Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples

Abdullah Al Nomaan Nafi, Habibur Rahaman, Zafaryab Haider, Tanzim Mahfuz, Fnu Suya, Swarup Bhunia, Prabuddha Chakraborty

TL;DR

DASH introduces a differentiable, meta-attack framework that learns to combine multiple LP-constrained base attacks through soft-attention across multiple stages to produce adversarial examples with high attack success and perceptual fidelity. By optimizing a meta-loss that balances misclassification and perceptual similarity, it generalizes across robust defenses and transfers well in black-box settings. Empirical results on CIFAR-10/100 and ImageNet show substantial gains over state-of-the-art perceptual attacks, with strong transferability and resilience under post-processing defenses. The framework provides a flexible, automated approach to evaluate robustness without handcrafted adaptive attacks for each defense, opening paths for broader applications and extensions to multimodal tasks.

Abstract

Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only recently have a few methods begun specifically exploring perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively leveraged to improve perceptual efficacy. In this paper, we introduce DAASH, a fully differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods. DAASH operates in a multi-stage fashion: at each stage, it aggregates candidate adversarial examples from multiple base attacks using learned, adaptive weights and propagates the result to the next stage. A novel meta-loss function guides this process by jointly minimizing misclassification loss and perceptual distortion, enabling the framework to dynamically modulate the contribution of each base attack throughout the stages. We evaluate DAASH on adversarially trained models across CIFAR-10, CIFAR-100, and ImageNet. Despite relying solely on Lp-constrained based methods, DAASH significantly outperforms state-of-the-art perceptual attacks such as AdvAD -- achieving higher attack success rates (e.g., 20.63\% improvement) and superior visual quality, as measured by SSIM, LPIPS, and FID (improvements $\approx$ of 11, 0.015, and 5.7, respectively). Furthermore, DAASH generalizes well to unseen defenses, making it a practical and strong baseline for evaluating robustness without requiring handcrafted adaptive attacks for each new defense.

DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples

TL;DR

DASH introduces a differentiable, meta-attack framework that learns to combine multiple LP-constrained base attacks through soft-attention across multiple stages to produce adversarial examples with high attack success and perceptual fidelity. By optimizing a meta-loss that balances misclassification and perceptual similarity, it generalizes across robust defenses and transfers well in black-box settings. Empirical results on CIFAR-10/100 and ImageNet show substantial gains over state-of-the-art perceptual attacks, with strong transferability and resilience under post-processing defenses. The framework provides a flexible, automated approach to evaluate robustness without handcrafted adaptive attacks for each defense, opening paths for broader applications and extensions to multimodal tasks.

Abstract

Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only recently have a few methods begun specifically exploring perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively leveraged to improve perceptual efficacy. In this paper, we introduce DAASH, a fully differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods. DAASH operates in a multi-stage fashion: at each stage, it aggregates candidate adversarial examples from multiple base attacks using learned, adaptive weights and propagates the result to the next stage. A novel meta-loss function guides this process by jointly minimizing misclassification loss and perceptual distortion, enabling the framework to dynamically modulate the contribution of each base attack throughout the stages. We evaluate DAASH on adversarially trained models across CIFAR-10, CIFAR-100, and ImageNet. Despite relying solely on Lp-constrained based methods, DAASH significantly outperforms state-of-the-art perceptual attacks such as AdvAD -- achieving higher attack success rates (e.g., 20.63\% improvement) and superior visual quality, as measured by SSIM, LPIPS, and FID (improvements of 11, 0.015, and 5.7, respectively). Furthermore, DAASH generalizes well to unseen defenses, making it a practical and strong baseline for evaluating robustness without requiring handcrafted adaptive attacks for each new defense.

Paper Structure

This paper contains 30 sections, 9 equations, 5 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Threat Model
  3. Related Work
  4. DASH Attack Design
  5. Design motivation
  6. Design Details
  7. Experiments and Results
  8. Experimental Setup
  9. Datasets and Robust Models
  10. Post-Processing Defenses
  11. Evaluation Metrics
  12. Base Attacks and DASH Training Details
  13. Effectiveness of DASH against Robust Models
  14. Effectiveness of DASH on Black-Box Settings
  15. Ablation Studies on DASH
  16. ...and 15 more sections

Figures (5)

  • Figure 1: Comparative visualization of adversarial perturbations across multiple attack methods (including DASH).
  • Figure 2: An overview of the proposed Differentiable Attack Search (DASH) methodology.
  • Figure 3: Comparison of DASH performance before and after training, illustrating ASR and SSIM across different defense settings. "Trained DASH" significantly outperforms the randomly weighted version ("Random DASH").
  • Figure 4: DASH training progression over epochs.
  • Figure 5: Learned DASH weights (represented as % of contribution) for different base attacks across stages.