Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks

2025-12-11

AI Summary

Existing projection-based white-box adversarial attacks (e.g., PGD) suffer from high computational overhead and slow convergence when evaluating neural network robustness under ℓₚ-norm constraints. Method: This paper proposes an efficient white-box adversarial attack based on an improved Frank–Wolfe (FW) algorithm, the first systematic exploration of FW for ℓₚ-constrained adversarial example generation. It eliminates explicit projection by introducing a gradient-driven feasible direction update strategy, leveraging full gradient access in a white-box setting. The method is validated across logistic regression, CNNs, and Vision Transformers. Results: Experiments on MNIST and CIFAR-10 demonstrate superior attack success rates and faster convergence (fewer iterations) than PGD under identical perturbation budgets. Moreover, the generated adversarial examples exhibit significantly stronger cross-model transferability. This work establishes a projection-free, computationally efficient paradigm for adversarial robustness evaluation.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

The construction of adversarial attacks for neural networks appears to be a crucial challenge for their deployment in various services. To estimate the adversarial robustness of a neural network, a fast and efficient approach is needed to construct adversarial attacks. Since the formalization of adversarial attack construction involves solving a specific optimization problem, we consider the problem of constructing an efficient and effective adversarial attack from a numerical optimization perspective. Specifically, we suggest utilizing advanced projection-free methods, known as modified Frank-Wolfe methods, to construct white-box adversarial attacks on the given input data. We perform a theoretical and numerical evaluation of these methods and compare them with standard approaches based on projection operations or geometrical intuition. Numerical experiments are performed on the MNIST and CIFAR-10 datasets, utilizing a multiclass logistic regression model, the convolutional neural networks (CNNs), and the Vision Transformer (ViT).

Problem

• Evaluates Frank-Wolfe methods for efficient white-box adversarial attack construction
• Compares projection-free optimization with standard adversarial attack approaches
• Tests methods on neural networks using MNIST and CIFAR-10 datasets

Innovation

• Modified Frank-Wolfe methods for adversarial attacks
• Projection-free optimization for white-box attack construction
• Theoretical and numerical evaluation on neural networks