readerrubic / ewr-pgd Goto Github PK

We propose a new white box adversarial attack method named EWR-PGD which exceeds the state-of-the-art attacks performance. It is more efficient than the state-of-the-art ODI-PGD method.

Code will be available soon.

When reducing the models to the same accuracy, the number of restarts required by the EWR-PGD significantly less than that of the ODI-PGD. EWR-PGD is up to roughly 5 times faster than ODI-PGD.

Figure 1. On 10 state-of-the-art defense models, comparison of the number of restarts required(the lower the better) when the EWR-PGD and ODI-PGD methods reduce the models to the same accuracy.

The models are available online:

• TRADES-Small Cnn, TRADES-WRN
• MadryLab-WRN
• MART-ResNet18, MART-WRN
• FBTF-ResNet18
• pytorch ResNeXt101-DenoiseAll, ResNet152-Denoise, ResNet152-Baseline

EWR-PGD ranks first on the TRADES white-box MNIST and CIFAR-10 leaderboards, reducing the accuracy of their MNIST model to 92.52% and the accuracy of their CIFAR-10 model to 52.95%. EWR-PGD also ranks first on MardyLab’s White-box CIFAR-10 leaderboard, reducing the accuracy of their CIFAR-10 model to 43.96%.

Table 1. Accuracy(the lower the better) under EWR-PGD and SOTA attacks and corresponding complexity.

EWR-PGD ranks first among 1701 teams in CIKM2020 Analyticup: Alibaba-Tsinghua Adversarial Challenge on Object Detection. Surpassing the runner-up approach by∼14% in terms of scores.

Please contact [email protected] if you have any question.Enjoy!