A practical approach to evaluating the adversarial distance for machine learning classifiers
Georg Siedel Ekagra Gupta Andrey Morozov


Proceedings of the ASME 2024International Mechanical Engineering Congress and Exposition
IMECE2024
November 17–21, 2024 
Portland, OR 
IMECE2024-145280




	Georg Siedel12siedel.georg@baua.bund.de, ekagrag99@gmail.com, 
	Ekagra Gupta2,
	Andrey Morozov2


1Federal Institute for Occupational Safety and Health (BAuA), Dresden, Germany
2University of Stuttgart, Germany

A Practical Approach to Evaluating the Adversarial Distance for Machine Learning Classifiers
    K. Grunthal 1kgrunthal@mpifr-bonn.mpg.de
          V. Venkatraman Krishnan 1
          P. C. C. Freire 1
          M. Kramer 1
          M. Bailes 8,9
          S. Buchner 7
          M. Burgay 5
          A. D. Cameron 8,9
          C.-H.R. Chen 1
          I. Cognard 2,3
          L. Guillemot 2,3
          M. E. Lower 6
          A. Possenti 5
          G. Theureau 2,3,4
          
    September 9, 2024
=======================================================================================================================================================================================================================================================================================================================================================================================================






§ ABSTRACT 
Robustness is critical for machine learning (ML) classifiers to ensure consistent performance in real-world applications where models may encounter corrupted or adversarial inputs. In particular, assessing the robustness of classifiers to adversarial inputs is essential to protect systems from vulnerabilities and thus ensure safety in use. However, methods to accurately compute adversarial robustness have been challenging for complex ML models and high-dimensional data. Furthermore, evaluations typically measure adversarial accuracy on specific attack budgets, limiting the informative value of the resulting metrics.
This paper investigates the estimation of the more informative adversarial distance using iterative adversarial attacks and a certification approach. Combined, the methods provide a comprehensive evaluation of adversarial robustness by computing estimates for the upper and lower bounds of the adversarial distance. We present visualisations and ablation studies that provide insights into how this evaluation method should be applied and parameterised. We find that our adversarial attack approach is effective compared to related implementations, while the certification method falls short of expectations. The approach in this paper should encourage a more informative way of evaluating the adversarial robustness of ML classifiers.






§ INTRODUCTION




Robustness is a prerequisite for the safe and secure implementation of ML in high-risk applications. The recently published proposal for a horizontal European regulation on artificial intelligence (AI), the "AI Act", explicitly addresses robustness as an essential property <cit.>. High-risk AI on the European market will be required to meet certain levels of accuracy, robustness and cybersecurity to ensure a trustworthy and safe application according to Article 15 <cit.>. Robustness is the ability of an AI module to cope with erroneous, noisy, unknown, or adversarially constructed input data <cit.>. Specifically, adversarial robustness (AR) refers to robustness against "attempts to deceive the AI module by means of carefully chosen harmful input" <cit.>. AR can be interpreted as a worst-case scenario for robustness under the threat of an attacker. Thus, AR is required by two of the above-mentioned requirements of the AI Act at the same time: cybersecurity and robustness. The AI Act encourages the development of benchmarks and  measurement methodologies "to address the technical aspects of how to measure the appropriate levels of accuracy, robustness and cybersecurity" <cit.>. However, despite ongoing research and discussion as required by the AI Act <cit.>, there exists a gap in the development of standardised, widely applicable and meaningful measurement methodologies for assessing the robustness of ML systems <cit.>.

Current research typically evaluates adversarial robustness based on accuracy, which requires the prior definition of an attack budget and solely reports a discrete 0-or-1 success rate. Based on the above motivation to develop measures of adversarial robustness, this paper focuses on a less common but more informative metric: (minimal) Adversarial Distance (AD), for which we compute estimates for upper and lower bounds (see Figure <ref>). We find that many popular methods, or their implementations, are ill-suited for accurately estimating adversarial distance. It appears that while the techniques for AD evaluation are available, their correct application using a popular software package is not straightforward.

Our contributions to this problem are as follows: 

    
  * We propose an efficient attack algorithm for estimating adversarial distance, which serves as a baseline measure.
    
  * We combine this baseline with other appropriate approaches in an "estimation ensemble", theoretically bounding the true adversarial distance above and below,
    
  * We perform experiments on the parameterisation, effectiveness and computational efficiency of the proposed estimation methods, evaluating two differently robust models on an image classification task[Code available: https://github.com/georgsiedel/adversarial-distance-estimationgithub.com/georgsiedel/adversarial-distance-estimation].







§ PRELIMINARIES


Given a classifier f, an adversarial perturbation is typically defined as the minimal perturbation r that changes the estimated label f(x):
    
    Δ_adv(x, f) = min_r ∈ℝ^d r _p   subject to   f(x) ≠ f(x + r)


where x ∈ℝ^d is a data point and p is a norm to quantify the perturbation <cit.>. Although adversarial perturbations have been defined according to other and more general distance measures <cit.>, L_2 and L_∞ are the most common norms used for adversarial robustness evaluation <cit.>.
Δ_adv(x, f) is then called the robustness of f at x. With  𝔼_μ defined as the expected value over all x sampled from distribution μ, the overall robustness of f is defined as:

    
    ρ_adv(f) = 𝔼_μ(Δ_adv(x, f)).


In words, it is defined as the average norm of the minimal perturbation required to change the predictions of f across all data points <cit.>. For this reason, this measure is also referred to as the (mean) adversarial distance <cit.>. 

Research on adversarial robustness evaluation has focused on methods that find such adversarial perturbations through attacks, while solving (<ref>) directly is a less popular research direction in machine learning <cit.>. Adversarial examples found by an attack are always a guaranteed upper bound on the true minimal adversarial perturbation, no matter how tight they are.

For the purpose of benchmarking models and defences on datasets, most adversarial attack and certification approaches define a specific attack budget ϵ instead of trying to find the minimal adversarial distance <cit.>. This attack budget bounds the norm of the maximum allowed perturbation. The adversarial robustness is then evaluated according to the probability of correct classification using this given attack budget:

    
    P_adv(f) = 𝔼_μ(f(x')=y)   for all   x' ∈ℬ(x, ϵ).


where ℬ(x, ϵ) is a norm ball defining the given attack budget and y is the true label for x. P_adv(f) is typically called "adversarial accuracy" or "astuteness" <cit.>, while "adversarial risk" is its opposite term. Adversarial accuracy can be estimated with a selected attack and attack budget on a given test dataset. 

The evaluation approach (<ref>) is quite different from (<ref>). For adversarial accuracy evaluation, attacks can always fully exploit their attack budget. Reporting adversarial accuracy is well comparable for a fixed attack type and attack budget. However, the metric is less informative than (<ref>), as it simply sums up the successes or failures of an attack as 0 or 1. For example, consider two models that could behave very differently under different attacks or in real-world applications: The first is a classifier that is robust just below the given attack budget on all tested data points, and the second is not robust at all. Both would obtain an adversarial accuracy of 0% according to (<ref>), but different mean adversarial distances according to (<ref>), providing a more nuanced and more informative assessment of the models adversarial robustness. Despite its advantages, adversarial distance is only rarely reported in basic research such as <cit.> and is absent from the evaluations of most adversarial defense methods.



§ RELATED WORK



 §.§ Adversarial Distance Calculation through Attacks


There exist approaches that pave the way for estimating the upper bound adversarial distance according to (<ref>) by focusing on generating minimal adversarial perturbations instead of using the entire attack budget. 

Single-step adversarial attacks are generally not well suited for estimating tight minimal adversarial perturbations, as they generate a deceptive example in one step. One such attack is the Fast Gradient Sign Method (FGSM) <cit.>, where a single perturbation is applied to the original input along the gradient of the classifier. In a non-iterative setting, the attack will use its full attack budget ϵ, producing suboptimally large minimal perturbation estimates (see Figure <ref>).

Iterative attacks, on the other hand, incrementally alter the input while staying within the predefined attack budget. As shown in Figure <ref>, these methods push the perturbation towards the decision boundary. Popular iterative adversarial attacks include Projected Gradient Descent (PGD) <cit.> and Basic Iterative Method (BIM) <cit.>. Iterative methods do not need to use their entire attack budget epsilon, as they could potentially early stop once they have successfully changed the class. The smaller the step size, the more applicable they become for estimating tight minimal perturbations according to (<ref>).

The authors of <cit.> emphasise adversarial distance as a refined measure of robustness beyond adversarial accuracy. They propose an adversarial attack called DeepFool for L_2 norm, which estimates a tight minimal perturbation using an iterative attack that stops when the prediction changes.

A related approach to DeepFool is NewtonFool <cit.>. This method also aims to create minimal perturbations, meaning that they are in principle suitable for adversarial distance estimation.

The authors of <cit.> propose the Carlini-Wagner (CW) attack that uses an iterative search strategy to find close adversarial perturbations. Their method is reported to be particularly effective for the L_2 norm. The authors are also among the few to report adversarial distance for successful attacks in their experiments.



 §.§ Robustness Certification

In contrast to upper bound adversarial distance calculation through attacks, certification methods[Note that certification of classifier robustness is unrelated to efforts of official institutions and authorities that may certify products.] aim at identifying a lower bound on the true minimal adversarial perturbation, namely a norm distance for which no adversarial perturbation exists. One line of research is on using formal mathematical proofs to verify robustness <cit.>. 

Another is robust defense approaches that also claim theoretically guaranteed certified robustness. Sometimes, such papers plot guaranteed adversarial accuracy over various sizes of adversarial perturbations <cit.>. When evaluated for a sufficiently continuous set of perturbation sizes, such plots can be interpreted as an estimate of the cumulative distribution function for the lower bounds of the adversarial distances of all data inputs.



 §.§ Clever Score Metric


The CLEVER (Cross Lipschitz Extreme Value for nEtwork Robustness) score <cit.> is a popular and scalable robustness certification approach that estimates a lower bound on adversarial distance. It represents an attack-agnostic metric applicable to all neural network classifiers. It is based on the principle of Lipschitz continuity <cit.>. 

The CLEVER method uniformly generates an additional number of samples in a specified p-norm neighbourhood around the original input, as shown in Figure <ref>. It then assigns the samples to a specified number of batches and calculates the maximum norm of the local gradients of the samples in the batch. These maximum gradients follow a reverse Weibull distribution according to the principles of extreme value theory <cit.>. From this distribution, the maximum gradient, which represents the cross-Lipschitz constant, can be estimated as the finite right tail of the Weibull distribution using maximum likelihood estimation. The cross-Lipschitz constant can be used to derive a robustness lower bound for the data point, below which the class cannot be changed, implying adversarial robustness.

It should be noted that CLEVER is an estimation based on statistical sampling and does not provide guarantees.





 §.§ Robustness Toolbox


There are several popular libraries that implement approaches for adversarial attack, defence, and robustness estimation. One such open source library is the Adversarial Robustness Toolbox (ART) <cit.>, implemented in Python. 

ART provides an implementation of CLEVER and several adversarial attacks, including those mentioned above as well as HopSkipJump (HSJ) <cit.> or ElasticNet (EAD) <cit.>. On paper then, the ART toolbox provides all the means to compute upper and lower bounds of (<ref>).

However, we show in section <ref> that many attacks, or their implementation in ART, are ill-suited for accurate adversarial distance estimation for one of several reasons. Some iterative approaches do not provide sufficiently tight perturbations, such as the implementation of DeepFool. Other iterative methods, such as the implementation of all PGD variants, do not stop at class change, but use their full attack budget ϵ instead. ART even provides the metric "Empirical Robustness", which implements a wrapper for some iterative attacks to stop them early in order to estimate the adversarial distance. However, our results show that this metric only works for an iterative FGSM attack, and the resulting perturbation is not competitively tight.

Looking back at the state of the art, we find that calculating upper bounds of adversarial distance in particular is relatively uncommon in the literature. It is no wonder then that implementations for practitioners in a popular package such as ART do not work effectively.



§ PROPOSED ALGORITHM


Based on our unsatisfactory findings of the minimal adversarial distance calculation in a common robustness toolbox such as ART, we propose a simple approach to adversarial distance calculation. Our method, described in Algorithm (<ref>), can use any attack that returns an intermediate result even if no adversarial example is found. The attack generates a perturbed image x_adv in norm p using the input image x and the specific attack parameter ϵ_step. The algorithm repeats this generation up to max_iters times. After each iteration, it checks whether f(x_adv) diverges from y, which indicates a successful adversarial attack. An early stopping mechanism stops the attack in this case, allowing the Algorithm (<ref>) to estimate the minimum adversarial perturbation of the image x.
It uses an early stopping function to extract the tightest possible adversarial perturbation for this attack.

Note that the principle of this early stopping function has been described in <cit.> for the DeepFool attack. However, any attack that returns intermediate results after each iteration would be possible (e.g. FGSM, NewtonFool, DeepFool). In this study, we use a simple 1-step PGD attack on the (<ref>) algorithm. While this recombination seems obvious, we will see in the experiments that ART does not provide a functionality that leads to the same results.



Algorithm (<ref>) extends our approach to a comprehensive evaluation of the adversarial distance of a classifier. It performs two adversarial attacks on each image in the test set, the first using Algorithm (<ref>), the second being a selected second attack that estimates tight minimal perturbations. The choice of the second attack depends on the norm p and is described in section <ref>. For both attacks, Algorithm (<ref>) computes the adversarial distance between the original image x and its adversarial example x_adv according to the norm p. The algorithm selects the smaller of the two distances for each image, identifying it as the most effective minimal perturbation. Algorithm (<ref>) serves as a baseline, while the second, norm-specific attack may produce even tighter minimal perturbations. From the adversarial distances of all data points, the maximum perturbation distance is identified as radius^max_p. This value is used as the sampling radius for calculating the CLEVER score for the same classifier f. The algorithm then outputs adversarial distances and corresponding CLEVER scores for all data points, ordered by increasing size of the adversarial distances. Overall, Algorithm (<ref>) provides both upper and lower bounds on the adversarial distance for the classifier and the given data points. The real value should lie between the adversarial distance and the CLEVER score, although only the adversarial distance is a guaranteed and trustworthy upper bound.





§ EXPERIMENTS


We evaluate the effectiveness of our adversarial distance computation with experiments on the CIFAR-10 image classification dataset <cit.>. 

We compare two pre-trained models according to the Wide Residual Network 28-4 architecture described in <cit.>. The "standard" model is trained with a typical Pytorch training pipeline using only dropout and standard random crop and flip data augmentations as described in <cit.>. The "robust" model is additionally trained with a combined set of random data augmentations, including Mixup <cit.>, TrivialAugment <cit.>, and random p-norm noise injections <cit.>. It is therefore expected to be more robust. Although the model is not trained for adversarial robustness, which <cit.> is a much harder goal to achieve than robustness against random corruptions, the adversarial distance metric should be able to measure the higher robustness of the robust model, even if both models are not adversarially trained. We also compare an "adversarial" model of similar architecture from <cit.> loaded from <cit.>, which is expected to yield much higher adversarial distance.

The computations for which we report runtime evaluations were performed on the data science platform Kaggle, using a NVIDIA P100 as a GPU.

We evaluated adversarial distances for three common norms:

    
  * L_1 Distance (1-Norm) is defined as:
        
    x - x_adv_1 = ∑_i|x_i - x_adv_i|

 L_1 perturbations make intense changes to few pixels.
    
    
  * L_2 Distance (2-Norm / Euclidean distance) is defined as:
        
    x - x_adv_2 = √(∑_i(x_i - x_adv_i))

    L_2 perturbations are more evenly spread across all pixels.
    
    
  * L_∞ Distance (∞ Norm) is defined as: 
        
    x - x_adv_∞ = max_i · |x_i - x_adv_i|

    This is probably the most common adversarial distance metric. This type of attack tends to be the least visible, as it limits the maximum change to any pixel in the image uniformly.



Algorithm (<ref>) should change the class on all images, and we initially set max_iters = 500, a value high enough for the standard and robust models. For the adversarial model, this attack budget is not high enough, so it was increased to max_iters = 10000. The overall maximum perturbation ϵ is then defined by Algorithm (<ref>) to be max_iters * ϵ_step. The only important parameter to tune in this algorithm is ϵ_step, for which we report sensible parameters in section <ref>.

We have compared our Algorithm (<ref>) with PGD with several potential second attacks. HSJ, EAD and CW do not return intermediate results if they cannot find an adversarial example after one iteration. They are therefore not suitable to be plugged into our (<ref>) algorithm, but can still find tight adversarial perturbations on their own. We run them with 40 iterations (100 for the adversarial model), as done in <cit.> for the CW attack, and the runtime is reported with this parameterisation. For DeepFool and NewtonFool it makes no difference whether we plug them into Algorithm (<ref>) or let them run independently with the same ϵ_step. We also tested the iterative FGSM implementation in ART, which is deliberately designed to evaluate adversarial distance. Finally, we experimented with ART implementations of different PGD variants and AutoAttack <cit.>. These attacks never stop early when changing a class, even when plugged into our Algorithm (<ref>). They are therefore inapplicable for adversarial distance computation and are not reported upon.







§ RESULTS

In sections <ref> and <ref> we present results on a reasonable parameterisation of Algorithm (<ref>) and the CLEVER computation. In sections <ref> to <ref> we present results for adversarial distances on the three norms. We justify which attack is effective enough to be used as a second attack and evaluate the results of the CLEVER score lower bound estimation for all norms. 




 §.§ Parameterization of Algorithm 1 with PGD



In a practical framework, 1/255 represents the smallest real-world step size feasible in the pixel space. However, for a theoretical white-box evaluation of adversarial robustness, this value can be adjusted. Figure <ref> shows a clustering effect for high values of ϵ_step, leading to inaccurate discrete overestimates of adversarial distance and requiring a precise parameterization of ϵ_step for our approach. The smaller ϵ_step becomes, the higher the resolution and the tighter the minimal perturbation is for the approach according to Algorithm (<ref>). 

Figure <ref> shows how the average L_∞ minimal perturbation on 20 selected images becomes smaller as ϵ_step is reduced. At the same time, more steps are required for each image to change the class, increasing the computation time and revealing a trade-off between performance and computation time. Since the overall computation time for Algorithm (<ref>) is relatively small, we choose a relatively small step size of ϵ_step = 0.0003 for L_∞ distance and 0.005/0.2 for L_2/L_1 respectively. In addition to the trade-off described above, this choice should also take into account the robustness of the image classifier.








 §.§ Parameterization of Clever Score



Table <ref> shows, that a small number of samples and batches for CLEVER calculation leads to a larger and, assuming it is a lower bound, less tight mean CLEVER score. Specifically, the lower the number of samples and batches, the higher the proportion of images with a CLEVER score (lower bound) above the adversarial distance (upper bound). For this "Err." ratio of points, CLEVER cannot be a correct lower bound and the metric is not sound. In contrast, setting the number of samples to 1024 and batchsize of 500, as parameterised in the original paper <cit.>, improves the fraction of correct CLEVER scores. It comes at high computational cost, which scales linearly with the number of samples and the number of classes in the dataset. The decision to use a large sample size must be made keeping in mind that this configuration is the most computationally expensive evaluation of all in this paper. From Table <ref> we also find that for L_2-norm the error ratio of CLEVER score is lowest for the adversarial trained model. We discuss this phenomenon in more detail in section <ref>.



 §.§ Adversarial Distances in L_∞



Figure <ref> shows the results of adversarial distance estimation by multiple L_∞-norm attacks on the standard model for 20 images. The EAD, DeepFool and NewtonFool attacks show high variability, often resulting in high perturbation distances. The (iterative) FGSM also fails to consistently induce minimal perturbations, which is surprising since it is the basis of PGD and should work similarly to our Algorithm (<ref>) with PGD. CW for L_∞ and HSJ generate solid adversarial perturbations.

The HSJ attack outperforms PGD in perturbing some of the 20 images displayed in <ref>, although not being as effective on average. For L_∞ norm we therefore chose HSJ as the second attack. The advantage of HSJ is that it is a black box method and only requires access to the output of the classifier, not to its internal gradients. However, HSJ requires more time per step compared to PGD, underlining the greater efficiency of PGD. Thus, in situations where time efficiency is a priority, PGD seems to be the more sensible choice in L_∞.



 §.§ Adversarial Distances in L_2



Under the L_2 norm, we choose CW as the second attack, as it tends to find the tightest adversarial perturbations (see Figure <ref>). CW is expected to produce tight adversarial perturbations in L_2, as its sophisticated loss function is known to be effective in L_2. The Algorithm (<ref>) with PGD is still competitive with CW, and produces tighter estimates for some inputs.
Again, the precision of CW as a second attack comes at the cost of its computational time, as it takes about 40 times as long to compute as PGD on the standard model, as shown in Figure <ref>.



 §.§ Adversarial Distances in L_1



Under the L_1 norm, we choose EAD as the second attack. EAD produces significantly tighter adversarial perturbations compared to Algorithm (<ref>) with PGD on almost all data points and on average as can be seen in Figure <ref>. This makes EAD a preferred choice for adversarial distance estimation in L_1, despite being computationally more expensive compared to PGD.







 §.§ CLEVER Score as a Lower Bound


The figures <ref> to <ref> show the comparison between CLEVER (for its most reliable 1024-500 parameter setup) and the minimal adversarial attack distance on 500 images, plotted for all 3 norms for the standard and robust models as well as for the adversarial model on L_2-norm. The images are sorted by adversarial distance as returned by Algorithm (<ref>). Misclassified points are assigned an adversarial distance of 0. Ideally, we expect the CLEVER scores to be just below the adversarial distance for most points. For the standard model and L_1 norm, it is clearly visible that CLEVER massively underestimates the adversarial distance, with many images having scores of 0. In contrast, for the robust model and L_1 norm, CLEVER seems to work better, although many images still have CLEVER scores of 0. For the standard model on L_2 and L_∞ as well as the adversarial model on L_2, CLEVER gives reasonable estimates, with about 15% of the CLEVER scores higher than their respective adversarial distances, indicating an incorrect lower bound estimate. For the robust model, CLEVER scores are unreliable on both norms. For L_2, about 18% of the CLEVER scores are incorrect lower bounds and most of the rest are close to zero. For L_∞, 54% are incorrect lower bounds. 

In the plot for the adversarial model it is also visible how a larger ratio of points being misclassified as the models clean accuracy is lower. Also, 4% of points cannot be succesfully attacked by our algorithm <ref>, in which case we assume those points to have the maximum adversarial distance found for any other point (see the top right corner of the diagram). An overview of all mean CLEVER scores for all parameter setups compared to the mean adversarial attack distance can be found in Table <ref>.





§ DISCUSSION
 
Our results shed light on the effectiveness of a selection of evaluation methods for adversarial distance estimation. First, we emphasise that most of this evaluation was carried out with two models that were not trained to be adversarially robust. A comparison with the adversarial model show clearly that the latter is much more robust in terms of adversarial distance according to our method. 

In our experiments, we used implementations of attacks from only one popular adversarial robustness toolbox. It may be that another toolbox has already built an estimator like Algorithm (<ref>).

In our experiments, we found our iterative attack algorithm with early stopping and a small step size, to be an effective baseline in terms of computational efficiency and adversarial distance estimates compared to a number of other adversarial attacks. Surprisingly, it is particularly effective compared to the ART implementations of FGSM <cit.> with early stopping and DeepFool <cit.>, both deliberately designed to estimate exactly this minimal adversarial distance.

We found that our estimation algorithm should be supported by a second algorithm that provides tight estimates of adversarial distances instead of using its entire attack budget. There are several reasons for this: 

    
  * Models trained adversarially using one particular method, where that method may then be less effective at estimating adversarial distance. 
    
  * Ensembles of adversarial attacks are state of the art for robustness evaluation <cit.>.
    
  * For all norms, but L_1 in particular, there exist attacks that appear to be more effective than PGD. The effectiveness of EAD on L_1 is probably due to its dual regularisation technique, which combines the sparsity of L_1 with the evenly distributed perturbations of the L_2 norm.


In our experiments, we expected the CLEVER score to be an effective estimator of an adversarial distance lower bound. The visualisations of the results as in Figures <ref> allows us to discuss this expectation. It leads us to conclude that for our experiments, CLEVER is a rather unreliable estimator, even when parameterised to sample within the perfect norm distance derived from the previous attacks. This is true in particular when evaluating the robust model, probably because it was not trained to be strictly smooth using adversarial training or smoothing methods. However, as it was trained to be robust to random corruptions, it may have lulled CLEVER, which uses a random sampling scheme for estimation, into a false sense of security. In fact, the mechanism of a wrong estimation of CLEVER on a non-smooth model is explained in detail in <cit.>. Countering this phenomenon with many more samples is inefficient, but a different sampling scheme may help <cit.>. For a reliable lower bound on adversarial distance, robustness verification methods with guarantees are needed. For the adversarial model, CLEVER worked more reliably, but we still found counter examples among the less robust points in particular. The precision of CLEVER may be improved by using the adversarial attack distance of each individual point as CLEVERs ϵ value in order to not waste any samples for its estimation.

We found from results such as in Table <ref> that the mean adversarial distance captures the differences in adversarial robustness of all 3 models well, while the adversarial distance distributions across all points provide more details. On the other hand, for the adversarially trained model, our method has trouble finding an adversarial example on some of the points due to their high robustness. Nevertheless, we emphasise the usefulness of measuring the adversarial distance. For example, it helps evaluate the robustness of the robust model compared to the standard model, with its adversarial distance being twice as high. This is plausible, as research suggests a positive effect of random data augmentations such as those used for the robust model, on adversarial robustness <cit.>. However, a typical benchmark evaluation of L_∞ adversarial accuracy with our PGD attack and an attack budget of 8/255 would evaluate the standard model at 0% and the robust model at 1.4% adversarial accuracy, indicating little difference. Our evaluation gives a different and more informative impression about the adversarial robustness of the models compared to each other. We summarize that in line with the findings in <cit.>, adversarial distance is a nuanced and useful measure of robustness at least for comparing models with about similar adversarial accuracy as in the example above.



§ CONCLUSION

This paper proposes a practical approach to estimating the (mean) adversarial distance of classifiers. We find that our simple algorithm provides a solid basis for this estimation, and propose a combination of several attacks and a certification methods to provide an overall assessment of a model's adversarial robustness. While our attack methods work effectively to estimate an upper bound on the adversarial distance for different norm distances, the CLEVER score certification does not provide reliable lower bounds in our experiments. We highlight the value of adversarial distance as a metric to consider for an overall robustness evaluation of a machine learning classifier. Future work should explore different (iterative) adversarial attacks to enable tight upper bounds on adversarial distance for various models and applications. Those results can in turn be used to evaluate the tightness of lower bounds on adversarial distance from verification approaches outside CLEVER score, or the validity of robustness certification approaches.


asmeconf  


