EAD: Elastic-Net Attacks on Deep Neural Networks via Adversarial Examples

1. 01What problem does this paper attempt to solve?

   The authors propose EAD, an L1-oriented attack based on elastic-net regularization, filling the gap of the lack of rigorous study on L1 adversarial examples.

   Core question: how to generate L1-oriented adversarial examples—existing attack methods are based on L2 and L∞ distortion metrics, and the authors argue that L1 adversarial examples have not yet been rigorously explored.

   • Problem setting and importance: DNNs are easily misled by adversarial examples that are visually indistinguishable, which the authors state poses a threat to safety-critical applications such as traffic sign recognition and malware detection, and adversarial examples remain effective in the physical world.
   • Shortcomings of existing methods: the authors point out that mainstream attacks use the L∞ metric for maximum pixel change and L2 for improved visual quality, but although the L1 norm is widely used in image denoising and sparse recovery, methods for generating L1-based adversarial examples are few.
   • Core observation: L1 distortion characterizes the total variation of the perturbation and is a commonly used convex surrogate for L0 (the number of modified pixels, i.e., sparsity), making it suitable as a regularization term for adversarial examples.
   • Method proposed in the paper: the elastic-net attack EAD (elastic-net attacks to DNNs), which models the attack as an L1+L2 mixed regularized optimization problem, with the C&W L2 attack as a special case with β=0; the authors state that EAD outperforms or supplements existing methods in transfer attacks and adversarial training.
   • Threat model:
     • Goal: targeted attack—making the sample be misclassified as a specified target class; the paper states that targeted is harder than untargeted, so it focuses on the former, and the algorithm can be directly changed to untargeted.
     • Knowledge: white-box—EAD and C&W require the DNN to compute numerical gradients; FGM/I-FGM use the gradient of the training loss.
     • Capability: modifying all pixels of the input image (subject to the [0,1] box constraint); the transfer attack setting does not allow querying the target model, and samples are generated from an undefended network and then attack a defensively distilled network.
     • Victim systems: image classifiers based on deep convolutional networks (MNIST/CIFAR10 models, ImageNet's Inception-v3), including defensively distilled versions.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into two groups, attacks and defenses: attacks include FGM/I-FGM, C&W, JSMA, DeepFool and black-box attacks; defenses include distillation, adversarial training and detection.

   Gradient-based attack methods

   • FGM and I-FGM (Goodfellow et al. 2015; Kurakin et al. 2016b) — use the training loss gradient (or its sign) under L1/L2/L∞ metrics to generate adversarial samples in one step or iteratively; this paper uses the CleverHans implementation of them for comparison.
   • C&W attack (Carlini and Wagner 2017b) — designs an L2 regularized loss based on the logit layer; the paper states it is one of the strongest attacks, can break undefended and defensively distilled networks, and is the special case of this paper's EAD when β=0 and the main baseline.
   • JSMA (Papernot et al. 2016a) and DeepFool (Moosavi-Dezfooli et al. 2016) — the former is a greedy per-pixel attack based on the Jacobian saliency map, the latter is an untargeted L2 attack based on projection onto the nearest classification hyperplane; the paper only describes them and does not compare them experimentally.

   Black-box and transfer attacks

   • Papernot et al. 2017 use JSMA to train a substitute model for transfer attacks; there is also a black-box C&W attack based on zeroth-order optimization (ZOO); when queries are prohibited, ensemble methods can be used for transfer attacks (Liu et al. 2016). The paper only describes these black-box methods and does not implement them itself.

   Defense methods

   • Defensive distillation (Papernot et al. 2016b) — retrain the network using the class probabilities predicted by the original network, and introduce a temperature parameter T at the softmax layer; this is the target attacked in the paper's 4th group of experiments.
   • Adversarial training (Zheng et al. 2016; Madry et al. 2017; Tramèr et al. 2017 etc.) — augment the training set with adversarial samples or modify the training loss/structure; this paper conducts adversarial training experiments with C&W and EAD samples.
   • Detection methods (Feinman et al. 2017; Grosse et al. 2017; Lu et al. 2017; Xu et al. 2017) — use statistical tests to distinguish adversarial from normal samples; the paper cites the conclusion of Carlini and Wagner 2017a that 10 detection methods cannot detect the C&W attack; this paper does not evaluate detection defenses.

   Baselines and benchmarks: the comparison baselines are C&W, FGM-L1/L2/L∞, I-FGM-L1/L2/L∞ (all targeted), and the benchmarks are MNIST, CIFAR10, ImageNet.

   Positioning of this paper: the authors state that EAD generalizes C&W's L2 attack to an elastic-net form, can generate adversarial samples that are fundamentally different from existing methods with smaller L1 distortion, and provides a supplement in the L1 dimension for transfer attacks and adversarial training.

   Collapse this answer

3. 03How does the paper address this problem?

   EAD formulates the attack as an elastic-net (L1+L2) regularized optimization problem, solves it with ISTA/FISTA, and C&W is its special case with β=0.

   Overall approach: retain C&W's logit loss to ensure misclassification, then add an L1 penalty to encourage sparse perturbations, and solve with the EAD (elastic-net attacks to DNNs) algorithm with a shrinkage threshold step.

   Problem formulation

   • Given an original image x0 (label t0) and a target class t, the loss function is f(x,t)=max{max_{j≠ t}[Logit(x)]_j−[Logit(x)]_t, −κ}, where κ controls the margin between the target class and the next most likely class, and is also used as a transfer attack parameter.
   • The EAD optimization objective is minimize_x c· f(x,t)+β|x−x₀|₁+|x−x₀|₂², subject to x∈[0,1]^p; when β=0 it degenerates to the C&W attack.
   • The untargeted version replaces f with f(x)=max{[Logit(x)]_t0 − max_{j≠t0}[Logit(x)]_j, −κ}.

   Solution algorithm (ISTA/FISTA)

   • The authors found that C&W's change-of-variable (tanh transform) method is insensitive to β when β>0, and considered it unsuitable for subgradient optimization, so they switched to the iterative shrinkage-thresholding algorithm (ISTA).
   • Each iteration step is x(k+1)=Sβ(x(k)−αk·∇g(x(k))), where g(x)=c·f(x)+‖x−x0‖₂²; Sβ is the element-wise projected shrinkage threshold function: if the deviation is greater than β, shrink by β and project to [0,1]; if less than β, set directly back to the original pixel value.
   • The implementation uses FISTA acceleration (introducing a momentum term y(k)); the authors state that ISTA can be viewed as a robust version of the C&W method, and the appendix gives an optimality proof.

   Decision rules and parameters

   • During iteration, the model records a sample as successful when it classifies the target class as the highest probability; the final sample is selected from successful samples by one of two rules: minimum elastic-net loss (EN rule) or minimum L1 distortion (L1 rule).
   • Default hyperparameters: a 9-step binary search over c (starting at 0.001), with I=1000 iterations per step, initial learning rate α0=0.01 decaying by square root; unless otherwise specified, κ=0.
   • Subsequent experiments use β=10⁻³, because on MNIST and CIFAR10 this value reduces L1 distortion while L2 and L∞ distortion are comparable to β=0.

   Success determination and evaluation method

   • ASR (attack success rate): the percentage of adversarial samples classified as the target class; the average L1, L2, L∞ distortion of successful samples is also reported.
   • Each method reports three cases: best case (the attack with the smallest distortion among all wrong classes), average case (randomly select one wrong class), worst case (the attack with the largest distortion).

   Collapse this answer

4. 04What experiments did the paper conduct?

   On MNIST/CIFAR10/ImageNet, EAD achieves 100% average-case ASR with the smallest L1 distortion, and is superior to or complements C&W in transfer attacks and adversarial training.

   Experimental setup

   • Models tested: MNIST and CIFAR10 classifiers (trained with the DNN models provided by Carlini and Wagner), and Inception-v3 for ImageNet.
   • Datasets and sample sizes: for MNIST/CIFAR10, 1000 randomly selected correctly classified test images each are attacked toward one wrong class; for ImageNet, 100 correctly classified images are selected, each paired with 9 wrong classes.
   • Baselines: C&W (L2), FGM-L1/L2/L∞, I-FGM-L1/L2/L∞, all targeted attacks.
   • Metrics: ASR and the average L1/L2/L∞ distortion of successful samples, in best/average/worst cases.
   • Implementation details: EAD uses projected FISTA, C&W uses ADAM; FGM/I-FGM use CleverHans, ε is determined by fine-grained grid search (1000 candidates per image), I-FGM iterates 10 times; hardware is Intel E5-2690 v3, 40 GB memory, a single NVIDIA K80.
   • Number of repetitions: not reported in the paper.

   Main results

   Table 2 (average case, ASR in %, distortion is the mean over successful samples):

   Swipe horizontally to read the table

   Method	MNIST ASR / L1	CIFAR10 ASR / L1	ImageNet ASR / L1
   C&W (L2)	100 / 22.46	100 / 13.62	100 / 232.2
   FGM-L1	39 / 53.5	48.8 / 51.97	1 / 61
   I-FGM-L1	100 / 32.94	100 / 17.53	77 / 526.4
   I-FGM-L2	100 / 30.32	100 / 17.12	100 / 774.1
   I-FGM-L∞	100 / 71.39	100 / 33.3	100 / 864.2
   EAD (EN rule)	100 / 17.4	100 / 8.18	100 / 69.47
   EAD (L1 rule)	100 / 14.11	100 / 6.066	100 / 40.9

   (The two rows FGM-L2 and FGM-L∞ are omitted; their average-case ASR on the three datasets is 34.6–52.3% and 1–3%, according to Table 2.)

   • The authors state that EAD, C&W, and I-FGM-L∞ achieve the smallest L1, L2, and L∞ distortion, respectively; compared with I-FGM-L1, the L1 distortion of EAD(EN) decreases by about 47% on MNIST, about 53% on CIFAR10, and about 87% on ImageNet.
   • The authors point out that EAD(L1 rule) has smaller L1 distortion but larger L2 and L∞ distortion, while still maintaining 100% ASR, which they consider to show that evaluating robustness using only L2 and L∞ metrics is insufficient.
   • The average-case ASR of the FGM variants is low (1%–52.3%), and the authors state that their distortion is also larger than that of other methods.

   Comparison of solving methods (COV vs EAD)

   • What was tested: on MNIST (Table 1) and CIFAR10 (Table 5), the tanh change-of-variable and EAD were compared for solving the elastic-net objective, with β from 0 to 10⁻².
   • Results: the ASR of the two is similar (mostly 100%), but COV's distortion is insensitive to β (e.g., the average-case L1 on MNIST stays at 22.27–23.11), while EAD's L1 decreases as β increases (on MNIST average case from 22.63 to 13.56).
   • Authors' interpretation: COV is not suitable for elastic-net optimization because it is inefficient for subgradient optimization; they also observe a trade-off in which smaller L1 is accompanied by larger L2 and L∞.

   Breaking defensive distillation and transfer attacks

   • Defensive distillation: on MNIST and CIFAR10, with temperature T from 1 to 100, the average-case ASR of EAD and C&W is 100% or close (Figure 3, Tables 11–12); the authors state that EAD, like C&W, can break defensive distillation.
   • Transfer attacks: on MNIST, transfer from an undefended network to a defensively distilled network (T=100). EAD(EN) has the highest average ASR at 98.6% (κ=50), EAD(L1) at 98.1% (κ=50), and C&W at most 87.4% (κ=40); the worst-case gap is larger: EAD(EN) 87%, C&W 30.5% (Table 13).
   • Authors' interpretation: L1 adversarial examples transfer better; when κ is too large, the ASR of both falls back (e.g., at κ=60, EAD(EN) averages 90% and C&W 67.9%), and the authors believe the optimizer struggles to minimize the loss at large κ; I-FGM has no κ parameter, and its average ASR is below 2%.

   Adversarial training

   • What was tested: on MNIST, 9000 adversarial examples are generated using all wrong classes of 1000 training images (C&W or EAD(L1 rule)), used separately or jointly to augment the training set for retraining, and then attack difficulty is measured (Table 3, Table 14).
   • Results: after adversarial training with either single method, ASR remains 100%, but distortion increases, e.g., the average L1 of the C&W attack rises from 22.46 to 24.97–27.32; joint EAD+C&W training gives the highest L1/L2 distortion against the C&W attack (27.32/2.513).
   • Authors' interpretation: L1 samples can supplement adversarial training; the appendix states that all adversarially trained models still have at least 99% test accuracy on MNIST.

   Other ablations and analyses

   • Decision rules (Figure 2, Tables 6–7): at the same β, the L1 rule has smaller L1 and larger L2/L∞ than the EN rule; on CIFAR10, L1 distortion does not decrease monotonically with β, and instead increases at β=5·10⁻².
   • β sensitivity (Table 1): as β increases from 0 to 10⁻², the average L1 on MNIST decreases from 22.63 to 13.56, and L∞ increases from 0.512 to 0.852.
   • Visualization (Figures 6–8): the authors state that on CIFAR10 and ImageNet the samples of each method are visually indistinguishable, and on MNIST the I-FGM samples are blurrier than EAD and C&W.

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically discuss limitations; the experiments cover three image datasets, white-box attacks, defensive distillation, and transfer and adversarial training on MNIST.

   Limitations and future directions noted by the authors

   • The paper does not specifically discuss limitations and has no Limitations or Future Work section.
   • In the Conclusion, the authors state that the results "provide a new perspective on adversarial learning and the security implications of DNNs using L1 adversarial examples," which can be regarded as a directional statement, but no specific future work is listed.

   Scope of experiments

   • The models tested are the MNIST DNN, the CIFAR10 DNN (both architectures provided by Carlini and Wagner), and ImageNet's Inception-v3, 3 classifiers in total.
   • The attack setting is a white-box targeted attack; for untargeted, only the loss function modification is given, and no experiments are reported.
   • Defense evaluation includes defensive distillation (MNIST/CIFAR10, T=1–100) and adversarial training (MNIST only); detection-based defenses are only cited in related work and not evaluated.
   • Transfer attacks are evaluated only on MNIST (undefended → defensive distillation, T=100); sample sizes are 1000 images each for MNIST/CIFAR10 and 100 images for ImageNet; the paper does not report the number of repetitions or statistical significance tests.
   • Black-box attacks (substitute models, ZOO, ensemble methods) are only described in Related Work and were not run by the paper itself; the authors state that the EAD code has been released.

   Collapse this answer

6. 06Summarize the main content of the paper

   EAD uses elastic-net regularization to unify and generalize the C&W attack, generating adversarial examples with smaller L1 distortion and improving transfer attacks and adversarial training.

   A paper on an adversarial example attack method: it models attacking a DNN as an elastic-net (L1+L2) regularized optimization problem and proposes the EAD algorithm, of which the C&W L2 attack is a special case with β=0.

   • Problem to solve: Existing attacks are based on L2/L∞ metrics, and the authors argue that adversarial examples guided by L1 (which characterizes total variation and promotes sparsity) lack rigorous study.
   • Method highlights: It follows C&W's logit loss, adds an L1 penalty, and solves with ISTA/FISTA (a shrinkage-thresholding step replaces C&W's tanh transform); the final example is selected by the EN or L1 decision rule; by default, 9-step binary search over c, 1000 iterations per step, β=10⁻³.
   • Main results: On MNIST/CIFAR10/ImageNet, the average-case ASR is 100% in all cases, and L1 distortion is the smallest (e.g., on ImageNet, EAD(EN) is 69.47, I-FGM-L1 is 526.4, C&W is 232.2, Table 2).
   • Transfer attacks: On MNIST, undefended→defensive distillation, EAD(EN) has the highest average ASR of 98.6% (κ=50), and C&W is 87.4% (κ=40) (Table 13).
   • Defense-related: EAD and C&W both break defensive distillation at T=1–100; adversarial training jointly with EAD and C&W examples can increase the distortion cost of subsequent attacks, and the authors state that L1 examples supplement adversarial training.
   • Authors' conclusion: The authors state that EAD generates a set of adversarial examples fundamentally different from L2/L∞ methods, and argue that robustness evaluation should incorporate the L1 metric, and that L1 examples can supplement L2/L∞ to improve the adversarial machine learning framework.

   Collapse this answer

Related papers