HO-FMN: Hyperparameter optimization for fast minimum-norm attacks

Mura, Raffaele

Co-prime

;Floris, Giuseppe

Co-prime

;Scionis, Luca

Co-prime

;Piras, Giorgio;Pintor, Maura

;Demontis, Ambra;Giacinto, Giorgio;Biggio, Battista

Penultimate

;Roli, Fabio

Last

2025-01-01

---

Abstract

Gradient-based attacks are a primary tool to evaluate robustness of machine-learning models. However, many attacks tend to provide overly-optimistic evaluations as they use fixed loss functions, optimizers, step-size schedulers, and default hyperparameters. In this work, we tackle these limitations by proposing a parametric variation of the well-known fast minimum-norm attack algorithm, whose loss, optimizer, step-size scheduler, and hyperparameters can be dynamically adjusted. We re-evaluate 12 robust models, showing that our attack finds smaller adversarial perturbations without requiring any additional tuning. This also enables reporting adversarial robustness as a function of the perturbation budget, providing a more complete evaluation than that offered by fixed-budget attacks, while remaining efficient. We release our open-source code at https://github.com/pralab/HO-FMN.