Optimization Strategies for Robust Deep Learning: Evaluation, Attack, and Defense

Abstract

Deep Learning models have significantly advanced the capabilities of machine learning; however, they remain vulnerable to adversarial examples — inputs that are subtly modified to induce incorrect predictions. This vulnerability is particularly critical in safety-critical domains, such as autonomous driving and medical diagnostics, where model robustness is essential. Three primary limitations in current deep learning systems are: narrow evaluation metrics that oversimplify robustness, manual attack design that impedes scalable vulnerability discovery, and inefficient defenses against practical adversaries (e.g., those with access only to label outputs). This thesis aims to address these gaps through optimization-driven innovations, introducing multi-objective evaluation frameworks and automated attack/defense pipelines to advance the field of adversarial robustness research.

Firstly, we propose a new metric for evaluating model robustness, the Adversarial Hypervolume (AH), which quantifies robustness across multiple perturbation levels. Traditional metrics, which assess robustness at fixed perturbation levels, fail to capture the nuanced trade-offs inherent in adversarial attacks. The AH, inspired by optimization theory, provides a comprehensive evaluation by quantifying robustness across a range of perturbation intensities. We also develop an efficient algorithm for computing the AH and an adversarial training method that directly optimizes this metric. These contributions enable a more holistic assessment of model robustness.

Secondly, to automate the generation of adversarial examples in white-box settings, where attackers have full access to model internals, such as gradients, we propose MOS Attack, a novel framework that systematically leverages multiple loss functions to perform strong attacks. MOS Attack demonstrates how conventional single-objective evaluations underestimate vulnerabilities and provides the first systematic approach to generating adversarial examples using multiple objectives. By eliminating the need for manual tuning of loss functions, MOS Attack significantly advances the automation of gradient-based attacks.

Thirdly, we address the automation of adversarial attacks under black-box settings, where attackers only have access to model outputs, such as class labels. Decision-based attacks, the most practical black-box threat model, rely on querying the model for predictions. However, existing decision-based attacks depend on manually designed heuristics and lack a systematic approach for designing new attacks, unlike white-box attacks that leverage gradient-based optimization. To address this, we propose L-AutoDA, a framework that integrates evolutionary strategies with large language models (LLMs) to autonomously design adversarial algorithms and enable large-scale automated testing. L-AutoDA is the first framework to use LLMs for automating the design of decision-based attacks, facilitating scalable testing of model robustness under black-box settings.

Finally, we propose PuriDefense to address the challenges related to improving defense mechanisms using optimization techniques. It is a lightweight defense combining stochastic optimization with local implicit smoothing. Local implicit smoothing is a novel, lightweight defense mechanism applicable to any model without additional training, and its effectiveness against adversarial attacks has been demonstrated in prior work. Using a randomized dispatch mechanism, we theoretically improve model robustness without increasing computational overhead, achieving quadratic robustness improvement relative to the number of purification models used.

Moreover, to demonstrate the impact of real-world information leakage on model robustness, we introduce MagMiner, a novel attack that exploits the electromagnetic emanations of mobile devices to infer model structures. With the known model structure, attackers can craft more effective adversarial examples based on surrogate models, thereby compromising the robustness of the target model.

These contributions are validated across diverse benchmarks, including ImageNet, CIFAR-10, real-world autonomous driving datasets, and commercial cloud platforms. By redefining evaluation practices, enhancing adversarial threat models, and delivering efficient defenses, this work lays a foundation for trustworthy deep learning systems capable of operating securely in adversarial environments.

Date of Award	6 May 2025
Original language	English
Awarding Institution	City University of Hong Kong
Supervisor	Qingfu ZHANG (Supervisor)