通过检测循环提前终止PGD，加速对抗攻击同时不损失准确性。
Stop Walking in Circles! Bailing Out Early in Projected Gradient Descent
- 基于实际实现中的几何特性检测循环，动态提前终止
- 速度提升显著，仍能获得与标准PGD完全一致的鲁棒性评估结果
- 适合需要高效评估模型抗扰动能力的研究者
投影梯度下降（PGD）在$L_\infty$球约束下已成为计算机视觉中对抗鲁棒性评估的主流方法，因其可靠性和有效性，成为简单易实现的迭代基线。然而，应用PGD计算成本高昂，尤其当使用数千次迭代生成单张图像的对抗样本时，已成为当前最佳实践。本文提出一种基于循环检测的简单新方法，用于早期终止PGD，利用其在实践中实现的几何特性，证明该方法可在不牺牲任何攻击强度的前提下，显著加快计算速度，实现与标准PGD完全相同的模型鲁棒性估计。该方法大幅加速了PGD，使此前因计算量过大而不可行的鲁棒性评估成为可能。
原文摘要 · Abstract (English)
Projected Gradient Descent (PGD) under the $L_\infty$ ball has become one of the defacto methods used in adversarial robustness evaluation for computer vision (CV) due to its reliability and efficacy, making a strong and easy-to-implement iterative baseline. However, PGD is computationally demanding to apply, especially when using thousands of iterations is the current best-practice recommendation to generate an adversarial example for a single image. In this work, we introduce a simple novel method for early termination of PGD based on cycle detection by exploiting the geometry of how PGD is implemented in practice and show that it can produce large speedup factors while providing the \emph{exact} same estimate of model robustness as standard PGD. This method substantially speeds up PGD without sacrificing any attack strength, enabling evaluations of robustness that were previously computationally intractable.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。