Prior literature on adversarial attack methods has mainly focused on
attacking with and defending against a single threat model, e.g., perturbations
bounded in Lp ball. However, multiple threat models can be combined into
composite perturbations. One such approach, composite adversarial attack (CAA),
not only expands the perturbable space of the image, but also may be overlooked
by current modes of robustness evaluation. This paper demonstrates how CAA's
attack order affects the resulting image, and provides real-time inferences of
different models, which will facilitate users' configuration of the parameters
of the attack level and their rapid evaluation of model prediction. A
leaderboard to benchmark adversarial robustness against CAA is also introduced.

本文研究对抗攻击方法中的组合对抗攻击（CAA），对 CAA 的攻击顺序进行了研究，提供了不同模型的实时推理，并介绍了一个基准评测 CAA 的排行榜。

CARBEN: 组合对抗鲁棒性基准测试

CARBEN: Composite Adversarial Robustness Benchmark

Model robustness against adversarial examples of single perturbation type
such as the $\ell_{p}$-norm has been widely studied, yet its generalization to
more realistic scenarios involving multiple semantic perturbations and their
composition remains largely unexplored. In this paper, we first propose a novel
method for generating composite adversarial examples. Our method can find the
optimal attack composition by utilizing component-wise projected gradient
descent and automatic attack-order scheduling. We then propose generalized
adversarial training (GAT) to extend model robustness from $\ell_{p}$-ball to
composite semantic perturbations, such as the combination of Hue, Saturation,
Brightness, Contrast, and Rotation. Results obtained using ImageNet and
CIFAR-10 datasets indicate that GAT can be robust not only to all the tested
types of a single attack, but also to any combination of such attacks. GAT also
outperforms baseline $\ell_{\infty}$-norm bounded adversarial training
approaches by a significant margin.

本文提出了一种新的生成组合对抗样本的方法和一种广义对抗训练方法，能够实现模型对多种组合语义扰动的鲁棒性，包括色调、饱和度、亮度、对比度和旋转等，并在 ImageNet 和 CIFAR-10 数据集上具有显著性能优势。