SDM: A Powerful Tool for Evaluating Model Robustness
This work addresses the limitation of existing gradient-based adversarial attacks, which often generate high-loss non-adversarial samples due to poorly designed objective functions. To overcome this issue, the authors propose Sequential Difference Maximization (SDM), a novel approach that reformulates the attack objective as maximizing the gap between an upper bound on the probabilities of non-target classes and the probability of the true class. SDM introduces a three-level optimization framework—comprising cycles, phases, and steps—that progressively combines Negative Probability Loss and Directional Probability Difference Ratio (DPDR) loss to iteratively approximate optimal adversarial perturbations. Experimental results demonstrate that SDM significantly outperforms state-of-the-art methods in both attack success rate and cost efficiency.