White-Box Evasion Attack under Linf Constraint

Objective

Implement a stronger white-box L_inf attack in bench/custom_attack.py. Your method should maximize attack success rate (ASR) under a strict perturbation budget:

• Threat model: white-box (full model access, including gradients).
• Norm constraint: ||x_adv - x||_inf <= eps.
• Budget: eps = 4/255.

Editable Interface

You must implement:

run_attack(model, images, labels, eps, device, n_classes) -> adv_images

Inputs:

• images: tensor of shape (N, C, H, W), values in [0, 1].
• labels: tensor of shape (N,).
• n_classes: 10 for CIFAR-10, 100 for CIFAR-100.

Output:

• adv_images: same shape as images, also in [0, 1].

Evaluation Protocol

Each evaluation script:

1. Loads one pretrained model.
2. Collects up to 1000 samples that are initially classified correctly.
3. Runs your run_attack.
4. Checks L_inf validity.
5. Reports:
   • clean_acc
   • robust_acc
   • asr = 1 - robust_acc

Important:

• ASR denominator is the number of initially correct samples.
• Invalid adversarial outputs (shape mismatch or violated norm) are treated as failure.

Scenarios

Six scenarios are evaluated in parallel:

• ResNet20 on CIFAR-10
• VGG11-BN on CIFAR-10
• MobileNetV2 on CIFAR-10
• ResNet20 on CIFAR-100
• VGG11-BN on CIFAR-100
• MobileNetV2 on CIFAR-100

Baselines

• fgsm: one-step FGSM baseline (simplest first-order attack).
• pgd: iterative PGD baseline (strong first-order baseline).
• mifgsm: momentum iterative FGSM.
• autoattack: torchattacks.AutoAttack(version="standard") as a strong upper baseline.

Your goal is to improve ASR while respecting the Linf budget.