{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/distributionally-adversarial-attack","title":"Distributionally Adversarial Attack","arxiv_id":"1808.05537","date":"2018-08-16","proceeding":null,"authors":["Tianhang Zheng","Changyou Chen","Kui Ren"],"abstract":"Recent work on adversarial attack has shown that Projected Gradient Descent\n(PGD) Adversary is a universal first-order adversary, and the classifier\nadversarially trained by PGD is robust against a wide range of first-order\nattacks. It is worth noting that the original objective of an attack/defense\nmodel relies on a data distribution $p(\\mathbf{x})$, typically in the form of\nrisk maximization/minimization, e.g.,\n$\\max/\\min\\mathbb{E}_{p(\\mathbf(x))}\\mathcal{L}(\\mathbf{x})$ with\n$p(\\mathbf{x})$ some unknown data distribution and $\\mathcal{L}(\\cdot)$ a loss\nfunction. However, since PGD generates attack samples independently for each\ndata sample based on $\\mathcal{L}(\\cdot)$, the procedure does not necessarily\nlead to good generalization in terms of risk optimization. In this paper, we\nachieve the goal by proposing distributionally adversarial attack (DAA), a\nframework to solve an optimal {\\em adversarial-data distribution}, a perturbed\ndistribution that satisfies the $L_\\infty$ constraint but deviates from the\noriginal data distribution to increase the generalization risk maximally.\nAlgorithmically, DAA performs optimization on the space of potential data\ndistributions, which introduces direct dependency between all data points when\ngenerating adversarial samples. DAA is evaluated by attacking state-of-the-art\ndefense models, including the adversarially-trained models provided by {\\em MIT\nMadryLab}. Notably, DAA ranks {\\em the first place} on MadryLab's white-box\nleaderboards, reducing the accuracy of their secret MNIST model to $88.79\\%$\n(with $l_\\infty$ perturbations of $\\epsilon = 0.3$) and the accuracy of their\nsecret CIFAR model to $44.71\\%$ (with $l_\\infty$ perturbations of $\\epsilon =\n8.0$). Code for the experiments is released on\n\\url{https://github.com/tianzheng4/Distributionally-Adversarial-Attack}.","url_abs":"http://arxiv.org/abs/1808.05537v3","url_pdf":"http://arxiv.org/pdf/1808.05537v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"distributionally-adversarial-attack","repo_url":"https://github.com/tianzheng4/Distributionally-Adversarial-Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"distributionally-adversarial-attack","repo_url":"https://github.com/MadryLab/cifar10_challenge","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"distributionally-adversarial-attack","repo_url":"https://github.com/MadryLab/mnist_challenge","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"distributionally-adversarial-attack","repo_url":"https://github.com/shubhamuttam1/Pytorch-DAA","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1808.05537","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}