Colliding with Adversaries at ECML-PKDD 2025 Adversarial Attack Competition 1st Prize Solution
Dimitris Stefanopoulos, Andreas Voskou
TL;DR
The paper presents a winning white-box adversarial attack against a TopoDNN-based binary classifier for simulated high-energy physics jet data, aiming to maximize misclassification while minimizing perturbations. It employs a multi-round gradient-based strategy with random initializations and sample-mixing to guide perturbations, formalized by a piecewise loss that first prioritizes flipping predictions and then minimizes the perturbation size. The approach achieves state-of-the-art performance (S ≈ 0.98), with a fooling ratio reaching 100% after several rounds and perturbations shrinking to near 0.0012 in L1 distance, though at the cost of substantial computation and GPU requirements. These results highlight both the vulnerability of differentiable models in this domain and the potential for rapid, high-impact adversarial strategies, while suggesting avenues for improvement such as adaptive optimizers and more targeted initialization schemes.
Abstract
This report presents the winning solution for Task 1 of Colliding with Adversaries: A Challenge on Robust Learning in High Energy Physics Discovery at ECML-PKDD 2025. The task required designing an adversarial attack against a provided classification model that maximizes misclassification while minimizing perturbations. Our approach employs a multi-round gradient-based strategy that leverages the differentiable structure of the model, augmented with random initialization and sample-mixing techniques to enhance effectiveness. The resulting attack achieved the best results in perturbation size and fooling success rate, securing first place in the competition.