Adversarial attack is a technique for deceiving Machine Learning (ML) models, which provides a way to evaluate the adversarial robustness. In practice, attack algorithms are artificially selected and tuned by human experts to break a ML system. However, manual selection of attackers tends to be sub-optimal, leading to a mistakenly assessment of model security. In this paper, a new procedure called Composite Adversarial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms and their hyper-parameters from a candidate pool of \textbf{32 base attackers}. We design a search space where attack policy is represented as an attacking sequence, i.e., the output of the previous attacker is used as the initialization input for successors. Multi-objective NSGA-II genetic algorithm is adopted for finding the strongest attack policy with minimum complexity. The experimental result shows CAA beats 10 top attackers on 11 diverse defenses with less elapsed time (\textbf{6 $\times$ faster than AutoAttack}), and achieves the new state-of-the-art on $l_{\infty}$, $l_{2}$ and unrestricted adversarial attacks.

翻译：Aversarial攻击是一种欺骗机器学习(ML)模型的技术,它为评估对抗性强力提供了一种评估方法。在实践中,攻击算法是人为选择的,由人类专家对攻击算法进行调整,以打破 ML 系统。然而,对攻击者的手工选择往往不够理想,导致对模型安全进行错误的评估。在本文中,提议采用一个称为复合反反对攻击(CAAA)的新程序,以自动搜索攻击算法及其超参数的最佳组合,从候选的\ textbf{332 基地攻击者库中搜索。我们设计了一个搜索空间,将攻击政策作为攻击顺序,即用上一个攻击者的输出作为后继者的初始输入。采用了多目标NSGA-II基因算法,以最复杂程度找到最强的攻击政策。实验结果显示CAAA用较慢的时间(\ textbf{6\timets $$_timets autAttack}11种不同的防御来击击击击手,并取得了新的州-abretial2, $_in}