s2fieldsofstudy:
Computer Science
Physics

text:
TeraVision: A LabVIEW Software for THz Hyper-Raman Spectroscopy

Terahertz Time-Domain Spectroscopy (TDS) has emerged during the last two decades as a very popular technique for characterizing the low-energy excitations of several materials, gaseous, liquids and solids, as well as artificial materials as for instance epitaxial heterostructures and more. In recent years, the advances in THz technology allowed obtaining nonlinear optical effects with THz photons, showing remarkable results. In particular, THz Hyper-Raman Spectroscopy greatly expands the spectroscopic capability of the standard THz-TDS by combining intense and broadband THz pulses with a detailed analysis of the spectral content of the generated signal. It is evident that this improvement needs an adequate software support. The main parameter for coding the software which differs with respect to a standard THz-TDS software is the control of a motorized grating (monochromator), but several routines employed in the setup optimization stage rather than the actual measurement are needed as well. In this paper we present the TeraVision software, based on LabVIEW code, in order to highlight the solutions we adopted to tackle the main experimental challenges as well as to give a pleasant and user-friendly experience to expert users.

Brief introduction on terahertz radiation
Terahertz (THz) is a multiple of the unit of frequency in the International System, equal to 10 12 Hz. In the present context we use it for representing the frequency of electromagnetic waves in the range of 0.1 to 30 THz (wavelength 10 μm to 3000 μm), which confines with microwaves and infrared (IR) light. The THz radiation lies on a transition region from macroscopic classical theory to microscopic quantum theory and from classical electronics to photonics. Sometimes, especially in the past, people refer to this region with the expression "Terahertz gap". The reason for this is that both the generation and detection of THz electromagnetic waves is quite challenging compared to well-established techniques in the microwaves and infrared regions, so that this important part of the electromagnetic spectrum was inaccessible until very recent years. Since the first artificial THz wave was produced and detected by means of ultrashort laser pulses in the early 90's, a strong research effort began with the aim to improve our ability to produce, control, manipulate and detect this kind of waves [1], so that now, 30 years later, the expression "THz gap" is not so often employed anymore.
The importance of THz spectroscopy in fundamental science is obvious because many important low-energy excitations are present within this range in practically all kind of materials: emerging materials [2], semiconductors [3], ferroelectrics [4], superconductors [5], polymers [6], photonic crystals [7], liquids [8][9][10], gases [11] and biological systems [12]. Moreover, THz technology has a high impact in many different areas too. We shall not cite them all here, but as an example the application of THz sensing and imaging to biomedical and biological studies and laboratory practices will revolutionize, in our opinion, these fields in a close future [13]. One of the great advantages in this case, is the very low photon energy, which is much safer than X-rays for living tissues imaging [14].
The unique performance of THz has far-reaching implications in areas such as communications [15], radar [16], astronomy [17], safety inspection (airports) [18], etc. Terahertz is a new source of radiation with many unique advantages: as an example, it is possible to combine spatial and temporal resolution (a typical THz pulse has a time duration of about 1 ps and a wavelength of about 100 μm) in order to perform not only imaging but also time-resolved measurements on an ultrafast ps time-scale. As a result, THz research has a great value to national economy and national security [19].

THz Spectroscopy
For many years, IR and Raman spectroscopies have been used to investigate the properties of molecular vibrations and rotations. THz Spectroscopy can complement those two techniques, for mainly two reasons: from the one hand, it can access higher wavelengths compared to IR and Raman, and from the other hand it can access the complex transmission or reflection coefficients rather than their real squared value (power spectrum), as will be shown in the following [20]. Figure 1 shows the position of the THz range in the electromagnetic spectrum. At present, there is no generally accepted definition of the upper and lower limits of THz radiation frequency. The high frequency of THz spectrum overlaps with the far IR spectrum, and the low frequency overlaps with the microwave frequency band. Most of the authors set the limits of this range to 0.1-3 THz, because this is the emission region of the most commonly used sources (photoconductive antennas and optical rectification), but here we prefer to extend this range up to 30 THz, because this is the upper limit of our source based on air-plasma, which will be described in the following, and this emission scheme is essential to achieve the THz Hyper-Raman effect, as it will be shown later. TeraVision: A LabVIEW Software for THz Hyper-Raman Spectroscopy DOI: http://dx.doi.org /10.5772/intechopen.96663 A major reason for the rapid development of terahertz spectroscopy is the progress of ultrafast lasers (femtosecond pulses) by means of the Chirped Pulse Amplification technique, which was introduced by Donna Strickland and Gérard Mourou at the University of Rochester in the mid-80's for which they received the Nobel Prize in Physics in 2018 [21]. These ultrashort laser sources gave birth to several new generations of spectrometers in the early 90's, including THz. The THz spectrometer is capable of generating and detecting pulses of coherent THz radiation, but most importantly it is able to detect both amplitude and phase of the THz wave, and thus it allows retrieving the full complex dielectric function of the target material without resorting to Kramers-Kronig relationships, as it happens in standard IR spectroscopy. Moreover, some recent advances in both the fs laser sources and the THz emission efficiency and detection sensitivity, allowed the researchers to make use of intense THz pulses to control the material relevant parameters [22], rather than being limited to measure its spectrum.

THz time domain spectroscopy
THz Time Domain Spectroscopy (THz-TDS) is the most widespread technology among general THz spectroscopies. We give here a brief description of it, although it is not the main topic of this Chapter, for two different reasons. First, the TeraVision software is able to control standard THz-TDS measurements besides the THYR Spectroscopy, and, second, THz-TDS is a good way for inexperienced readers to approach the topic of THz Spectroscopy in general. The name of this technique is quite straightforward as the spectroscopic information is not retrieved directly in the frequency domain, but in the time domain, and then converted by simple Fourier Transform. The THz pulse can be generated in several ways. The most commonly employed generation mechanisms are photoconductive antennas [23], optical rectification [24] and air-plasma four waves mixing [25]. The first method creates a strong and short burst of current in between two electrodes with applied bias voltage when a population of free charges is suddenly created by a fs-laser optical pulse in a semiconductor slab. The second method converts the fs-pulse bandwidth into THz by nonlinear optical difference frequency conversion ( ωω − , often called "optical rectification", this expression more properly refers to static electric fields generated by light) by means of opportune nonlinear crystals (ZnTe, GaSe, GaP and many others have been proved to work best on different spectral ranges). The key point here is that due to the very large bandwidth of fs-pulses the difference between all possible frequencies ( ωω − ) does not always vanish, but it rather creates a low-energy band whose extension depends on the laser pulse bandwidth as well as the dielectric properties of the nonlinear crystal. The third method is based on laser ionization of air molecules, converted by strong laser intensity into plasma, which is a highly non-linear medium. The contextual presence of fundamental and double frequency photons (created by a suitable nonlinear crystal Beta Barium Borate β-BBO, placed few centimeters in front of the plasma) generates many four-waves mixing frequencies: some of them are falling into the visible domain, as possible to observe in Figure 2 on the mirror surface, and should be filtered out by a high resistivity thick silicon wafer, but one particular linear combination of those frequencies ( ωωω −−

2
) is capable of producing the THz radiation. Also, here as in previous point, the subtraction of two photons at fundamental laser frequency from one photon at double frequency, is not a static field ( ω = 0 ) because of the large bandwidth of the fs-laser pulses. This is the generation scheme which is necessary for THYR Spectroscopy [26].
For detection, it is possible to use any of the above mentioned techniques, but reversed. In all cases, the detection works as follows: the THz pulse is sent to the sample and it gets reflected or transmitted. Then, it is sent to a detector which will LabVIEW -A Flexible Environment for Modeling and Daily Laboratory Use change its electric or optical behavior according to the THz excitation, and namely to the value (and sign) of the THz electric field at a specific time. As an example, the THz pulse will change the microcurrent which flows in between two electrodes on a semiconductor substrate (photoconductive antennas) but this current will exist only when a second fs-laser optical pulse hits the semiconductor to create free carriers. Given the much shorter duration of the fs pulse as compared to the THz one, the microcurrent will be proportional not to the integrated THz pulse energy, but rather to the value of the THz electric field in time, where the time is given by the delay between the THz and the probing optical pulse. In a similar fashion, one can exploit the transient birefringence of certain nonlinear crystals in order to change the polarization state of the probing optical pulse. Again this transient change depends on the time delay between THz and optical pulses and therefore it gives a time-scan of the temporal profile of the THz pulse (so-called "electro-optic sampling"). Finally, the symmetry breaking induced by the THz electric field in a centro-symmetric medium (usually air) will produce a nonlinear effect when coupled with a strong optical pulse, such as for instance optical Second Harmonic Generation (SHG), and again its intensity will be proportional to the amplitude of the THz electric field responsible for the symmetry breaking (this is the so-called Air Biased Coherent Detection -ABCD).
THz-TDS has the following characteristics: 1. THz-TDS technology can be used for qualitative identification [27], because it can effectively detect the physical and chemical information of materials in the THz band. And it is also a non-destructive detection method.  2. The amplitude and phase information of various materials such as dielectrics [28], semiconductors [3], gas molecules [11], biological systems [12,29] (proteins, DNA, etc.) and superconductors [5,30] can be obtained conveniently and quickly by using THz-TDS technology.
3. In conductive materials, THz radiation can directly access the carrier dynamics. THz-TDS can effectively be used as a non-contact and ultrafast multimeter for conductivity measurements.
4. Due to the transient nature of THz radiation, THz-TDS techniques can be used to measure relaxation-times and the low-energy excitations dynamics in general, with very good resolution [31].
Besides, THz-TDS technology also has the advantages of wide bandwidth, high detection sensitivity and stable operation at room temperature.
Despite a huge amount of developments in the last 20 years, THz-TDS still needs some improvements on the spectral resolution and spectral range. In the near future, THz-TDS technology will be a powerful tool for uncovering and analyzing ultrafast phenomena in basic sciences such as physics, chemistry, and biology. At the same time, with the reduction of laser cost, the emergence of more efficient THz emitters and detectors, and more compact and advanced optical design, THz-TDS technology will have a broad commercial application prospect [32].

THz Hyper-Raman time domain spectroscopy
The standard THz-TDS technique has already proved to be very effective. Nonetheless, it is important to highlight that, despite the use of nonlinear optics to generate and reveal THz radiation, this is a linear spectroscopic technique, i.e. it probes the linear dielectric function of the target material. Sometimes, it could be not so easy to access the target observables, such as the low-frequency excitations (phonons, magnons, excitons, etc.). For example, a large absorption can obscure a significant part of the spectral range, the index of refraction and/or the dielectric function could be difficult to interpret if the target materials have a complicated structure, the background from the bulk can overcome the weaker superficial contribution, which is perhaps the real target of the experiment, and finally some low-energy excitations are simply out-of-reach because of symmetry, i.e. they just do not show up in the linear parameters due to selection rules. Accessing the nonlinear optical parameters can in principle remove most of these hurdles. With this aim in mind, a new spectroscopic technique has been developed by our group a couple of years ago. Through the application of this new technology, femtosecond laser pulses and intense sub-picosecond broadband THz pulses produce THzoptical four-wave mixing in the material. The spectrum of the resulting signal is decomposed both in wavelengths and time and it appears as two distinct frequency side bands around the optical SHG central frequency L ω 2 , where L ω is the optical central frequency of the fundamental fs-pulse. This effect resembles the wellknown Hyper-Raman (HYR) effect, and therefore it has been named THz Hyper-Raman -THYR.
In standard all-visible HYR, the coupling between optical frequencies happens through a high-order nonlinear susceptibility tensor. The model at the base of the THYR effect, instead, is a regular four-wave mixing effect, in which one of the optical photons is replaced by a THz photon. The mathematical formalism is therefore that of a nonlinear Raman effect, but because of the very small THz photon energy, the sidebands are appearing very close to the SHG central frequency instead of the fundamental central frequency, resembling what happens in HYR. Taking the same nomenclature routinely used for Raman and HYR effects, we define "Stokes" and "anti-Stokes" bands, developing around the SHG frequency L For all details about THYR theory and applications we invite the reader to the following publications: [33,34]). The energy diagram of the effect is shown for Stokes (left) and anti-Stokes (right) bands in Figure 3. From an experimental point of view, the signal has to be measured in both frequency and time domain, so that the software TeraVision which has been developed in order to drive the experiment and record the data must be more sophisticated than the regular kind of software used for THz-TDS. Moreover, we intended to create a software capable of performing several different kinds of measurements, thought to be independent from the THYR spectrometry, and/or used as ancillary measurements in THYR spectrometry as well. In addition to this, we inserted some features in order to simplify the signal detection and optimization, which could be of use more generally for whoever needs to perform any kind of optical Pump/Probe experimental scheme.

Experimental set-up
The experimental setup which was built in order to perform THYR experiments is shown in Figure 4. The femtosecond laser is a Ti:Sa mode-locked seed laser, amplified by a regenerative cavity. The fs-laser pulse, after passing through the beam splitter, is divided into a Pump (transmitted) pulse and a Probe pulse (about 10% of total power). The Pump is chopped by a mechanical chopper locked to half of the laser trigger frequency in order to block every second pulse. The pulse train chopping is very important because it allows measuring the difference between THz-ON and THz-OFF signals, as it will be further explained in the following. The pulse is then sent on a nonlinear optical crystal (Beta Barium Borate, β-BBO) where about 20% of the optical power is converted in SHG and then both fundamental and doubled pulses are focused in air by an achromatic doublet. In the plasma filament, usually about 1 cm long, the generated plasma is producing THz pulses via fourwaves mixing processes in which the maximum THz amplitude depends on relative phase between the fundamental and second harmonic light [35]. The Probe is sent to a delay stage in order to introduce a controllable delay between Pump and Probe pulses and then it is incident on the detection crystal (usually ZnTe, GaSe or GaP, or just air for ABCD technique) together with the THz pulse in a collinear geometry, through a hole in the last parabolic mirror. In the detection crystal the polarization  state of the optical pulse is altered by the presence of a transient birefringence created by the THz electric field, and this change can be detected by separating two orthogonal polarizations of the pulse with a Wollaston Prism and measuring their signal difference in a balanced photodiode. As the delay between the two pulses is adjusted, the amplitude of the THz pulse can be sampled in time, and the full THz waveform can be reconstructed. In a standard THz-TDS experiment, the sample will be placed in the first focus (f1) of the parabolic mirror and the detection crystal is placed in the second focus (f2), as we can see from Figure 1, to measure the THz waveform transmitted through the sample. The complex transmission coefficient is then obtained by measuring the signal without the sample in place, as an estimate of the incoming electromagnetic wave, and finally the complex ratio between the Fourier Transforms of those two measurements will deliver the complex transmission coefficient spectrum. In reflection geometry, the problem is more complicated by the difficulty to place sample and reference mirror with sufficient accuracy. We are not going to tackle the problem of THz reflectivity measurements here, and we refer to this publication and the references therein [36]. In the THYR experiment, the first focus (f1) is left empty, the detection crystal is removed, the sample is place in the second focus (f2) and the whole detection line after sample is replaced (by means of flippable mirrors) with the setup shown in the inset of Figure 4. The signal produced in the sample by the interaction between THz and optical pulses is filtered in order to remove the 800 nm light, then it is sent to a monochromator for spectral analysis and finally to a photon multiplier tube (PMT) for detection. The PMT is needed because of the very small amount of photons which are created by THYR effect, but its operation is usually in continuous mode rather than in photon counting mode. Anyway, if the signal from a given sample would be too small, it is straightforward to switch the detection to a photon counting regime, provided that the laser and setup stability is good enough to support a much longer data acquisition time. Finally, the ON and OFF trains of pulses are separated by the TeraVision software and each of them is subtracted with the following one. As the timedistance of two subsequent pulses is 1 ms, this differential measurement scheme will quench all noises below the 1 kHz cutoff frequency. Moreover, this procedure ensures that even in presence of a strong non-THz-related background signal (as for instance a static SHG signal, or 2-photons luminescence) the measured signal will not be too much affected.
Here and in the following, we will name the Pump pulse simply "THz pulse", as it is responsible for THz generation, and the Probe pulse will be named "Gate pulse", as it sets the time-gate at which the signal is sampled. This nomenclature is quite common in THz spectroscopy, and it is particularly important when performing a THz Pump/Probe measurement, because in that case the pulses will be three: an optical Pump pulse which is exciting the sample, the THz and the Gate pulses, which are both together acting as a Probe. Let us now briefly give some details about the main components of the setup.

Laser
The laser system used to run the spectrometer is a Coherent Legend regenerative amplifier seeded by a Coherent Mantis fs-oscillator (800 nm central wavelength, 20 fs FWHM pulse duration, 80 MHz repetition rate, 500 mW output power) and pumped by Coherent Evolution (527 nm central wavelength, ~ 10 ns pulse width, 1 kHz repetition rate, 20 W output power). The Legend delivers ~4 W output power at 1 KHz repetition rate (~ 4 mJ energy per pulse) at 800 nm central wavelength (1.5 eV), ~ 80 nm bandwidth, and with about 35 fs FWHM time duration [37].

Monochromator
It is an optical device which disperses the light spectrum by means of a suitable optical grating (1800 groves/mm, in this case) and filters out all wavelengths except those passing through a slit at the output of the device. We use a monochromator from the Optometrics Group which is a Ebert-Fastie type with focal length (path length) of 74 mm, model number SDMC1-02 (Scanning Digital MiniChrom). The wavelength range of this monochromator is 200-800 nm. The wavelength range is suitable for all our measurements (THYR, THz-TDS and SHG). The reciprocal linear dispersion factor is 3 nm/mm. We can operate our monochromator manually using a knob for selection and a digital counter for wavelength readout. However, the device is routinely controlled via TeraVision software which drives a stepping motor controller (PCM-01) connected to PC by RS-232 serial port. The monochromator is used only for SHG and THYR detection, in combination with a PMT. It is possible to use it also for THz-TDS detection in case of ABCD technique, but we will not discuss this method here.

Photomultiplier tube and balanced photodiode
A PMT is a device consisting of a photocathode, several dynodes and one anode, all placed in vacuum. Modern PMTs deliver low noise and low jitter detection over a wide dynamic range. We use a PMT by Hamamatsu (model number R928) having spectral response from 185 to 900 nm. The PMT is used only for SHG and THYR detection, and it can be used in combination with the monochromator for THz-TDS by means of the ABCD technique. In case of standard electro-optic sampling (THz-TDS) we use a balanced amplified photodetector by Thorlabs (model number PDB210A) with broadband detection range (320-1060 nm). The detector has two distinct low-noise photodiodes, whose difference is strongly amplified by the device in order to achieve a low noise measurement of the differential signal. The main advantage of this device compared to performing the subtraction of independent photodiodes signals is that the amplification on the difference is affected by a much lower noise than the subtraction of already amplified separate signals.

Delay line
In our experiments we use a linear stage by Physik Instrumente (PI, M-5x1 series) which are low profile, high-accuracy linear translation stages for laboratory applications. The stage is controlled by a DC-Motor controller (Mercury) and the PC communication is ensured through a standard RS-232 port. The minimal step size corresponds to a minimum incremental motion of 0.1 μm and 1 μm full travel accuracy. Therefore, since the optical path is double (forward-and-backward) than the physical path, we can achieve a minimal time delay of about 6 fs. As the optical pulse duration is about 35 fs, this Delay Line allow us to reach the full time-resolution possible for our setup.

Rotors
To control the input and output optical polarizations of light for THYR and THz-TDS experiments, we used mechanical rotors controlled by DC servo controllers. We use Thorlabs rotors (model PRM1/MZ8) which are small, compact, DC servo motorized 360° rotation stages. The user can measure the angular displacement manually by using the Vernier dial and the marks that are marked on the rotating plate in 1° increments. In order to rotate the rotors precisely we are using DC servo controllers (model TDCOO1) or "T-cube DC", controlled in turn by our TeraVision software. The software allows the user both to set the in-out angles as fixed parameters in any kind of measurement, or to measure the signal as a function of in-and/or-out angles by fixing all other parameters, in the "Rotors" Tab.

Data acquisition
The electrical signal is generated by the PMT or the balanced photodiodes and enters a Stanford Gated Integrator or Boxcar Averager (GI). Here, it is splitted in two signals (50%). One is sent to a Tektronix DPO 4054 oscilloscope for monitoring the signal and, more importantly, adjusting the synchronization with the electronic gate, while the second signal enters the GI for processing. In our lab we use SR250 GI that is a versatile, high speed, low cost module designed to recover fast input analog signals from noisy background. It consists of a gate generator, a fast gated integrator, and an exponential averaging circuitry. The gate generator can be triggered internally or externally, and it provides an adjustable delay from a few nanoseconds to 100 ms before it generates a continuously adjustable gate with a width between 2 ns and 15 μs. The delay can be set by a front panel potentiometer. The fast gated integrator integrates the input signal during the gating and the output signal is normalized by the gate width to provide a voltage which is proportional to the average of the input signal. This signal can be further amplified by using different settings on the front panel of the boxcar integrator. The final analog output signal is sent to a data acquisition system (DAQ ) based on aPCIe-6351 interface by National Instruments (NI). The latter is a X-series multifunction I/O Device, which offers analog (16 bit) and digital I/O, four 32-bit counter/timers for encoder, frequency, event counting etc. It relies on a high-speed PCI Express bus. In our TeraVision software we used NI-VISA which is an API (Application Programming Interface) that provides a programming interface to control GPIB, serial, USB, PXI, VXI etc. instruments in National Instruments application development environments like LabVIEW.

Brief introduction to LabVIEW
LabVIEW (Laboratory Virtual Instrument Engineering Workbench) is a software development environment by National Instruments (NI). One of the most significant difference between LabVIEW and many other computer languages is the use of a graphical interface for editing codes, resulting in the form of block diagrams. Besides this, LabVIEW is quite straightforward to use especially for people (like us) with no professional training for software coding, thanks to many routines and libraries which have been developed with a special focus on laboratory work, automation and instruments control, together with a pleasant and user friendly graphic interface for the software end user. This software is the core of the NI design platform and it is also an ideal choice for developing measurement or control systems. LabVIEW development environment integrates all the tools that engineers and scientists need to quickly construct various applications, designed to help engineers and scientists to concentrate on their principal tasks, to solve problems and to improve productivity.
LabVIEW is a graphical programming environment for creating applications using icons instead of text lines. The traditional text programming languages determine the order of program execution according to the order of statements and instructions, while the LabVIEW adopts the method of data flow programming. LabVIEW's graphical source code is similar to a flowchart to some extent, so it is also called the block diagram. The data flow between nodes in the program block diagram determines the execution order of subroutines (Virtual Instruments -VI) and functions. LabVIEW provides many controls that look similar to traditional instruments, such as oscilloscopes and multimeters, for simplified user interface creation. The user interface in LabVIEW is called the front panel. With icons and wires in the block diagram, one can programmatically control the objects on the front panel.

Main concepts about the TeraVision software
The TeraVision software is meant to perform two main types of measurements: 1) as a function of time (THz-TDS); 2) as a function of time and wavelength (THYR). In addition, it can perform two ancillary measurements: 3) as a function of wavelength only (Spectrum); 4) as a function of input/output polarizations (Signal Anisotropy). The latter two can be performed with and without a THz pulse applied on the sample. More features are very relevant for system optimization, and therefore the software includes: 5) a routine for signal optimization, in order to observe a real-time scan of the signal on screen, although with a large noise; 6) a signal-channel monitor, which displays the actual values of each channel of the DAQ before averaging; 7) a Delay Stage control to check for the device performance and to drive it manually and independently on the measurements. We note incidentally that point 6 can be used also as a signal monitor to manually measure the signal as a function of any variable which is not under the software control (temperature, external electric or magnetic fields, and so on…). Since the signal is revealed as the difference between THz-ON and THz-OFF trains of pulses, this reading cannot be done by means of a single external unit, such as a digital oscilloscope.
The software can manage automatically the creation of folders and data files for saving the experimental results and the parameters are checked at each input in order to ensure that any possible mistake by the user cannot create problems during the measurement execution. At every startup the initialization procedure is collecting data from all devices to set the safety breaks which are forcing the user to set all parameters in within a safe range. Moreover every value is rounded to the minimal time/angle/wavelength resolution, so that the device can be driven with no overlap between subsequent points. The measurements files are numbered incrementally in order to ensure that two runs with identical parameters and names will be stored in different files, which are saved automatically during each run, but can be deleted at the end of the run upon user command. The software also has the ability to ring a bell when the measurement is finished, and the bell stops ringing as soon as the mouse is moved or any key is pressed. In this way the user can save time and energy by working on other things while the measurement is running, still without losing any time at the end of each run. The basic idea below TeraVision is that the user must be concentrated uniquely on the measurement and not be bored by many irrelevant tasks.
The software produces three distinct files for each single measurement: a large data file in which every single point of every scan is saved before averaging, a short data file in which only the average on all points and scans is saved, and an image file which contains a summary of the measurement with graphs and all relevant parameters and comments by the user. This ensures that during data analysis the user will find quickly what he/she is searching for, he/she will be able to quickly analyze the averaged data, but he/she will also be able to perform a deep data analysis on individual points if needed, so to maintain the full information content of the measurement. The data files are saved point-by-point during the run, in order to prevent information losses due to system crash, electrical black-out or whatever unpredictable problems.
All these features are meant to create a very friendly and free-of-worries user experience, to make unnecessary for the user to have any specific knowledge about the software code and to achieve 100% safety about data loss and device operation.
From the point of view of the performances, and in particular in order to reduce the measurement time as much as possible, several solutions have been implemented, and they will be discussed in the next sections.

The TeraVision front panel
We begin to describe the operation of the TeraVision software starting from the final user interface, in order to explain in some details all the features included in the software. In a second moment, we will describe the "backstage", i.e. how we implemented the proposed solutions in the software code. Figure 5 shows the TeraVision front panel. In the upper line of the panel there is the software name and version, and the Quit button. This button is important, for it drives the correct quitting procedure of the software, as better explained in the dedicated section. The user can quit the software in other ways, but then he/she will need to close manually all ports used by the program and all set parameters of that experimental session will be lost and the software will load the previously saved ones at next startup. Below the first line, we can locate two main blocks: the central Tab panel, which is the core of the software, and a lateral column. This column will be always on screen for any Tab selected. Let us describe the column content, and then we will describe each individual Tab of the central panel in separate subsections.

The controls column
The lateral column is always on screen, for each Tab selected. It is composed of two upper Controls columns and one lower indicator/comments column. On the two upper columns the user can set the parameters for different types of measurements. These two columns have been labeled "Spectral controls" and "Time controls" not because they contain only spectral or time controls (they do not) but rather to remind the user that when he/she would like to perform a spectral measurement, the software will drive the Delay Line to a specific time (so the Delay Time parameter is shown in the Spectral Controls). Similarly, when the user wants to perform a Time-scan (just as the one shown in Figure 5) the software will set the monochromator wavelength to a fixed specific value, and therefore this value has been inserted in the Time Controls column. In the lateral columns it is possible to set the parameters for any specific measurement. The user can define the start/stop/ step values for a time scan or a wavelength scan, the angles of polarizer and analyzer waveplates, the number of Laser shots on which the average will be performed and the number of Scans (the number of times the single measurement will be repeated to improve the signal-to-noise ratio) and finally the sample name which will be used in the experimental report. Every single value is checked together with the others in order to ensure safety. For instance if the user sets by mistake a value for stopping the Delay Line which is larger than the Delay Line length itself, the software force the value to the maximum, which has been recorded during the device initialization procedure. If the start value is larger than the stop value, the two values are  exchanged. If the user sets a negative value for the Laser Shots parameter, it is forced to positive, and so on.

The comments columns, the saved files and the experimental report
Below the Controls columns there are three indicators. "# per Scan" indicates the number of points to measure within a single scan, "Now scan #" indicates the number of current scan and "Meas. Numb." indicates the incremental measurements numbering. As already mentioned, each time a measurement is launched, the software creates three files using the sample name, date/time and measurement number for naming the files. Those files are saved in a folder, which is created automatically at each startup during initialization, named with the date of the measurement. The three files have all identical names but different file extensions. The *.dat file contains all single points of the measurement. The *.txt file contains only the averages for all points and all scans. The third file is a *.jpeg file with the printout of the experimental report.
Below the indicators there are two text fields with the user name (for future references) and a free textbox in which the user will write all parameters which are not under TeraVision control (sample temperature, electric or magnetic fields applied to the sample, and so on…) and whatever observation is relevant to the present experiment. This "comment" textbox is extremely useful for creating the experimental report file. Figure 6 shows an example of a report file. The measurement number and sample name are in the top row of the page. In the center of the page there are the graphs of the measurement, and just below them there is a textbox with all relevant parameters, the units of each column in the data files and the free comment textbox, just described above. The reason while we have chosen the *.jpeg format instead of the more used *.pdf file is that having one folder with up to 100 or more measurements, the user must open those 100 *.pdf files individually in order to find the measurement he/she is searching for. Using jpeg and any picture viewer, one can just browse all pictures in the folder within the same window simply by pressing an arrow key, and it is even possible to use the preview function so that one does not need to actually open the file in order to know what is inside that specific measurement. We found that if one makes use of this report wisely and carefully, it can create a digital log-book which can partially replace the need of a physical hand-written lab-book. Figure 5 is the "Acquisition" Tab. It is used for timescan, both with electro-optic detection, as in regular THz-TDS, or for scanning in time on a single wavelength in a THYR experiment, or for THz-TDS with alternative techniques such as the already mentioned ABCD technique. There are two graphs, one for the measured signal in time domain and the other which displays the Fast Fourier Transform (FFT) of the signal. In each graph two lines with different colors are displayed. The red one is the measurement on the current scan, and it is updated point-by-point, so that the user can immediately see if there are problems during the measurement without need to wait one full scan to be finished. The white curve is the average of all previous scans, and it is updated at the end of each scan. In the saved txt data file and jpeg report only the averaged curve is stored. In addition, the user has all the usual LabVIEW graph tools for changing the scale, labels, and more. Finally a vertical bar is tracing the progress of the measurement. This progress is not a theoretical estimate. It is calculated by measuring the real elapsed time since the beginning of the measurement, dividing this time by the number of measured points so to obtain a realistic estimate of the time-per-point, and finally a multiplication for the number of total points and remaining points gives an estimate of the overall progress, in percent.

• The first Tab is shown in
• The second Tab is the "Loop Scan" Tab. In this Tab the time scan is shown with no averaging. The delay stage is moved continuously in between the start and stop point, and the positions are not recorded. This speeds up a lot the acquisition, so that the waveform appears on the PC screen in real-time exactly as if it was displayed on an oscilloscope screen. In this Tab it is possible to set the velocity and acceleration of the Delay Stage, which will be then used also  elsewhere. The reason for this utility is to monitor the signal while adjusting the alignment of the setup. Who works with THz knows that the setup optimization can be quite difficult because if one looks at some signal on the oscilloscope, for instance the peak of the waveform, this peak position will change in time as the user is optimizing the alignment, because the relative path between THz and Gate pulses is changed. If one has the signal on screen in real-time, the displacement of the peak position will not be a problem, as long as the peak will fall between the start and stop points. The major drawback of this method is that the very poor signal-to-noise ratio makes difficult to distinguish the signal when it is very far from optimal intensity. It is very useful to quickly reach the optimum once the signal is already roughly optimized.
• The third Tab is the "Move Stage" Tab. Here the user can set the Delay Stage parameters, and it displays a real-time chart which shows the stage position in time. This utility is used to manually move the stage step-by-step when searching for the signal after a major realignment, or to quickly move the stage in between two fixed positions. For instance, when a filter is placed in one of the two arms THz or Gate, it will change the relative optical path by a fixed known amount of time, so that it will be possible to quickly switch between the peaksignals in the two different cases.
• The fourth Tab is the "Single Channels" Tab. In this Tab a graph in real time shows just the output of the DAQ for a given number of points. The DAQ receives two signals. One is the photodetector (PMT or balanced photodiode), and the second channel is linked to a photodiode which monitors the THz generation optical pulse right after the chopper. This monitor is needed for two reasons: the first is to keep trace of the laser intensity, and the second to know exactly which pulse has been chopped and which one has not. Even if in principle this signal could be used to normalize the measured signal on channel 1 in order to account for laser intensity fluctuations, our test measurements reveal that the amount of noise introduced by this procedure greatly overcomes the benefits of having a normalized signal, and therefore the channel 2 is used only to recognize the ON and OFF signals so to perform the differential measurement. In this Tab it is possible to set the DAQ parameters such as number of triggers to wait and average for each experimental point (delay stage position, monochromator wavelength). The utility is also capable of warning the user if the channel 2 photodiode signal difference between ON and OFF pulses is lower than 3 times the sum of the two standard deviations of each series of points (ON and OFF). When this condition is met, it means that the chopper phase has somehow changed and the chopping does not completely block every second pulses (this may happen for instance when the laser trigger has significant jitter or when the trigger parameters in the chopper motor are not correctly set). In this case, a red indicator blinks and the user is invited to check the chopper phase.
• The fifth Tab is the "PCM Spectrum" Tab. Here the signal is measured as a function of wavelength for a fixed Delay Line position (time position). In this Tab it is possible to set the monochromator parameters and to record a curve of the signal when THz is ON, OFF or the difference between the two. This is important in the case of THYR measurements, in order to directly compare the signal with no THz (standard SHG signal) and the signal with THz applied to the sample (THYR signal). It is also quite useful for quickly checking the presence of spurious effects, as for instance 2-photons luminescence.
• The sixth Tab is the "2D Scan" Tab. This Tab is shown in Figure 7. This is the Tab for THYR measurement, where the signal is measured in 2D as a function of both wavelength (x-axis) and time (y-axis). The graphs in this Tab can be manipulated to be a color mesh in 2D or a full 3D graph. The figure shows a typical THz measurement, in which we can observe first and second order Stokes and anti-Stokes bands and their very different time relaxation. The oscillating behavior of the central peaks is evident as well. For a detailed explanation of the measurement shown in this figure, we would like to refer to Ref. [26].
• Finally, the last Tab is the "Rotors" Tab, in which the signal can be measured as a function of the incoming or outcoming optical polarization. This is of particular importance when studying the symmetry properties of the SHG signal generated by the sample. This is in turn important for obtaining a correct physical interpretation of the THYR signal. This is in fact the result of a complex nonlinear optical effect, and its relationship with the target material parameters of interest can be not easy or immediate to appreciate. One has to usually study the SHG symmetry and characteristics, with and without applying a THz pulse, in order to find the most convenient choice of the optical polarizations. This Tab can be also used as stand-alone acquisition software when a SHG measurement, rather than THYR or THz-TDS, is the real goal of the experiment.

Initialization and quitting routines
The conceptual scheme of the experiment in Figure 8 shows the optical, electrical and digital connections of the THYR setup. The TeraVision software controls 4 items: Delay Stage, Data Acquisition Card (DAQ ), Rotors and the monochromator. The first task of the software at startup is therefore to initialize all these devices.  The program creates all folders needed for data acquisition according to the system date and time; it opens all communication ports and cleans all buffers. In this phase, however, the software is not only performing the basic initialization in order to be able to communicate with each device, but it is also interacting with the user. Using pop-up messages the software asks the user about starting set parameters, which initial value is read in a setup file. For instance the user can choose to move the Delay Stage to find its physical edges or to set the "home position", i.e. the zero-step position. The user can choose to skip the initialization procedure of that specific device too. The same happens for all devices. This start-up phase is run only at the beginning, when the software is launched. Then the software is running in time-out mode, waiting for user commands. When the software is quit, a second one-timeonly routine is launched, which is saving all set parameters in the setup file in order to call them again at next startup. This method is very convenient as the parameters are many, and the user can not always remember which parameter was set last time. Beside this, the quit-routine is closing all open ports and flushing all memories of the devices in order to ensure a clean startup on the next call. A "smart-stop" VI ensures that the user cannot quit the program if one or more while/for loops are still running. The VI makes sure all loops are closed in the right order, from internal to external, and all queues are correctly flushed before moving to stop the next loop. This is the reason why it is not recommendable to quit the software in other ways.

The block diagram: event structure/producer and consumer loops
After initialization, the software goes in timeout mode and waits for user commands. The entire architecture of the software is therefore enclosed in a large event structure, shown in Figure 9, where every single button on screen is triggering a specific event. This choice of the basic architecture was perhaps not the wisest one, and it will be changed in the future (see the final section about future perspectives). In order to ensure that unjustified clicking on certain buttons by the user can harm the software execution, each event will disable all buttons which are not relevant during the performance of that event, and those buttons will be grayed, so that the user has an exact feeling of what can and cannot be done in that precise moment. The user can always stop the current task with a specific stop button, which drives the already mentioned "smart-stop" VI instead of being directly linked to any loop, so to ensure that the system has returned to timeout mode correctly.
The TeraVision software has been written with particular effort on saving time during each measurement. If a simple time-scan on a short range and few points can take seconds or few minutes, a full resolution 2D scan of a real THYR measurement can take several hours. This time is really at the limit of long-term laser stability specifications. For this reason, every millisecond spared during the single point acquisition, or in between two subsequent scans, is important. Several actions have been taken in order to reduce the measurement time as much as possible, and we will list them in this section.
First, the time required for the actual measurement (devices movements and number of triggers for each point) is decoupled from all analysis and digital work (in particular data and parameters file writing, which is the most digital timeconsuming task). The way we chose for this, is to implement several Producer/ Consumer loops (an example is shown in Figure 10). The Producer/Consumer architecture is a classic case of multithreaded synchronization solution. It applies when two threads (producer and consumer) actually run together in parallel. The main role of the producer is to generate a certain amount of data to put into the buffers and then repeat the process with one or more nested for/while loops. It is crucial to implement "smart stops" in order to prevent crashes due to nested loops. At the same time, consumers are consuming the data in buffers for data analysis and saving. The key is to ensure that producers do not add data when the buffer is full, and consumers do not consume data when the buffer is empty. Figure 10 shows as an example the Producer/Consumer architecture for the Acquisition task. Many users know that LabVIEW can be programmed by multithreading, but usual ways to implement multithreading are to use global and local variables, with the disadvantages of possible data loss, risk and competition. The loops are driven by queue controls in order to ensure a correct processing of data flow.
The data processing is, however, not the most time-expensive problem. The most time-consuming tasks are by far the physical movements of all devices. In order to minimize those movements, we implemented the following procedure.  The usual way to drive a step motor is to give it a target position, then read out the actually reached position and finally adjust it with a secondary movement command, with or without a third step due to so-called backlash correction. We chose to avoid all position corrections. For the measurement is not important that the target position is "really" that given in command, as long as the actual position reached after a single movement is read with sufficient precision and accuracy. Therefore, the system creates an array of positions, from the start/stop/step parameters, equally spaced, and gives them to the motor driver VI for each trigger of the acquisition loop. Instead of waiting that the device goes precisely on each position of the array, the software collects data on random positions acquired "closed to" the target positions. After one scan is completed, the software interpolates the signal values acquired on random positions on top of the original equally spaced array. In this way we realize two important things: first, the signal can be averaged easily with all previous scans as the x-axis values are identical, and second the FFT routine will work correctly, as it requires to run over equally spaced arrays only. For the same reason of minimizing the device movements, the software is also capable of performing the scans in "reverse" mode, i.e. it scans from start to stop and then from stop to start, in order to remove the dead time needed to send the motor back to the start position. Finally, the system can decide automatically how to start the first scan by reading the actual position and compare it with the position array so to choose which direction of motion will give the shortest time before the measurement begin.

Future perspectives
In the near future we plan to upgrade the software to version 3.0 with three main improvements (and many minor adjustments). First, the system will be able to perform individual separated measurements, saved in separated individual files, for a given list of static parameters. For example, we can now scan the signal as a function of the input polarization, and we can then fix one specific angle and run a time-scan or a wavelength-scan. In the future it will be possible to programmatically set two or more angles (and other parameters as well) and run subsequent separate measurements for every single parameter.
The second improvement goes in the direction of greatly reducing the measurement time. We bought a new Delay Line which is capable of reading the stage position on-the-fly while the stage moves. Those positions are recorded in a buffer and they can be read all together in the dead-time which the motor employs to stop the stage and start to scan in the opposite direction. The system can therefore work continuously without the need to make stop-and-go movements. The challenge here is represented by the need to link the physical position of the stage in real time, to the time at which the signal is actually measured, and this requires a very fine and precise synchronization of the digital clock with the laser trigger.
Finally, a major rearrangement of the whole software architecture is needed in order to bring the loops out of the event structure. A simple state machine will contain the measurement loops, while the event structure will drive the state machine. This rearrangement is not critical because our current architecture has proved itself to be very robust (the software crashes very rarely, if ever), but we have in mind to do so because it will be much easier to work on the software when it is necessary to add/change any component, and also in order to have a much more "clean" block diagram.


Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness

The vulnerability of deep neural networks to adversarial examples has motivated an increasing number of defense strategies for promoting model robustness. However, the progress is usually hampered by insufficient robustness evaluations. As the de facto standard to evaluate adversarial robustness, adversarial attacks typically solve an optimization problem of crafting adversarial examples with an iterative process. In this work, we propose a Model-Agnostic Meta-Attack (MAMA) approach to discover stronger attack algorithms automatically. Our method learns the optimizer in adversarial attacks parameterized by a recurrent neural network, which is trained over a class of data samples and defenses to produce effective update directions during adversarial example generation. Furthermore, we develop a model-agnostic training algorithm to improve the generalization ability of the learned optimizer when attacking unseen defenses. Our approach can be flexibly incorporated with various attacks and consistently improves the performance with little extra computational cost. Extensive experiments demonstrate the effectiveness of the learned attacks by MAMA compared to the state-of-the-art attacks on different defenses, leading to a more reliable evaluation of adversarial robustness.

INTRODUCTION
Deep neural networks are vulnerable to the maliciously crafted adversarial examples (Biggio et al., 2013;Szegedy et al., 2014;Goodfellow et al., 2015), which aim to induce erroneous model predictions by adding small perturbations to the normal inputs. Due to the threats, a multitude of defense strategies have been proposed to improve adversarial robustness (Kurakin et al., 2017b;Madry et al., 2018;Wong & Kolter, 2018;Dong et al., 2020a;Pang et al., 2020). However, many defenses have later been shown to be ineffective due to incomplete or incorrect robustness evaluations (Athalye et al., 2018;Uesato et al., 2018;Carlini et al., 2019;Croce & Hein, 2020b;Dong et al., 2020b;Tramer et al., 2020), making it particularly challenging to understand their effects and identify the actual progress of the field. Therefore, developing methods that can evaluate adversarial robustness accurately and reliably is of profound importance.
Adversarial attacks are broadly adopted as an indispensable solution to evaluate adversarial robustness for different models. One of the most prominent attacks is the projected gradient descent (PGD) method (Madry et al., 2018), which generates an adversarial example by performing iterative gradient updates to maximize a classification loss (e.g., cross-entropy loss) w.r.t. the input. Although recent methods improve upon PGD by introducing different loss functions (Carlini & Wagner, 2017;Gowal et al., 2019;Croce & Hein, 2020b;Sriramanan et al., 2020) and adjusting the step size (Croce & Hein, 2020b), most of them adopt hand-designed optimization algorithms, such as vanilla gradient descent, momentum (Polyak, 1964), and Adam (Kingma & Ba, 2015). However, it has been shown that these attacks can be sub-optimal (Croce & Hein, 2020b;Tramer et al., 2020), arousing an overestimation of adversarial robustness for some defenses. It is thus imperative to develop more effective optimization algorithms for improving adversarial attacks. Nevertheless, designing a generic optimization algorithm in a hand-crafted manner is non-trivial, considering the different defense models with varying network architectures, defense strategies, and training datasets.
To overcome this issue and develop stronger adversarial attacks, in this paper, we propose a Model-Agnostic Meta-Attack (MAMA) approach to learn optimization algorithms in adversarial attacks automatically. In particular, we parameterize the optimizer with a recurrent neural network (RNN) to mimic the behavior of iterative attacks, which outputs an update direction at each time step during adversarial example generation. By learning to solve a class of optimization problems with different data samples and defense models, the RNN optimizer could benefit from long-term dependencies of iterative attacks and exploit common structures among the optimization problems. To improve and stabilize training, we then propose a prior-guided refinement strategy, which imposes a prior given by the PGD update rule on the outputs of the RNN optimizer, whose parameters are trained via the maximum a posteriori (MAP) estimation framework. Consequently, the RNN optimizer can learn to yield more effective update directions than hand-designed ones.
Despite the effectiveness, the learned optimizer may not generalize well to attacking unseen defenses due to potential overfitting to the defenses used for training. Although training a different optimizer for each defense is possible, the training process can be time-consuming and inconvenient in practice when it is utilized to benchmark adversarial robustness. To endow the learned optimizer with a better generalization ability, we develop a model-agnostic training algorithm with a gradient-based metatrain and meta-test process to simulate the shift from seen to unseen defenses. Therefore, the learned optimizer can directly be deployed to attack unseen defenses without retraining or fine-tuning.
Extensive experiments validate the effectiveness and generalization ability of the learned optimizers for attacking different defense models. We also demonstrate the flexibility of our method integrating with various attacks, including those with different loss functions (Carlini & Wagner, 2017;Gowal et al., 2019;Croce & Hein, 2020b) and initialization (Tashiro et al., 2020). Our method consistently improves the attacking performance over baselines, while introducing little extra computational cost. By incorporating our method with an orthogonal technique -output diversified initialization (ODI) (Tashiro et al., 2020), we achieve lower robust test accuracy on all 12 defense models that we study than other state-of-the-art attacks, including the MultiTargeted (MT) attack (Gowal et al., 2019) and AutoAttack (Croce & Hein, 2020b), leading to a more reliable evaluation of adversarial robustness. Moreover, MAMA provides a plug-and-play module in adversarial attacks, which may benefit future adversarial attacks if new improvements have been made in different aspects.

ADVERSARIAL ATTACKS
Let f (x) : x ∈ R D → z ∈ R K denote a classifier, which outputs the logits z := [z 1 , ..., z K ] over K classes for an input image x. The prediction of f is C f (x) = arg max i=1,...,K z i . Given the true label y of x, adversarial attacks aim to generate an adversarial examplex that is misclassified by f (i.e., C f (x) = y), while the distance between the adversarial examplex and the natural one x measured by the ∞ norm is smaller than a threshold as x − x ∞ ≤ . Although we introduce our approach based on the ∞ norm only, the extension to other p norms is straightforward. The adversarial examplex can be generated by solving a constrained optimization problem aŝ where L is a loss function on top of the classifier f (x). For example, L could be the cross-entropy loss as L ce (f (x), y) = − log p y where p y = e zy / K i=1 e z i denotes the predicted probability of class y, or the margin-based CW loss (Carlini & Wagner, 2017) as L cw (f (x), y) = max i =y z i − z y .
A lot of gradient-based methods (Goodfellow et al., 2015;Kurakin et al., 2017a;Carlini & Wagner, 2017;Madry et al., 2018; have been proposed to solve this optimization problem. The projected gradient descent (PGD) method (Madry et al., 2018) performs iterative updates aŝ where B (x) = {x : x − x ∞ ≤ } denotes the ∞ ball centered at x with radius , Π(·) is the projection operation, and α t is the step size at the t-th attack iteration. PGD initializesx 0 randomly by uniform sampling within B (x) and adopts a fixed step size α in every iteration.
To develop stronger attacks for reliable robustness evaluation, recent improvements upon PGD include adopting different loss functions (Gowal et al., 2019;Croce & Hein, 2020b;Sriramanan et al., 2020), adjusting the step size (Croce & Hein, 2020b), and designing sampling strategies of initialization (Tashiro et al., 2020). For the update rules, besides the vanilla gradient descent adopted in PGD, recent attacks Gowal et al., 2019) suggest to use the momentum (Polyak, 1964) and Adam (Kingma & Ba, 2015) optimizers. In contrast, we aim to enhance adversarial attacks by learning optimization algorithms in an automatic way.

ADVERSARIAL DEFENSES
To build robust models against adversarial attacks, numerous defense strategies have been proposed, but most defenses can be evaded by new adaptive attacks (Athalye et al., 2018;Tramer et al., 2020). Among the existing defenses, adversarial training (AT) is arguably the most effective defense technique, in which the network is trained on the adversarial examples generated by attacks. Based on the primary AT frameworks like PGD-AT (Madry et al., 2018) and TRADES , improvements have been made via ensemble learning (Tramèr et al., 2018;Pang et al., 2019), metric learning (Mao et al., 2019;Pang et al., 2020), semi-supervised learning (Alayrac et al., 2019;Zhai et al., 2019), and self-supervised learning (Chen et al., 2020a;Kim et al., 2020). Due to the high computational cost of AT, other efforts are devoted to accelerating the training procedure (Shafahi et al., 2019;Wong et al., 2020;. Recent works emphasize the training tricks (e.g., weight decay, batch size, etc.) in AT (Gowal et al., 2020;Pang et al., 2021). However, it has been shown that the robust test accuracy of numerous adversarially trained models can be degraded significantly by using stronger attacks (Croce & Hein, 2020b;Tramer et al., 2020), indicating that the reliable evaluation of adversarial robustness remains an imperative yet challenging task. In this paper, we focus on evaluating adversarial robustness of AT models due to their superior robustness over other defense techniques.

META-LEARNING
Meta-learning (learning to learn) studies how to learn learning algorithms automatically from a meta perspective, and has shown promise in few-shot learning (Finn et al., 2017) and learning optimizers (Andrychowicz et al., 2016). The latter is called learning to optimize (L2O). The first L2O method leverages a coordinate-wise long short term memory (LSTM) network as the optimizer model, which is trained by gradient descent on a class of optimization problems (Andrychowicz et al., 2016). The optimizer can also be trained by reinforcement learning (Li & Malik, 2017). Bello et al. (2017) propose to adopt an RNN controller to generate the update rules of optimization algorithms, which can be described as a domain specific language. L2O is then extended to efficiently optimize black-box functions (Chen et al., 2017). Recent methods focus on improving the training stability and generalization of the learned optimizers by designing better optimizer models and training techniques (Lv et al., 2017;Wichrowska et al., 2017;Chen et al., 2020b).
The general idea of meta-learning has been investigated in adversarial attacks. Most related methods learn to generate adversarial examples by using convolutional neural networks (CNNs), which usually take clean images as inputs and return adversarial examples/perturbations (Baluja & Fischer, 2017;Poursaeed et al., 2018). Differently, our method adopts an RNN model as the attack optimizer to mimic the behavior of iterative attacks. Empirical results validate the superiority of our approach compared to the CNN-based generators. Meta-learning has also been used in black-box attacks (Du et al., 2020) and AT defenses (Xiong & Hsieh, 2020;Jiang et al., 2021). It is noteworthy that Xiong & Hsieh (2020) propose a similar approach to ours that uses an RNN optimizer to learn attacks for AT. Although the RNN optimizer is also adopted in our approach, we improve the attacking performance and generalization ability of the RNN optimizer with new techniques, as presented in Sec. 3. More detailed comparisons between our work and Xiong & Hsieh (2020) are shown in Appendix A.

METHODOLOGY
In this paper, we propose a Model-Agnostic Meta-Attack (MAMA) approach to improve adversarial attacks by learning optimization algorithms automatically. MAMA permits learning to exploit common structures of the optimization problems (1) over a class of input samples and defense models. We first present the instantiation of the learned optimizer with a recurrent neural network (RNN) and the corresponding training procedure in Sec. 3.1. The learned optimizer is expected to not only perform well on the data samples and defenses for which it is trained but also possess an excellent generalization ability to other unseen data samples, defenses, and more optimization steps (i.e., attack iterations) than training. Therefore, we propose a model-agnostic training algorithm simulating train/test shift to ensure generalization of the learned optimizer, as detailed in Sec. 3.2. An overview of our proposed MAMA approach is provided in Fig. 1.

META-ATTACK WITH RECURRENT NEURAL NETWORKS
Different from the existing attack algorithms, we propose a meta-attack that learns an optimizer in adversarial attacks parameterized by an RNN model m φ with parameters φ to mimic the behavior of iterative attacks. The learned optimizer is capable of optimizing the loss function L in Eq. (1) for different data samples (x, y) and defense models f . At each step, m φ takes gradient information of the loss function (1) at the current adversarial example as input and outputs an update direction for generating the adversarial example. This procedure can be expressed aŝ where α t is the step size, ∇ t = ∇ x L(f (x t ), y) denotes the gradient of the loss function L atx t , and h t denotes the hidden state representation of the optimizer, which contains rich temporal gradient information to capture long-term dependencies. The output g t of the RNN model is used to update the adversarial examplex t . We apply a tanh transformation to the last layer of the RNN model to normalize and smoothen the update direction g t since the adversarial perturbations are required to be smaller than the threshold . In particular, we adopt the coordinate-wise long short term memory (LSTM) network (Andrychowicz et al., 2016) as the RNN model m φ , which can significantly reduce trainable parameters, making training much easier and faster.
Given a distribution F over defenses f and a data distribution D over (x, y) pairs, the parameters φ can be trained by maximizing the expected loss over the entire trajectory of optimization as wherex t is obtained by the optimizer model m φ through Eq. (3), w t ∈ R ≥0 is the weight for the loss at the t-th step to emphasize different importance on the loss at different steps, and T is the total number of optimization steps. For example, we could let w t = 1[t = T ] to focus on the loss at the final adversarial example since it would be used to attack the classifier, but using a different setting for w t can make training easier. For training the optimizer network m φ , we can maximize the objective (4) using gradient ascent on φ. The expectation in Eq. (4) is approximated by mini-batches of randomly sampled defense models f and data points (x, y). The gradient w.r.t. φ is calculated by truncated backpropagation. Besides the general framework of learning to optimize (Andrychowicz et al., 2016;Chen et al., 2020b;Xiong & Hsieh, 2020), there exist particular challenges in training the optimizer due to the optimization problem of adversarial attacks as illustrated below.
Vanishing gradient problem. Note that the optimization problem (1) is a constrained one, which is different from unconstrained problems commonly studied in previous works (Andrychowicz et al., 2016;Chen et al., 2020b;Lv et al., 2017;Wichrowska et al., 2017). As in Eq.
(3), we need to project the adversarial example onto the ∞ ball B (x) after every optimization step, which is essentially the clip function. However, optimizing Eq. (4) requires backpropagation through the clip function, which can result in a number of zero gradient values when the update exceeds the ∞ ball. This can consequently lead to the vanishing gradient problem for a long optimization trajectory. To address this problem, we apply the straight-through estimator (Bengio et al., 2013) to get an approximate gradient of the clip function as ∇ x Π B (x) (x ) = I, where I denotes the identity matrix. In this way, the optimizer can effectively be trained to optimize the constrained problem (1).
Training instability problem. Training the learned optimizer may suffer from an instability problem (Chen et al., 2020b), leading to unsatisfactory performance. To further stabilize training of the learned optimizer m φ and improve its performance, we propose a prior-guided refinement strategy which leverages an informative prior to refine the outputs of the optimizer. In particular, the prior is given by the PGD update rule (Madry et al., 2018) which performs generally well on many defenses. We specify the prior distribution of g t to be an isotropic Gaussian distribution as N (sign(∇ t ), 1 2λt ), whose mean is the PGD update direction sign(∇ t ). The variance of the distribution is 1 /2λt with λ t being a hyperparameter. Under the maximum a posteriori (MAP) estimation framework, the objective function (4) can be viewed as the likelihood while the prior is equivalent to minimizing the squared 2 distance as λ t g t − sign(∇ t ) 2 2 . We provide a formal derivation of MAP in Appendix B. Therefore, the overall objective function of training the optimizer becomes where {λ t } T t=1 can be seen as another set of weights corresponding to the regularization terms at each step. In this way, the optimizer can learn from the informative prior given by the PGD update rule and explore potential better directions simultaneously. To maximize the objective function (5), a basic technique is using gradient ascent on φ. We call it Basic Meta-Attack (BMA).

MODEL-AGNOSTIC META-ATTACK ALGORITHM
To make robustness evaluation more convenient after training, the learned optimizer should generalize well to new data samples, defense models, and more optimization steps that are not seen during training. In practice, we observe that the data-driven process of optimizing Eq. (5) (i.e., BMA) enables to obtain a generalizable optimizer on new data samples with more optimization steps, but the learned optimizer may not necessarily generalize well to new defenses, as shown in Sec. 4.3. This is because the defenses usually adopt different network architectures and defense strategies, making it hard for an attack optimizer to generalize well across a variety of defenses (Tramer et al., 2020).
To improve the generalization ability of the learned optimizer when attacking unseen defenses, we propose a model-agnostic training algorithm for meta-attack (i.e., MAMA). This method simulates the shift between defenses during training with a gradient-based meta-train and meta-test procedure, inspired by model-agnostic meta-learning (Finn et al., 2017;. After MAMA training, the learned optimizer can directly be used to attack unseen defenses, which will be more convenient and user-friendly for carrying out robustness evaluation once novel defense methods are presented. Specifically, assume that we have a set of N defenses (denoted as F) in training, where we reuse the notation F without ambiguity. To simulate the shift between defense models in training and testing, at each training iteration we split F into a meta-train setF of N − n defenses and a meta-test setF of the other n defenses. The model-agnostic training objective is to maximize the loss J (φ;F, D) on the meta-train defenses, while ensuring that the update direction of φ also leads to maximizing J (φ;F, D) on the meta-test defenses, such that the learned optimizer will perform well on true test defenses. During meta-train, the optimizer parameters φ are updated by the one-step gradient ascent where β is the meta-train learning rate. During meta-test, we expect the updated parameters φ to exhibit a good generalization performance on the meta-test defenses, which indicates that J (φ ;F, D) is also maximized. The meta-train and meta-test can be optimized simultaneously as Algorithm 1 Model-Agnostic Meta-Attack (MAMA) algorithm Require: A data distribution D over (x, y) pairs, a set of defense models F = {fj} N j=1 , the objective function J in Eq. (5), attack iterations T , batch size B, learning rates β, γ, balancing hyperparameter µ. Ensure: The parameters φ of the learned optimizer.
1: for iter = 1 to MaxIterations do 2: Randomly draw N − n defenses from F to getF, and letF = F\F consist of the other n defenses; 3: for fr inF do Meta-train 4: Randomly draw a mini-batch For (x r i , y r i ) ∈ Br, computex r i t from φ for defense fr by Eq. (3) for t = 1 to T ; 6: end for 7: Compute J (φ;F, D) using the defenses fr inF and the corresponding mini-batches Br; 8: for fe inF do Meta-test 10: Randomly draw a mini-batch For (x e i , y e i ) ∈ Be, computex e i t from φ for defense fe by Eq.
(3) for t = 1 to T ; 12: end for 13: Compute J (φ ;F, D) using the defenses fe inF and the corresponding mini-batches Be; 14: φ ← φ + γ∇ φ (J (φ;F, D) + µJ (φ ;F, D)); 15: end for where µ is a hyperparameter to balance the meta-train loss and the meta-test loss. The objective (6) is optimized by gradient ascent. After accumulating the gradients from meta-train and meta-gradients from meta-test, the optimizer is trained to perform well on attacking both meta-train and meta-test defenses. The gradient and meta-gradient flows in the computation graph are illustrated in Fig. 1(b). We summarize the overall MAMA algorithm in Alg. 1.

EXPERIMENTS
In this section, we present the experimental results to validate the effectiveness of BMA and MAMA for adversarial attacks. We follow a simple-to-complex procedure to conduct experiments. Sec. 4.2 first shows the advantages of the learned optimizer in BMA when considering one defense at a time. Sec. 4.3 then proves that the learned optimizer possesses good cross-data, cross-iteration, and cross-model generalization abilities, respectively. Sec. 4.4 demonstrates that BMA and MAMA can achieve state-of-the-art performance by comparing with various top-performing attacks on 12 defense models. More details about the baseline attacks and defenses are provided in Appendix C and D, respectively. We mainly present the results based on the ∞ norm in this section. The results based on the 2 norm and standard deviations of multiple runs are provided in Appendix E.

EXPERIMENTAL SETUP
The hyperparameters of baseline attacks are set according to the common practice or their original implementations. Specifically, in Sec. 4.2 and Sec. 4.3, we set the attack iterations as T = 20 and the fixed step size as α = 2/255 according to (Madry et al., 2018). The learned optimizer in our method also adopts the same setting for fair comparison. In Sec. 4.4, we adopt the official hyperparameter configurations of the baseline attacks since we assume that their hyperparameters have been tuned appropriately. Our BMA and MAMA attacks follow a similar setup with 100 iterations, 20 random restarts, and ODI initialization. In all experiments, we use a two-layer LSTM with 20 hidden units in each layer as the optimizer model. We set w t = 1 and λ t = 0.1 in Eq. (5) and study different λ t through an ablation study. We set the learning rates as β = 0.0001 and γ = 0.001 in MAMA with µ = 1.0. The mini-batch size is B = 32.

EFFECTIVENESS AND ADAPTIVENESS OF BMA
We first train a different attack optimizer for each defense by BMA. We consider four typical AT defenses on CIFAR-10 ( Comparison with hand-designed optimizers. Since most existing adversarial attacks adopt handdesigned optimizers, we first compare the performance of our learned optimizer with these handdesigned ones. Specifically, we adopt the CW loss (Carlini & Wagner, 2017) (Uesato et al., 2018;Gowal et al., 2019)). Besides, we also adopt a CNN-based adversarial example generation method (Adv-CNN) (Baluja & Fischer, 2017) for comparison. We report the classification accuracy of the four defenses against these attacks in Table 1. We can see that BMA with the learned optimizer leads to lower accuracy of the defense models than the existing attacks, demonstrating that BMA can discover stronger adversarial attacks automatically.
Ablation study of the prior-guided refinement strategy. We conduct an ablation study to investigate the effects of the prior-guided refinement strategy introduced in Sec. 3.1. Fig. 2 shows the accuracy of HYDRA along the training iterations of BMA with λ t := λ = 0.0, 0.01, 0.1, 0.5, and 1.0, respectively. After integrating the PGD update rule as a prior with λ > 0, the learned optimizer achieves faster convergence and better performance than that with λ = 0. The results indicate that the proposed prior-guided refinement strategy can benefit from the informative prior given by the PGD update rule and explore potential better update directions simultaneously. Moreover, as λ increases, to a certain extent the convergence tends to be faster, but the performance tends to be similar. Therefore, we select λ = 0.1 for all experiments in the training phase of BMA.
Adaptiveness. The learned optimizer is generally compatible with previous methods on improving adversarial attacks in different aspects. To verify this, we incorporate our method with PGD variants using the cross-entropy loss (PGD CE ) (Madry et al., 2018), the difference of logits ratio loss (PGD DLR ) (Croce & Hein, 2020b) and PGD DLR with varying step size (APGD DLR ) (Croce & Hein, 2020b), the MultiTarged (MT) attack (Gowal et al., 2019) that performs targeted attack for each class, and the output diversified initialization method (Tashiro et al., 2020) with 10 random restarts (ODI-R10). Note that these methods only change the loss function L or the starting pointx 0 , which do not affect the learning process of BMA. Table 2 shows the results of the baseline methods and their extensions by integrating with the learned optimizer in BMA. The results verify that integrating BMA can consistently enhance the performance of each method. The mechanism of combining BMA is concise and easy to implement, yet steadily improving the different attack methods.

GENERALIZATION EVALUATION
Cross-data generalization. We first evaluate the cross-data generalization ability of the learned optimizer in BMA on unseen data points. Specifically, we randomly select 1, 000, 2, 000, 5, 000, and all 10, 000 data points from the CIFAR-10 test set as the training set for BMA, respectively, and adopt the entire test set of CIFAR-10 for evaluation. The performance on the entire test set is shown in Fig. 3. We can see that the learned optimizers using different numbers of data points achieve similar attack performance on the four defense models, indicating that the data-driven procedure enables the learned optimizer to obtain a good generalization ability to new unseen data samples.
Cross-iteration generalization. We then evaluate the generalization ability of the learned optimizer in BMA to more attack iterations than training. Fig. 4 shows the curves of model accuracy w.r.t. the number of attack iterations ranging from 1 to 100. We also mark the number of iterations used for training BMA at 20. The results on four defense models verify that BMA can consistently outperform the baseline attacks with varying attack iterations. It demonstrates that the learned optimizers also have a good generalization ability across attack iterations.
Cross-model generalization. The training process may face inconvenience in practice when training a different optimizer for each defense. A better property of the learned optimizer is more generalizable for adversarial attacks on any unseen defenses. We thus consider the challenging and practical scenario -training the optimizer on several available defense models and evaluating its generalization ability to other unseen defense models. This setting requires the optimizer to learn more general knowledge for adversarial attacks. For choosing the defense models in training, we mainly consider using a set of diverse defenses. Thus we randomly sample four models to train the optimizer from TRADES (T)  , AWP (A) , Unlabeled (U) , Hydra (H) (Sehwag et al., 2020), and SAT (S) (Huang et al., 2020). MAMA randomly selects three defenses as meta-train and the other one as meta-test in each iteration. We compare MAMA with two BMA variants. The first one trains an optimizer for each training defense and chooses the best optimizer for evaluation (BMA bs ), and the second one optimizes Eq. (5) using the training defenses as an ensemble (BMA en ). Table 3 shows that MAMA is more effective than the two methods, indicating that the generalization ability of the optimizer can be improved by adopting the model-agnostic algorithm. The effect of meta-test components is listed in Appendix E.3.

COMPARISON WITH STATE-OF-THE-ART ATTACKS
In this section, we perform a large-scale experiment to compare the performance of our methods with various state-of-the-art attacks for robustness evaluation of 12 defense models on CIFAR-10. We consider both BMA that learns a different attack optimizer for each defense model and MAMA that only learns one generalizable optimizer adopting the model-agnostic training algorithm to test all defenses. We compare our methods with several typical and state-of-the-art attacks, including 1) PGD CE (Madry et al., 2018), 2) PGD CW , 4) APGD (Croce & Hein, 2020b) with the DLR loss, 3) MT, 5) AutoAttack (AA) (Croce & Hein, 2020b), and 6) ODI (Tashiro et al., 2020). PGD CE , Table 4: Classification accuracy (%) of different defenses on CIFAR-10 under various white-box attacks. The defenses marked with † adopt additional unlabeled datasets. The defenses marked with * adopt = 0.031 as originally reported, and the others adopt = 8/255. ∆ represents the difference between reported accuracy and testing accuracy by ours. We also present the complexity (forward times) of each attack method in blue.  PGD CW , and ODI use 100 iterations with step size 2/255 and 20 restarts. APGD also uses the same iterations and restarts. MT performs targeted attacks for 9 classes except the true one with 2 restarts and 100 attack iterations. We adopt the official implementation of AA. We integrate our methods with ODI to establish stronger attacks. Our methods also use 100 attack iterations with 20 ODI restarts. MAMA is trained on defense models {T,A,U,H} with the model-agnostic algorithm. Table 4 shows the classification accuracy of these defense models against different adversarial attacks. We also show the clean accuracy and the reported robust accuracy of these models in the corresponding papers. Our methods achieve lower robust test accuracy on all 12 defense models than the baseline attacks, including MT and AA, demonstrating that ours can discover stronger adversarial attacks automatically than the existing attacks with hand-designed optimizers. Meanwhile, our methods are not only stronger but also less complex than AA. Besides, the results also demonstrate that MAMA can achieve a comparable performance of BMA, showing that the learned optimizer has a good generalization ability to unseen defense models due to the involved model-agnostic training algorithm, and could be flexibly used to evaluate the robustness of future defenses. Robustness evaluation on other datasets. We directly apply the learned optimizer in MAMA on CIFAR-10 to evaluate adversarial robustness on CIFAR-100 (Krizhevsky & Hinton, 2009) and ImageNet (Deng et al., 2009), without updating the optimizer by new datasets or defenses. We adopt = 8/255 on CIFAR-100 and = 4/255 on ImageNet. During testing, there is a significant shift between training and testing defense models for MAMA. Despite these difficulties, MAMA can consistently improve the performance on most defenses in Table 5. The results verify that MAMA obtains a good generalization ability for adversarial attacks on unseen datasets, benefiting from the data-driven learning procedure automatically.

Defense
Running time. Fig. 5 shows the running time of AA, ODI, and BMA (MAMA) based on a single RTX 2080-Ti GPU. BMA is slightly slower than the baseline ODI, but significantly faster than AA.

CONCLUSION
In this paper, we propose a Model-Agnostic Meta-Attack (MAMA) approach to automatically discover stronger attack algorithms. Specifically, we learn an optimizer in adversarial attacks parameterized by an RNN model, which is trained over a class of data samples and defense models to produce effective update directions for crafting adversarial examples. We further develop a modelagnostic learning approach with a gradient-based meta-train and meta-test procedure to improve the generalization ability of the learned optimizer to unseen defense models. Extensive experimental results demonstrate the effectiveness, adaptiveness, and generalization ability of MAMA on different defense models, leading to a more reliable evaluation of adversarial robustness.
A MORE DISCUSSIONS ON RELATED WORK Xiong & Hsieh (2020) propose a similar approach to ours that uses an RNN optimizer to learn attacks for adversarial training. The differences between our method and Xiong & Hsieh (2020) are three-fold. First, the motivations are different: we propose to discover stronger adversarial attack algorithms while they aim to learn robust models by adversarial training. Second, based on the different goals, the techniques are different: we develop a prior-guided refinement strategy and a model-agnostic training algorithm to improve the attacking performance and generalization ability of the RNN optimizer while they do not adopt these techniques and use a relatively smaller number of attack iterations (i.e., T = 10). Third, the empirical evaluations are different: we mainly conduct experiments to show the attack performance on various defense models while they mainly consider the defense performance of adversarial training. Overall, our method differs from Xiong & Hsieh (2020) in the aspects of motivation, technique, and experiment. Despite using a similar Learningto-Learn framework, our method has its own contributions in developing an effective attack method for evaluating adversarial robustness.

B EXPLANATION OF MAXIMUM A POSTERIORI
Assume that the output of the RNN optimizer is a random variable g t . The objective of the optimizer is to maximize the loss L atx t after applying g t , as in Eq. (3). By using the cross-entropy loss as L, we actually want to minimize p y (i.e., the probability of the true class) givenx t . We let p(y|g t ) = 1 py such that we want to maximize p(y|g t ). Thus p(y|g t ) can be viewed as the conditional likelihood. By assuming the prior distribution of g t to be a Gaussian one as p(g t ) ∼ N (sign(∇ t ), 1 2λt ), we can estimate the posterior distribution of g t using Bayes' theorem p(g t |y) ∼ p(y|g t )p(g t ).
Under the maximum a posteriori (MAP) framework, we would like to solve arg max log p(g t |y) = arg max{− log p y + λ t g t − sign(∇ t ) 2 2 } = arg max{L(f (x t ), y) − sign(∇ t ) 2 2 }. Be accumulating the loss at each step, we can obtain Eq. (5).

C TECHNICAL DETAILS OF ADVERSARIAL ATTACKS
In this section, we introduce more related backgrounds and technical details for reference.
PGD. One of the most commonly studied adversarial attacks is the projected gradient descent (PGD) method (Madry et al., 2018). PGD iteratively crafts the adversarial example aŝ where B (x) = {x : x − x ∞ ≤ } denotes the ∞ ball centered at x with radius , Π(·) is the projection operation, and α t is the step size at the t-th attack iteration. L could be the cross-entropy loss as L ce (f (x), y) = − log p y where p y = e zy / K i=1 e z i denotes the predicted probability of class y, or the margin-based CW loss (Carlini & Wagner, 2017) as L cw (f (x), y) = max i =y z i − z y .  propose to adopt the momentum optimizer (Polyak, 1964) in adversarial attacks, which can be formulated as

MI-FGSM.
where α is a fixed step size and µ is a hyperparameter.
NI-FGSM. Lin et al. (2019) propose to adopt the Nesterov accelerated gradient (Nesterov, 1983) in adversarial attacks, as tion. Specifically, we adopt the CW loss (Carlini & Wagner, 2017) and set = 0.1. We compare our learned optimizer (in BMA) with vanilla gradient descent (used in PGD (Madry et al., 2018)), momentum (Polyak, 1964) (used in MI-FGSM ), nesterov accelerated gradient (Nesterov, 1983) (used in NI-FGSM (Lin et al., 2019)), and Adam (Kingma & Ba, 2015) (used in (Gowal et al., 2019;Uesato et al., 2018)). For fair comparison, we set the attack iterations as T = 20 and the fixed step size as α = 0.025 in all methods. The learned optimizer in BMA is trained with 20 attack iterations on the entire test set of CIFAR-10. We report the classification accuracy of the two defenses including Overfitting (Rice et al., 2020) and Robustness (Engstrom et al., 2019) against these attacks in Table 7. BMA with the learned optimizer leads to lower accuracy of the defense models than the existing attacks with hand-designed optimizers, demonstrating the effectiveness of BMA based on the 2 norm.

E.2 RANDOMNESS EXPERIMENTS
To avoid the randomness caused by a single experiment, we report the standard deviations of multiple runs on CIFAR-10 in Table 8. We can see that the learned optimizers using different runs achieve similar attack performance on the four defense models including HYDRA (Sehwag et al., 2020), Pre-training , Overfitting (Rice et al., 2020) and FastAT (Wong et al., 2020). The results also demonstrate the stability of BMA to existing attacks. Effect of different µ. The meta-train and meta-test can be optimized simultaneously as Eq. (6), and µ is the hyperparameter to balance the meta-train and meta-test losses. To estimate the effect of different µ, we sample four models to train the optimizer from TRADES (T), AWP (A), Unlabeled (U), Hydra (H), and SAT (S), and test the performance on Pre-Training for different µ. We can see in Table 9, a proper value 1.0 gives the best performance, indicating that the meta-train and meta-test should be equally learned. Effect of different numbers of meta-train and meta-test. Apart from the results based on different hyparameters, we study the effectiveness for different numbers of meta-train and meta-test. In the experiments, we attempt to sample m domains as meta-train, and remaining n domains as meta-test, thus named Sm-Tn. We report the classification accuracy of the defense model on different numbers of domains in Table 10. We can see that the best performance can be obtained by setting m as 3 and n as 1, which is also adopted in all experiments of MAMA. We also attempt to apply the automatic step size scheduler (Croce & Hein, 2020b) to MAMA in Table 11, which adopts 100 iterations and 20 restarts based on ODI on the different defenses including TRADES , Pre-training , HYDRA (Sehwag et al., 2020). The results show that integrating the automatic step size does not further improve the overall performance for robustness evaluation. We think that combining MAMA with ODI can already converge to sufficiently good results for robustness evaluation and may not be improved by integrating other techniques such as automatic step size.