AutoAttack is a standardized, parameter-free ensemble of adversarial attacks used for reliable robustness evaluation — combining four complementary attacks to provide a rigorous, reproducible assessment that avoids the pitfalls of weak evaluation.

AutoAttack Components

• APGD-CE: Auto-PGD with cross-entropy loss — adaptive step size, no hyperparameter tuning.
• APGD-DLR: Auto-PGD with difference of logits ratio loss — targets the margin between top classes.
• FAB: Fast Adaptive Boundary — finds minimum-norm adversarial examples.
• Square Attack: Score-based black-box attack — catches gradient-masking defenses.

Why It Matters

• Reliable Evaluation: AutoAttack is the standard for trustworthy robustness evaluation — eliminates "defense by obscurity."
• Parameter-Free: No attack hyperparameters to tune — fully reproducible results.
• RobustBench: The official attack for the RobustBench leaderboard — the benchmark for adversarial robustness.

AutoAttack is the ultimate robustness test — a standardized attack ensemble that provides reliable, reproducible adversarial robustness evaluation.