  The adversarial vulnerability of Deep Neural Networks (DNNs) has been
well-known and widely concerned, often under the context of learning top-$1$
attacks (e.g., fooling a DNN to classify a cat image as dog). This paper shows
that the concern is much more serious by learning significantly more aggressive
ordered top-$K$ clear-box~\footnote{ This is often referred to as
white/black-box attacks in the literature. We choose to adopt neutral
terminology, clear/opaque-box attacks in this paper, and omit the prefix
clear-box for simplicity.} targeted attacks proposed in Adversarial
Distillation. We propose a novel and rigorous quadratic programming (QP) method
of learning ordered top-$K$ attacks with low computing cost, dubbed as
\textbf{QuadAttac$K$}. Our QuadAttac$K$ directly solves the QP to satisfy the
attack constraint in the feature embedding space (i.e., the input space to the
final linear classifier), which thus exploits the semantics of the feature
embedding space (i.e., the principle of class coherence). With the optimized
feature embedding vector perturbation, it then computes the adversarial
perturbation in the data space via the vanilla one-step back-propagation. In
experiments, the proposed QuadAttac$K$ is tested in the ImageNet-1k
classification using ResNet-50, DenseNet-121, and Vision Transformers (ViT-B
and DEiT-S). It successfully pushes the boundary of successful ordered top-$K$
attacks from $K=10$ up to $K=20$ at a cheap budget ($1\times 60$) and further
improves attack success rates for $K=5$ for all tested models, while retaining
the performance for $K=1$.
