AutoAttack

Description

AutoAttack is a fixed suite of four automated adversarial attacks, introduced by Croce and Hein (ICML 2020), that measures how much of an image classifier's test accuracy survives small, deliberately chosen changes to its input images at inference time. The evaluator states the threat model, a norm and radius that bound the change (for example, no pixel value changed by more than 8/255 under the L-infinity norm), and the standard version then attacks each correctly classified test image in turn with APGD-CE (projected gradient descent that sets its own step size, on the cross-entropy loss), a targeted APGD on the authors' Difference of Logits Ratio loss, a targeted form of the FAB minimum-norm attack, and the Square Attack, which needs only the model's outputs and so still works when gradients are uninformative. An image counts as robust only if none of the four finds a misclassified version within the bound, and because every attack setting is fixed in advance the evaluator tunes nothing, which removes a common cause of overstated robustness: an attack too weakly tuned for the model. The output is robust accuracy, the share of test images still classified correctly under attack at the stated norm and radius, reported beside clean accuracy; published models are compared on the RobustBench leaderboard, which uses AutoAttack as its standard evaluation. Because AutoAttack is not built around any one defence, it can supply the attack step for a wider judgement of a defence, such as whether adversarial training holds up against attacks it was not trained on; unlike red teaming, it involves no human attacker or open-ended search.

Example Use Cases

Security

A bank's model-risk team validating a vendor's classifier that recognises which of 40 identity-document types a customer has photographed during remote account opening, so the right authenticity checks run, receives the model weights under the review agreement. It reruns the vendor's robustness evaluation with standard AutoAttack at the same L-infinity radius, compares the two robust accuracies and records any automatic warnings before accepting the vendor's figure.

A photo-sharing platform's trust-and-safety team expects uploaders to perturb images to slip past the classifier that sorts uploads into a dozen prohibited-content categories and an allowed class. Choosing between two candidate models, it runs standard AutoAttack on both at a perturbation budget agreed with its security team, and selects the one with higher robust accuracy whose clean-accuracy cost is acceptable, recording both figures in the release review.

A research group proposing a new defence for a traffic-sign classifier runs standard AutoAttack before publication and finds that the Square Attack lowers robust accuracy further than the gradient-based attacks, one of AutoAttack's warning signs that gradients are masked. It treats its figure as an upper bound and has an attack designed for its defence built before claiming any robustness.

A computational-pathology group comparing a convolutional network and a vision transformer for three-way tumour subtyping on routine slide images attacks both with AutoAttack, its settings reduced for three classes, at several perturbation sizes below what a blinded clinical reader could detect, and compares attack success rates on an external patient cohort to decide which architecture goes forward.

Limitations

Robust accuracy from AutoAttack is an upper bound: an image counts as robust because these four attacks failed, not because no adversarial example exists. The authors present it as the minimum test for a new defence rather than the strongest possible attack, so a claim that no change within the bound can alter a decision needs a certified-robustness method instead.
The standard version can overstate robustness for defences that are randomised, not differentiable or run an optimisation loop at inference. The reference code warns about some of these cases, offers a version averaging gradients over the model's randomness, and recommends attacks built for the specific defence; RobustBench excludes such defences. A defence tuned to beat AutoAttack itself can pass it without being robust.
The result holds only for the norm and radius tested. It gives no direct evidence about patches, rotations, physical changes to objects or natural corruptions: in RobustBench's quick-start guide, L-infinity-robust models do much worse than an undefended model on fog-corrupted images, though better on average across corruption types. Benchmark radii such as 8/255 are conventions, so the radius should be justified from the deployment's threat, and a new norm or radius needs a new run.
It needs white-box access: three of the four attacks use the model's gradients, and the code expects raw scores (logits) and inputs scaled to [0, 1]; with access only to output scores, the Square Attack can run alone, a weaker test. The standard settings also assume ten or more classes, since the targeted attacks each try nine other classes; on a binary or few-class model the reference code stops with an error, so the settings must be reduced and the result is no longer the standard one.
The full evaluation is computationally heavy for large models and test sets: each white-box run uses 100 iterations, the targeted attacks each try nine target classes, and the Square Attack makes up to 5,000 queries per image. RobustBench's quick start runs a cheaper two-attack version on 50 images and notes the full version is slower but more accurate; a figure from a subset should be reported with its sampling error.

Resources

Research Papers

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco Croce and Matthias Hein•Jan 1, 2020

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness. Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art. Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking. In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function. We then combine our novel attacks with two complementary existing ones to form a parameter-free, computationally affordable and user-independent ensemble of attacks to test adversarial robustness. We apply our ensemble to over 50 models from papers published at recent top machine learning and computer vision venues. In all except one of the cases we achieve lower robust test accuracy than reported in these papers, often by more than $10\%$, identifying several broken defenses.

RobustBench: a standardized adversarial robustness benchmark

Francesco Croce et al.

Software Packages

AutoAttack (fra31/auto-attack)

Oct 7, 2026

Code relative to "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks"

Tutorials

RobustBench: Model Zoo quick tour

RobustBench: a standardized adversarial robustness benchmark [NeurIPS 2021 Benchmarks and Datasets Track] - RobustBench/robustbench

Documentations

On the usage of AutoAttack (AutoAttack flags documentation)

Code relative to "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks" - fra31/auto-attack

Related Techniques

Name	Description	Assurance Goals
Adversarial Training Evaluation	Adversarial training evaluation tests whether a model trained on adversarial examples (inputs altered slightly to cause errors) is really more robust, or has only learned to resist the attacks used in training. The evaluator first states a threat model, meaning the kind and size of change allowed and what the attacker knows. The model is then attacked with a varied set of strong methods, including ones not used in training, ones adapted to this particular defence, and ones that do not rely on the model's gradients, which exposes models that merely hide them. The main output is robust accuracy, the share of inputs still classified correctly under attack, plotted against the allowed size of the change and reported next to accuracy on unaltered inputs. Because attacks can only find weaknesses, the result is an upper bound on robustness, not a guarantee.	Security
Model Extraction Defence Testing	Model extraction defence testing checks whether a model offered through a query interface, such as a prediction API, can be copied by someone who can only send it inputs and read its outputs. The tester plays the attacker, spends a fixed query budget on the protected interface, then uses the answers to train a surrogate model (a copy trained on the answers) or to solve for the model's parameters, and compares the copy with the original. Fidelity is usually measured as the share of inputs on which the copy agrees with the original, together with how many queries that took. The same attack is run with and without each defence, such as limiting queries, rounding or removing confidence scores, or adding noise to outputs, to show how much each defence raises the attacker's cost. The tester also measures the effect on legitimate users, for example accuracy or response time.	Security
Membership Inference Attack Testing	Membership inference attack testing checks whether someone with access to a trained model can tell if a particular record was in its training data. The tester plays the attacker, using the model's confidence scores, its prediction patterns or its loss on a record, often with shadow models, which are copies trained on similar data whose members are known. The attack is scored on records known to be members and records known to be non-members, which the tester must keep apart. The key result is the share of true members the attack identifies when it wrongly flags only a tiny share of non-members (for example 0.1%), because overall accuracy can hide an attack that identifies a few records with near certainty. The results guide the choice of mitigations, such as differential privacy or regularisation.	Privacy Security