Body: <p>For a typical adversarial attack, a sample <span class="math-container">$x_{0}$</span> is chosen from a training set belonging to class <span class="math-container">$C_{i}$</span> and a transformation <span class="math-container">$A$</span> is applied such that the adversarial example <span class="math-container">$x=A(x_{0})$</span> would be misclassified as <span class="math-container">$x \in C_{target}$</span>. The adversarial example <span class="math-container">$x$</span> could be found iteratively through <span class="math-container">${x}={x}_{0}+\eta \cdot \operatorname{sign}\left(\nabla_{{x}} J\left({x}_{0} ; {w}\right)\right)$</span> for instance.</p>
  <p>In <a href="https://textattack.readthedocs.io/en/latest/1start/what_is_an_adversarial_attack.html" rel="nofollow noreferrer">this documentation of TextAttack</a> I read</p>
  <blockquote>
  <p>Out of those 157, 29 attacks failed, leading to a success rate of 128/157 or 81.5%.</p>
  </blockquote>
  <p>My question is: <em>how do we chose the starting samples <span class="math-container">$x_{0}$</span> (here the 157) to evaluate the success rate of a type of adversarial attack?</em> Do we chose several target classes? Several initial classes <span class="math-container">$C_{i}$</span>? How many samples do we chose? From which set (training? validation?)</p>
  <p>In the <a href="https://arxiv.org/pdf/1511.04599.pdf" rel="nofollow noreferrer">DeepFool paper</a>, they'd use the entire test set- but is it standard practice to claim the success rate of a type of attack this way?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-08-08T09:13:39.100Z
Comments.Text: See: https://ai.stackexchange.com/a/14264/17742 and  https://ai.stackexchange.com/a/9767/17742 - the success rate is supposed to be 100%; otherwise it's not an attack, only an attempt.
Comments.UserDisplayName: Rob
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-08-08T09:22:24.907Z
Comments.Text: The adversarial example is supposed to have a 1/1 success rate, but I can't find a consistent way to chose the samples to evaluate the type of attack throughout the literature
Comments.UserDisplayName: VirginieDlpts
Tags: <adversarial-ml><testing><adversarial-attacks>
Title: What is the "attack success rate" of an Adversarial Attack?
UserDisplayName: VirginieDlpts
ThreadText: # What is the "attack success rate" of an Adversarial Attack?
  
  (Asked by: username_0 on 2022-08-08)
  
  For a typical adversarial attack, a sample $x\_{0}$ is chosen from a training set belonging to class $C\_{i}$ and a transformation $A$ is applied such that the adversarial example $x=A(x\_{0})$ would be misclassified as $x \in C\_{target}$. The adversarial example $x$ could be found iteratively through ${x}={x}\_{0}+\eta \cdot \operatorname{sign}\left(\nabla\_{{x}} J\left({x}\_{0} ; {w}\right)\right)$ for instance.
  
  In [this documentation of TextAttack](https://textattack.readthedocs.io/en/latest/1start/what_is_an_adversarial_attack.html) I read
  
  > Out of those 157, 29 attacks failed, leading to a success rate of 128/157 or 81.5%.
  
  My question is: *how do we chose the starting samples $x\_{0}$ (here the 157) to evaluate the success rate of a type of adversarial attack?* Do we chose several target classes? Several initial classes $C\_{i}$? How many samples do we chose? From which set (training? validation?)
  
  In the [DeepFool paper](https://arxiv.org/pdf/1511.04599.pdf), they'd use the entire test set- but is it standard practice to claim the success rate of a type of attack this way?
  
  **Tags:** adversarial-ml, testing, adversarial-attacks
  
  > **Comments:**
  > **username_1**: See: https://ai.stackexchange.com/a/14264/17742 and  https://ai.stackexchange.com/a/9767/17742 - the success rate is supposed to be 100%; otherwise it's not an attack, only an attempt.  
  > **username_0**: The adversarial example is supposed to have a 1/1 success rate, but I can't find a consistent way to chose the samples to evaluate the type of attack throughout the literature  
  
  ---
  
  ## 0 answers
  
  