MNIST model (Madry Defense Model) and question the reasonableness of its competition constraining attacks only by L∞ (ε=0.3).

   • Problem: the authors argue that the L∞ constraint of ε=0.3 weakens attacks not optimized under L∞, is unrealistic for attackers, and that L∞ alone cannot characterize visual distortion.
   • Method: use EAD (elastic-net attack, combining L1 and L2 regularization) to generate adversarial examples on naturally trained models of the same architecture (a single model or an ensemble of 3 models), transfer them to the defense model after relaxing the L∞ constraint, and compare with PGD, I-FGM, and C&W; 1000 MNIST test examples, with metrics ASR and L1/L2/L∞ distortion.
   • Main results (Table 1, ensemble transfer): in the targeted case, EAD (β=0.01, κ=50) has ASR 98.5%, higher than PGD's 68.5% and I-FGM's 75.1%; in the non-targeted case, EAD (κ=50) has ASR 99.6% and PGD 99.9%, but PGD's L1/L2 distortion (270.5/13.27) is far higher than EAD's (57.68/5.839).
   • Retraining results (Table 2): at ε=0.3, adversarial training gives Adv Test Accuracy 91.14%; at ε≥0.4, Nat/Adv accuracy drops to about 11%, and the authors conclude from this that the model cannot be successfully adversarially trained with a PGD adversary at ε>0.3.
   • Visual comparison (Figures 1–3): the authors state that at similar average L∞ distortion, EAD examples have less visual distortion than PGD examples, and that PGD's noise is already obvious at ε=0.3.
   • The authors' conclusion: EAD outperforms PGD on targeted transfer and can generate transferable examples with much less visual distortion at similar L∞ distortion; the authors argue that this shows the flaw of measuring distortion with L∞ alone, and suggest introducing L1 or L2 into defenses such as adversarial training and adversarial example detection to supplement subspace analysis.

   Collapse this answer

Related papers