Rethinking Classifier and Adversarial Attack
Various defense models have been proposed to resist adversarial attack
algorithms, but existing adversarial robustness evaluation methods always
overestimate the adversarial robustness of these models (i.e., not approaching
the lower bound of robustness). To solve this problem, this paper uses the
proposed decouple space method to divide the classifier into two parts:
non-linear and linear. Then, this paper defines the representation vector of
the original example (and its space, i.e., the representation space) and uses
the iterative optimization of Absolute Classification Boundaries Initialization
(ACBI) to obtain a better attack starting point. Particularly, this paper
applies ACBI to nearly 50 widely-used defense models (including 8
architectures). Experimental results show that ACBI achieves lower robust
accuracy in all cases.