[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119969-en":3,"doc-seo-119969-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119969,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","Improving Fast Minimum-Norm Attacks with Hyperparameter Optimization","Evaluating adversarial robustness of machine-learning models with gradient-based attacks is difficult because attack performance depends strongly on the chosen loss, optimization algorithm, and step-size scheduling. This work introduces HO-FMN, showing that hyperparameter optimization can enhance fast minimum-norm attacks by automatically selecting the loss function, optimizer, and step-size scheduler together with their hyperparameters. Extensive evaluation across multiple robust models demonstrates improved attack efficacy compared to baseline approaches, and the authors provide open-source code.","arXiv :2310 .08177v1 [ cs .LG] 12 Oct 2023  \nImproving Fast Minimum-Norm Attacks with Hyperparameter Optimization  \nGiuseppe Floris 1∗ , Raffaele Mura 1∗ , Luca Scionis 1∗ , Giorgio Piras 1 ,2 , Maura Pintor 1 , Ambra Demontis 1 and Battista Biggio 1  \n1-University of Cagliari-Department of Electrical and Electronic Engineering 2-Sapienza University of Rome-Department of Computer Engineering  \nAbstract. Evaluating the adversarial robustness of machine-learning models using gradient-based attacks is challenging. In this work, we show that hyperparameter optimization can improve fast minimum-norm attacks by automating the selection of the loss function, the optimizer, and the step-size scheduler, along with the corresponding hyperparameters. Our extensive evaluation involving several robust models demonstrates the improved efficacy of fast minimum-norm attacks when hypedup with hyperparameter optimization. We release our open-source code at [https://github.com/pralab/HO-FMN](https://github.com/pralab/HO-FMN).  \n1 Introduction  \nMachine learning (ML) models are susceptible to adversarial attacks [1, 13], i.e., input samples carefully perturbed to mislead the model. To evaluate adversarial robustness, many different gradient-based attacks have been proposed, whose performance is significantly affected by the choice of the loss function to optimize, the optimization algorithm, and the step-size scheduler. From a practical perspective, attacks tend to be run with a “default” configuration and set of hyperparameters that are deemed to fit most of the cases. Yet, the attack effectiveness is highly case-dependent, implying that the choice of the configuration needs to be carefully tailored to the model rather than a de-facto standard choice. In AutoAttack (AA) [4], the authors try to overcome this limitation by proposing an ensemble of parameter-free attacks, each including an internal auto-tuning process for each relevant hyperparameter. With Adaptive AutoAttack (AAA) [16], the approach is configured to run the parameter-free AA to look for a fast and good evaluation or alternatively come forward with an extensive search on a pool of attacks.  \nIn this paper, we aim to use a smart and effective search for the best configuration that adapts the attack to the model. Hence, we propose a systematic framework for configuring the state-of-the-art, fast minimum-norm (FMN) attacks properly instead of running extensive searches on multiple attacks. To this end, we develop our framework by rethinking the choice of the loss function, optimizer, and step-size scheduler as attack hyperparameters and then using a unified hyperparameter optimization procedure.  \n* These authors contributed equally to this work  \n\n| Algorithm 1: Fast Minimum-norm (FMN) Attack |\n| --- |\n| Input : x, the input sample; y, the target (true) class label; α0 , the initial δ-step size; K, the total number of iterations; L, the loss of the attack; h, the step size scheduler; u, the update function for the gradient.\u003Cbr>Output: The minimum-norm adversarial example x⋆ .\u003Cbr>1 x0 ← x, ϵ0 = 0 , δ0 ← 0 , δ⋆ ← ∞ , γ0 = 0 .05 ▷ initialization\u003Cbr>2 for k = 1 ,..., K do\u003Cbr>3 g ← ∇δ L (x + δk−1, y,θ) ▷ loss gradient\u003Cbr>4 γk ← hγ (γ0 , k, K) ▷ ϵ-step size decay\u003Cbr>5 ϵk = uϵ (ϵk−1,γk , ∥δ∥p) ▷ ϵ-step\u003Cbr>6 αk ← h(α0 , k, K) ▷ scheduler step\u003Cbr>7 δ k ← u (δk−1 , g/∥g∥2 ,αk) ▷ optimizer step\u003Cbr>8   δ k ← Π(x0 , δ k) ▷ projection onto the feasible domain\u003Cbr>9 return x⋆ ← x0 + best(δ0 ,...δ K ) ▷ return best solution |\n\n2 FMN Attacks with Hyperparameter Optimization  \nWe introduce here a modified FMN attack algorithm, referred to as HO-FMN, in which the loss function, the optimizer, and the step-size scheduler, along with their hyperparameters, are all exposed to be optimized. We then provide details on the hyperparameter optimizer considered in this work.  \nFMN Attacks. FMN [10] aims to find minimum-norm adversarial perturbations. The objective of the attack is to find, for a model with decis","cbCaivqMXqi2EhAm","https://ap.wps.com/l/cbCaivqMXqi2EhAm","pdf",454175,1,6,"English","en",105,"# Introduction\n## FMN Attacks with Hyperparameter Optimization\n## Experiments","[{\"question\":\"Why are fast minimum-norm attacks sensitive to hyperparameters?\",\"answer\":\"Attack effectiveness depends on the loss function, the optimization algorithm, and the step-size scheduler. Using default configurations can fail to adapt to the specific model and case.\"},{\"question\":\"What does HO-FMN optimize in fast minimum-norm attacks?\",\"answer\":\"HO-FMN exposes the loss function, optimizer, and step-size scheduler—along with their hyperparameters—so hyperparameter optimization can select the best combination for the given model.\"},{\"question\":\"Which loss functions and training components are considered for tuning?\",\"answer\":\"The tuning includes choosing between logit loss and cross-entropy loss, selecting optimizers, and choosing step-size scheduler strategies and related hyperparameters.\"}]","Improving Fast Minimum-Norm Attacks with Hyperparameter Optimization | PDF",1785727316,15,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"improving-fast-minimum-norm-attacks-with-hyperparameter-optimization","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/improving-fast-minimum-norm-attacks-with-hyperparameter-optimization/119969/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are fast minimum-norm attacks sensitive to hyperparameters?","Question",{"text":75,"@type":76},"Attack effectiveness depends on the loss function, the optimization algorithm, and the step-size scheduler. Using default configurations can fail to adapt to the specific model and case.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What does HO-FMN optimize in fast minimum-norm attacks?",{"text":80,"@type":76},"HO-FMN exposes the loss function, optimizer, and step-size scheduler—along with their hyperparameters—so hyperparameter optimization can select the best combination for the given model.",{"name":82,"@type":73,"acceptedAnswer":83},"Which loss functions and training components are considered for tuning?",{"text":84,"@type":76},"The tuning includes choosing between logit loss and cross-entropy loss, selecting optimizers, and choosing step-size scheduler strategies and related hyperparameters.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":111,"show_sort_weight":112,"slug":113},"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]