Adaptive Attacks

Adaptive Attacks are adversarial attacks specifically designed to overcome a particular defense mechanism — tailoring the attack strategy to exploit the defense's specific weaknesses, as opposed to using a generic off-the-shelf attack.

Designing Adaptive Attacks

• Understand Defense: Analyze exactly how the defense modifies gradients, inputs, or model behavior.
• Circumvent: Design the attack to work around the defense mechanism (e.g., bypass gradient masking, defeat input transformations).
• EOT: Use Expectation Over Transformation for stochastic defenses — average gradients over random defense operations.
• Surrogate Loss: If the defense breaks gradient flow, design a differentiable surrogate loss.

Why It Matters

• Defense Evaluation: Many published defenses are broken by adaptive attacks — "the defense is only as strong as its evaluation."
• Trappola et al.: Carlini et al. (2019) systematically broke 9 of 13 ICLR defenses using adaptive attacks.
• Best Practice: All defense papers should evaluate against adaptive attacks, not just standard benchmarks.

Adaptive Attacks are custom-crafted attack strategies — tailored to specific defenses to provide honest evaluation of robustness claims.