Abstract:Imperceptible adversarial attacks have recently attracted increasing research interests. Existing methods typically incorporate external modules or loss terms other than a simple $l_p$-norm into the attack process to achieve imperceptibility, while we argue that such additional designs may not be necessary. In this paper, we rethink the essence of imperceptible attacks and propose two simple yet effective strategies to unleash the potential of PGD, the common and classical attack, for imperceptibility from an optimization perspective. Specifically, the Dynamic Step Size is introduced to find the optimal solution with minimal attack cost towards the decision boundary of the attacked model, and the Adaptive Early Stop strategy is adopted to reduce the redundant strength of adversarial perturbations to the minimum level. The proposed PGD-Imperceptible (PGD-Imp) attack achieves state-of-the-art results in imperceptible adversarial attacks for both untargeted and targeted scenarios. When performing untargeted attacks against ResNet-50, PGD-Imp attains 100$\%$ (+0.3$\%$) ASR, 0.89 (-1.76) $l_2$ distance, and 52.93 (+9.2) PSNR with 57s (-371s) running time, significantly outperforming existing methods.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: How to optimize the classic PGD attack method to achieve imperceptible adversarial attacks without relying on additional complex designs. Specifically, the author believes that existing methods usually enhance the imperceptibility of attacks by introducing perception - related modules or loss terms, but these additional designs may not be necessary. The author proposes that if an attack method can successfully push an image across the decision boundary of the attacked model with the minimum perturbation intensity, then the attack is essentially imperceptible. ### Core problems of the paper 1. **Rethinking the essence of imperceptible attacks**: - The author believes that the key to imperceptible attacks lies in pushing the image across the model's decision boundary at the minimum cost, rather than relying on additional constraints or modules. 2. **Releasing the potential of classic PGD**: - Through two simple and effective strategies - Dynamic Step Size and Adaptive Early Stop, the author aims to optimize the classic PGD attack method so that it can perform well in imperceptible attacks. ### Specific problems and solutions - **Dynamic Step Size**: - The dynamic step - size strategy makes the optimization process more refined by allocating different parts of the total budget in each iteration, so as to find the optimal solution and reach the decision boundary at a lower cost. - The mathematical expression is: \[ \sum_{t = 1}^{T}\alpha_t=\sum_{t = 1}^{T}\eta_t\cdot\beta=\epsilon \] where $\alpha_t = \eta_t\cdot\beta$, $\eta_{1:T}\in(0, 1]^T$ is a predefined coefficient sequence, and $\beta$ is a fixed scale factor. - **Adaptive Early Stop**: - The adaptive early - stop strategy evaluates whether the current result has successfully attacked the classifier in the later iterations. Once successful, the optimization is stopped immediately to minimize the redundant perturbation intensity. - This strategy not only reduces the computational complexity but also improves the robustness of the attack and reduces the sensitivity to the hyperparameters $\epsilon$ and $T$. ### Experimental results - **Untargeted Attacks**: - PGD - Imp achieves a 100% attack success rate (ASR) on ResNet - 50, while the l2 distance is only 0.89 and the PSNR reaches 52.93, which is significantly better than existing methods. - **Targeted Attacks**: - PGD - Imp also performs well in targeted attacks against ResNet - 50, achieving a 100% ASR, with l∞ only 0.01, l2 distance of 1.42, and better image quality. ### Conclusion By rethinking the essence of imperceptible attacks and introducing the dynamic step - size and adaptive early - stop strategies, PGD - Imp successfully achieves efficient and imperceptible adversarial attacks without relying on additional complex designs. This not only improves the attack performance but also simplifies the design of the attack method.

PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks

Is PGD-Adversarial Training Necessary? Alternative Training via a Soft-Quantization Network with Noisy-Natural Samples Only

SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustness

Rethinking PGD Attack: Is Sign Function Necessary?

Low-Rank Adversarial PGD Attack

Perception-Driven Imperceptible Adversarial Attack Against Decision-Based Black-Box Models

PG-Attack: A Precision-Guided Adversarial Attack Framework Against Vision Foundation Models for Autonomous Driving

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Attacking Large Language Models with Projected Gradient Descent

Enhancing Adversarial Text Attacks on BERT Models with Projected Gradient Descent

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

PGN: A perturbation generation network against deep reinforcement learning

PPD: Permutation Phase Defense Against Adversarial Examples in Deep Learning

Efficient Two-Step Adversarial Defense for Deep Neural Networks

Perception Improvement for Free: Exploring Imperceptible Black-box Adversarial Attacks on Image Classification

Towards Rapid and Robust Adversarial Training with One-Step Attacks

Attention Masks Help Adversarial Attacks to Bypass Safety Detectors

You Only Propagate Once: Painless Adversarial Training Using Maximal Principle

Guidance Through Surrogate: Towards a Generic Diagnostic Attack

Scale-Invariant Adversarial Attack for Evaluating and Enhancing Adversarial Defenses

Improving Query Efficiency of Black-Box Attacks via the Preference of Deep Learning Models