Despite significant progress in designing powerful adversarial evasion attacks for robustness verification, the evaluation of these methods often remains inconsistent and unreliable. Many assessments rely on mismatched models, unverified implementations, and uneven computational budgets, which can lead to biased results and a false sense of security. Consequently, robustness claims built on such flawed testing protocols may be misleading and give a false sense of security. As a concrete step toward improving evaluation reliability, we present AttackBench, a benchmark framework developed to assess the efectiveness of gradient-based attacks under standardized and reproducible conditions. AttackBench serves as an evaluation tool that ranks existing attack implementations based on a novel optimality metric, which enables researchers and practitioners to identify the most reliable and efective attack for use in subsequent robustness evaluations. The framework enforces consistent testing conditions and enables continuous updates, making it a reliable foundation for robustness verification.
In recent years, the growing importance of adversarial robustness has led to the development of
numerous evasion attacks [
Together, these inconsistencies introduce variance that can severely distort robustness assessments, hinder reproducibility, and create a false sense of security. This leads us to a central and urgent question:
To what extent can we trust the evaluation tests used to certify adversarial robustness? If the tools used to evaluate ML systems are flawed or inefective, then any robustness guarantees or certification derived from them may be invalid, potentially exposing users to real-world vulnerabilities.
As a concrete step toward addressing the unreliability of current robustness evaluations, we present AttackBench, a benchmark framework developed to systematically assess the efectiveness and eficiency of gradient-based evasion attacks. AttackBench establishes a standardized and impartial evaluation protocol that enables the identification of attack implementations most capable of revealing a model’s true worst-case vulnerabilities under adversarial conditions. In this context, reliability refers to an attack’s ability to consistently find adversarial perturbations require minimal distortion to successfully mislead the model while respecting a constrained query budget. To support this goal, AttackBench introduces a novel optimality metric, which measures how closely each attack approximates the best empirical solution across a diverse set of models and perturbation budgets. Lastly, based on this metric, AttackBench ranks attack implementations according to their efectiveness and eficiency, providing a principled comparison across diferent threat models. The results are published on a continuously updated online leaderboard1, helping researchers and practitioners select the most reliable and efective attack strategy when evaluating the adversarial robustness of ML models.
Evasion attacks involve manipulating input data at test time to induce misclassification. Examples
include modifying malware code to evade detection (i.e., to be misclassified as legitimate) and generating
adversarial examples in computer vision—images that appear unchanged to humans but deceive deep
learning models [
subject to
((x + , ; ), ‖ ‖)
x + ∈ [
This bi-objective formulation reflects a trade-of between misclassification confidence and minimal
perturbation. Accordingly, evasion attacks fall into two families: fixed-budget attacks aim to maximize
misclassification within a given perturbation bound [ 18], and minimum-norm attacks seek the smallest
perturbation that causes misclassification [
Despite the vast number of adversarial attacks developed, each claiming improved performance over its
predecessors, their evaluation has often lacked standardization across three critical dimensions: (i) the
choice of models and evaluation metrics, (ii) the correctness and consistency of attack implementations,
and (iii) the fairness of computational budgets. With respect to the first dimension, attacks are frequently
evaluated on diferent models and datasets using incompatible success criteria—such as the attack
success rate at a fixed ℓ budget [
ASR() = 1
∑︁ || (x,)∈
I( (x, ) ̸= ∧ ‖xadv − x‖ ≤ ) .
(3)
This metric captures the proportion of input samples in dataset for which the attack successfully
induces misclassification (i.e., (x, ) ̸= ) within the allowed norm constraint (i.e., ‖xadv − x‖ ≤ ).
However, ASR is highly sensitive to the choice of ; an attack may perform well at one value of but
poorly at others, limiting the generality of the conclusions drawn. To overcome the limitations of
pointwise evaluation metrics like ASR, robustness evaluation curves [19] are often used (red curve in
Figure 1 (2)). These curves show the model’s robust accuracy as a function of the perturbation budget .
These curves capture the trade-of between attack strength and the model’s resilience over a continuous
range of perturbation magnitudes, ofering a richer picture of performance than single-point estimates.
A lower area under the robustness evaluation curve means the attack is more efective, as it reduces the
model’s accuracy more quickly. However, this metric depends on the model’s starting (clean) accuracy,
so it can’t be fairly compared across models with diferent initial performance. Concerning the second
dimension, many attacks are re-implemented in public libraries without proper validation against the
original code, often leading to performance degradation or the introduction of subtle bugs [
Lastly, regarding the third dimension, attacks difer significantly in their computational demands.
Some rely on internal restarts [
As a result of all these inconsistencies, researchers and practitioners may unknowingly draw conclusions from flawed comparisons, and thus deploy models with a false sense of security. For example, a model certified as robust under suboptimal evaluation attack may still be easily fooled in practice with more advanced attacks, exposing users and stakeholders to unacceptable risks.
To support the choice of a reliable attack to assess adversarial robustness, we rely on AttackBench, a benchmark framework specifically designed to test and compare the efectiveness of gradient-based attacks under consistent, fair, and reproducible conditions. Developed in prior work [20], AttackBench ofers a structured and extensible platform to assess whether robustness evaluation methods themselves are reliable, i.e., whether they are close to producing the optimal (i.e., smallest) possible adversarial perturbations within a fixed query budget. AttackBench serves as a framework where attacks are evaluated against a common set of models (the model zoo) and datasets, using a fixed query budget that counts both forward and backward passes. At the core of AttackBench is the notion of optimality. Instead of measuring only whether an attack succeeds at a certain perturbation size , AttackBench evaluates how close each attack comes to an empirical best solution, derived by ensembling the results of all tested methods, for . Specifically, for each attack, AttackBench evaluate their local optimality score, which reflects the quality of an attack on a specific model, and the global optimality score, which averages this performance across a diverse set of models. Subsequently, AttackBench utilizes these scores to rank attacks, fostering the identification of those that are both reliable and eficient. Lastly, a key feature of AttackBench is its ability to support continuous updates, enabling an evolving leaderboard and encouraging ongoing contributions from the research community.
The framework is organized into five modular stages, each designed to minimize experimental bias and promote reproducibility, depicted in Figure 1. … 1 …
Sub&set Hashing x1 ,y1 … xj ,yj … xh ,yh A1 … Ai … AN 3
Average Local Optimality for 1, … ,
Σ 5 Ranking Leaderboard for
A1, … , AN based on Global Optimality ……0.4 0.07.595 AAA132
Stage 1 - Model Zoo. AttackBench begins by defining a diverse and extensible model zoo, which includes both robust and standard models. This ensures that attacks are tested across a range of architectures and robustness levels, preventing overfitting to specific models and enabling generalization of benchmarking results.
Stage 2 - Attack Benchmarking. Attacks are executed against each model in the zoo under strict
constraints, producing, for each model-attack configuration, the corresponding robustness evaluation
curve (red curve in Figure 1 (2)). AttackBench wraps each model in a query-tracking interface that counts
both forward and backward passes, ensuring all attacks are evaluated within the same computational
budget. Importantly, it records the best adversarial perturbation found within this budget rather than
returning the result from the last iteration—an improvement over many existing libraries.
Stage 3 – Local Optimality. To enable meaningful comparisons between diferent adversarial attacks,
AttackBench introduces the local optimality metric—a model-agnostic measure of attack efectiveness.
Rather than focusing solely on individual scalar values such as attack success rate at a fixed perturbation
size , this metric evaluates how close an attack comes to the best-known lower bound on robustness,
as estimated by aggregating the results of multiple attacks (blue curve in the Figure 1). Specifically,
local optimality is computed from robustness evaluation curves obtained during Stage 2 of each attack.
Specifically, AttackBench ensembles all attacks run against a given model and constructs an empirical
lower envelope curve representing the best-known attack performance at each perturbation size. The
local optimality score for a specific attack is then calculated as the normalized area under the curve
between the attack’s robustness curve and the lower envelope. Formally, the smaller the area between
these two curves, the closer the attack is to the best-known bound, and the higher its optimality
score. This value is normalized to lie within [
We now summarize the main take-home messages derived from AttackBench [20]. Our benchmarking campaign spans 102 adversarial attacks, evaluated across 2 datasets (CIFAR-10 and ImageNet) and 9 deep neural networks. Lastly, AttackBench ofers a comprehensive perspective on attack performance, eficiency, and implementation fidelity across multiple ℓ threat models.
Overall Attack Performance. Our large-scale evaluation using AttackBench yields several critical insights into the reliability and practical utility of gradient-based adversarial attacks. First and foremost, our results confirm that a small subset of attacks, i.e., -zero, DDN, PDPGD, and APGD, consistently outperform others across both CIFAR-10 and ImageNet benchmarks. These attacks exhibit high optimality scores and produce robustness evaluation curves that closely track the empirical best attack. Efectiveness-Eficiency Tradeofs. Another central observation concerns the efectiveness-eficiency tradeofs. While high optimality scores are desirable, they do not always imply computational eficiency. For instance, although APGD demonstrates strong optimality, it incurs higher computational costs compared to PDPGD, especially on high-dimensional datasets like ImageNet. Conversely, attacks such as VFGA deliver remarkable speed due to early stopping but sufer a notable drop in attack success rate and optimality when scaled to more complex models.
Implementation Variability. Equally important are the discrepancies observed across diferent implementations of the same attack. Our benchmark reveals significant variations in performance depending on the source library. For example, the APGD attack implemented in the AdvLib library or its original repository achieves optimal or near-optimal results, whereas the same attack in the ART library shows a drastic performance degradation. Specifically, the optimality drops from 90.9% with the AdvLib implementation to 26% with the ART library on CIFAR-10. We highlight that these inconsistencies are often due to subtle but impactful implementation details, such as the number of restarts or the choice of loss function. These findings underscore the necessity for practitioners to carefully audit attack implementations before using them for model evaluation, as seemingly minor diferences can dramatically alter the perceived robustness of a model.
Implementation Pitfalls. Finally, our benchmark identifies several recurring pitfalls in existing libraries. Some attacks crash under specific conditions (e.g., initialization issues, label index bugs), while others fail to support crucial features such as per-sample evaluations, compromising the usability of attack tools in practice.
In summary, AttackBench provides a robust and actionable foundation for evaluating the trustworthiness of adversarial attacks. Our findings stress the importance of algorithmic design, implementation rigor, and careful tuning when benchmarking model robustness. They also caution against naive reliance on of-the-shelf attack implementations without thorough validation, especially in safety-critical or regulatory contexts.
This work has been partially supported by project FISA-2023-00128 funded by the MUR program “Fondo italiano per le scienze applicate"; the EU—NGEU National Sustainable Mobility Center (CN00000023), Italian Ministry of University and Research Decree n. 1033—17/06/2022 (Spoke 10); the project Sec4AI4Sec, under the EU’s Horizon Europe Research and Innovation Programme (grant agreement no. 101120393); the project ELSA, under the EU’s Horizon Europe Research and Innovation Programme (grant agreement no. 101070617); and projects SERICS (PE00000014) and FAIR (PE0000013) under the MUR NRRP funded by the EU—NGEU.
During the preparation of this work, the authors used Grammarly for spelling check. All substantive research content, methodology, analyses, and conclusions were conceived and developed entirely by the authors. The authors take full responsibility for the publication’s content. [18] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, in: ICLR, 2018. [19] B. Biggio, F. Roli, Wild patterns: Ten years after the rise of adversarial machine learning, Pattern
Recognition 84 (2018) 317–331. [20] A. E. Cinà, J. Rony, M. Pintor, L. Demetrio, A. Demontis, B. Biggio, I. B. Ayed, F. Roli, Attackbench: Evaluating gradient-based attacks for adversarial examples, Proceedings of the AAAI Conference on Artificial Intelligence (2025) 2600–2608. doi: 10.1609/aaai.v39i3.32263.