A Geometrical Approach to Evaluate the Adversarial Robustness of Deep
  Neural Networks
Deep Neural Networks (DNNs) are widely used for computer vision tasks.
However, it has been shown that deep models are vulnerable to adversarial
attacks, i.e., their performances drop when imperceptible perturbations are
made to the original inputs, which may further degrade the following visual
tasks or introduce new problems such as data and privacy security. Hence,
metrics for evaluating the robustness of deep models against adversarial
attacks are desired. However, previous metrics are mainly proposed for
evaluating the adversarial robustness of shallow networks on the small-scale
datasets. Although the Cross Lipschitz Extreme Value for nEtwork Robustness
(CLEVER) metric has been proposed for large-scale datasets (e.g., the ImageNet
dataset), it is computationally expensive and its performance relies on a
tractable number of samples. In this paper, we propose the Adversarial
Converging Time Score (ACTS), an attack-dependent metric that quantifies the
adversarial robustness of a DNN on a specific input. Our key observation is
that local neighborhoods on a DNN's output surface would have different shapes
given different inputs. Hence, given different inputs, it requires different
time for converging to an adversarial sample. Based on this geometry meaning,
ACTS measures the converging time as an adversarial robustness metric. We
validate the effectiveness and generalization of the proposed ACTS metric
against different adversarial attacks on the large-scale ImageNet dataset using
state-of-the-art deep networks. Extensive experiments show that our ACTS metric
is an efficient and effective adversarial metric over the previous CLEVER
metric.
Yang Wang, Bo Dong, Ke Xu, Haiyin Piao, Yufei Ding, Baocai Yin, Xin Yang
# A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks

###### Abstract

Deep Neural Networks (DNNs) are widely used for computer vision tasks. However, it has been shown that deep models are vulnerable to adversarial attacks, _i.e._, their performances drop when imperceptible perturbations are made to the original inputs, which may further degrade the following visual tasks or introduce new problems such as data and privacy security. Hence, metrics for evaluating the robustness of deep models against adversarial attacks are desired. However, previous metrics are mainly proposed for evaluating the adversarial robustness of shallow networks on the small-scale datasets. Although the Cross Lipschitz Extreme Value for nEtwork Robustness (CLEVER) metric has been proposed for large-scale datasets (_e.g._, the ImageNet dataset), it is computationally expensive and its performance relies on a tractable number of samples. In this paper, we propose the Adversarial Converging Time Score (ACTS), an attack-dependent metric that quantifies the adversarial robustness of a DNN on a specific input. Our key observation is that local neighborhoods on a DNN's output surface would have different shapes given different inputs. Hence, given different inputs, it requires different time for converging to an adversarial sample. Based on this geometry meaning, ACTS measures the converging time as an adversarial robustness metric. We validate the effectiveness and generalization of the proposed ACTS metric against different adversarial attacks on the large-scale ImageNet dataset using state-of-the-art deep networks. Extensive experiments show that our ACTS metric is an efficient and effective adversarial metric over the previous CLEVER metric.

**Computing methodologies \(\rightarrow\) Computer vision; Adversarial learning.**

**ACM Reference Format:**

Yang Wang, Bo Dong, Ke Xu, Haiyin Piao, Yufei Ding, Baocai Yin, and Xin Yang. 2023. A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks. _ACM Trans. Multimedia Comput. Appl._, (March 2023), 17 pages.
Introduction

In recent years, deep learning (DL) has widely impacted computer vision tasks, such as object detection, visual tracking and image editing. Despite their outstanding performances, recent studies [2; 3; 8; 12; 29; 35; 48; 58] have shown that deep methods can be easily cheated by the adversarial inputs: inputs with human imperceptible perturbations to force an algorithm to produce adversary-selected outputs. The vulnerability of deep models to adversarial inputs is getting significant attention as they are used in various security and human safety applications. Hence, a robust adversarial performance evaluation method is needed for existing deep learning models. The \(l_{p}\) norm-ball theory may be used to indicate the adversarial robustness of neural networks. Specifically, this theory suggests that there should exist a perturbation radius \(l_{p}\)-distortion \(\Delta_{p}=\|\delta x\|_{p}\)[51], where any sample point \(x\) within this radius would be correctly classified as true samples, and others would be regarded as adversarial ones. In other words, the smallest radius \(\Delta_{p}\) (_i.e._, minimum adversarial perturbation \(\Delta_{p,min}\)) can be used as a metric to evaluate the robustness: a model with larger radius indicates that it is more robust. However, determining the \(\Delta_{p,min}\) has been proven in [25; 45] as an NP-complete problem. Existing methods mainly focused on estimating the lower and upper bounds of \(\Delta_{p,min}\). While estimating the upper bound [7; 21; 26] is typically attack-dependent, easy-to-implement and computational lightweight, it often suffers poor generalization and accuracy. On the contrary, estimating the lower bound [50; 56] can be attack-independent but computational heavy. Moreover, the lower bound estimation often provides little clues for interpreting the prevalence of adversarial examples [17; 19; 39; 56].

To address the above limitations, this paper presents a novel instance-specific adversarial robustness metric, the Adversarial Converging Time Score (ACTS). Unlike CLEVER [51], ACTS does not use an exact lower bound of minimum adversarial perturbation as a robustness metric. Instead, ACTS estimates the desired robustness based on the \(\Delta_{p,min}\) in the direction guided by an adversarial attack. ACTS is resilient, which means if an attack method can deliver a \(\Delta_{p,min}\) attack, then the estimated robustness by ACTS reflects the fact. The insight behind the proposed ACTS is the geometrical characteristics of a DNN-based classifier's output manifold. Specifically, given a \(M\)-dimensional input, each output element can be regarded as a point on a \(M+1\) dimensional hypersurface. Adding adversarial perturbations can be regarded as forcing the original output elements to move to new positions on those hypersurfaces. The movement driven by effective perturbations should push all output elements to a converging curve (_i.e._, the intersection of two or more hypersurfaces), where a clean input is converted to an adversarial one. Since the local areas around different points on hypersurfaces have different curvatures, different clean samples require different time to be converged to adversarial examples. The proposed ACTS measures the converging time and use the time as the adversarial robustness metric. To summarize, this paper has the following contributions. We propose a novel Adversarial Converging Time Score (ACTS) method for measuring the adversarial robustness of deep neural networks. Our method leverages the geometry characteristics of a DNN's output manifolds, so it is effective, efficient and easy to understand. We provide mathematical analysis to justify the correctness of the proposed ACTS and extensive experiments to demonstrate its superiority under different adversarial attacks.

This paper is organized as follows. We first review the related work in Section 2. In Section 3, we describe the proposed method. Results from comparative experiments for different architectures and adversarial attack approaches are then given in Section 4. And we make the conclusions and envision the future work in Section 5.

## 2 Related Work

### Adversarial Attacks

Over the past few years, extensive efforts have been made in developing new methods to generate adversarial samples [9; 13; 20; 33; 36; 53; 57; 55]. Szegedy _et al._[48] proposed L-BFGS algorithm
to craft adversarial samples and showed the transferability property of these samples. Goodfellow _et al._[21] proposed Fast Gradient Sign Method (FGSM), a fast approach for generating adversarial samples by adding perturbation proportional to the sign of the cost functions gradient. Rather than adding perturbation over the entire image, Papernot _et al._[40] proposed Jacobian Saliency Map Approach (JSMA), which utilized the adversarial saliency maps to perturb the most sensitive input components. Kurakin _et al._[26] extended the FGSM algorithm as the Basic Iterative Method (BIM), which recurrently adds smaller adversarial noises.Madry _et al._[34] proposed the attack Projected Gradient Descent (PGD) method by extending the BIM with random start point.Carlini _et al._[7] proposed an efficient method (_i.e._, CW attack) to compute good approximations while keeping low computational cost of perturbing examples. It further defined three similar targeted attacks based on different distortion measures (\(L_{0}\), \(L_{2}\), and \(L_{\infty}\)). It is to be noted that all the above mentioned attacks are white-box attacks that craft adversarial examples based on the input gradient. In the classical black-box attack, the adversarial algorithm has no knowledge of the architectural choices made to design the original architecture. There are different ways to generate adversarial samples [14, 15, 16, 10, 16, 23, 54, 6] under black-box schemes. Since this paper focuses on the white-box attacks, for more detailed information, readers may refer to [1].

### Adversarial Defenses

This line of works focus on developing robust deep models to defend against adversarial attacks [18, 28, 49]. Goodfellow _et al._[21] proposed the first adversarial defence method that uses adversarial training, in which the model is re-trained with both adversarial images and the original clean dataset. A series of work [24, 34, 57] follow this adversarial training, but investigate different adversarial attacks to generate different adversarial data. Papernot _et al._[38] extended defensive distillation [41] (which is one of the mechanisms proposed to mitigate adversarial examples), to address its limitation. They revisited the defensive distillation approach and used soft labels to train the distilled model. The resultant model was robust to attacks. Liang _et al._[31] proposed a method where the perturbation to the input images are regarded as a kind of noise and the noise reduction techniques are used to reduce the adversarial effect. In their method, classical image processing operations such as scalar quantization and smoothing spatial filters were used to reduce the effect of perturbations. Bhagoji _et al._[5] proposed dimensionality reduction as a defense against attacks on different machine learning classifiers. Another effective defense strategy in practice is to construct an ensemble of individual models [27]. Following this idea, Liu _et al._[32] proposed the random self-ensemble method to defend the attacks by averaging the predictions over random noises injected to the model. Pang _et al._[37] proposed to promote the diversity among the predictions of different models by introducing an adaptive diversity-promoting regularizer. However, these methods do not have an ideal robustness metric to help them correctly evaluate and improve their performance.

### Robustness Metrics

With the development of adversarial attacks, there is a need for a robustness metric that quantifies the performance of a DNN against adversarial samples. A straightforward method is to use a specific attack method to find the adversarial examples, and use the distortions of adversarial examples (_i.e._, upper bound of \(\Delta_{p,min}\)) as the model robustness metric. For example, Bastani _et al._[4] proposed a linear programming formulation to find adversarial examples and directly use the \(l_{p}-\)distortion as the robustness metric. Moosavi-Dezfooli _et al._[36] proposed to compute a _minimal_ perturbation for a given image in an iterative manner, in order to find the _minimal_ adversarial samples across the boundary. They then define all the _minimal_ perturbation expectation over the distribution of data as the robustness metric. Other methods focus on estimating the lower bound of \(\Delta_{p,min}\) and use it as the evaluation metric. Weng _et al._[50] exploited the ReLU property to bound the activation function
(or the local Lipschitz constant) and provided two efficient algorithms (Fast-Lin and Fast-Lip) for computing a certified lower bound. Zhang _et al._[56] proposed a general framework CROWN for computing a certified lower bound of minimum adversarial distortion and showed that Fast-Lin algorithm is a special case under the CROWN framework. Recently, a robustness metric called CLEVER [51] was developed, which first estimates local Lipschitz constant using extreme value theory and then computes an attack-agnostic robustness score based on first order Lipschitz continuity condition. It can be scaled to deep networks and large datasets. However, the lower bound estimation of CLEVER is often incorrect and is time-consuming. Therefore, it is hard to be a robust and effective adversarial robustness metric.

## 3 Methodology

### Adversarial Converging Time Score

**Adversarial Attacks in Image Classification** Given an \(M\) dimensional input \(x\in\mathbf{R}^{M}\) and a K-class classification loss function \(D:\mathbf{R}^{M}\rightarrow\mathbf{R}^{K}\), the predicted class label \(t\) of the input \(x\) is defined as:

\[t=C(x)=\operatorname*{argmin}_{j}\{y_{j}\mid y_{j}\in\mathbf{R}^{1}\}, \tag{1}\]

where \(y_{j}\) is the \(j\)th element of the \(K\)-dimensional output of \(D(x)\). From geometrical point of view, \(y_{j}\) can be regarded as a point on a \(M+1\) dimensional hypersurface \(m_{j}\) (See Fig. 1 (a)).

Since DNN-based classifiers are typically non-linear systems, which is true for all state-of-the-art DNN models. In this case, the hypersurfaces \(m\) defined by \(D\) are also non-linear systems. Thus, local areas around different points on a hypersurface \(m_{j}\) have different curvatures, which results in that different inputs would have different sensitivity to the same added noise \(\delta x\). As shown in Fig. 1 (a), the changes on a hypersurface \(m_{j}\) driven by the same \(\delta x\) are significantly different in terms of magnitude. Inspired by this insight, we propose a novel Adversarial Converging Time Score (ACTS) as an instance-specific adversarial robustness metric. The key to the proposed ACTS is that the sensitivity is mapped to the "time" required to reach the converging curve (_i.e._, decision boundary) where a clean sample is converted to an adversarial sample. We first introduce the proposed ACTS in detail. Then, we provide a toy-example to validate the proposed approach.

**Adversarial Converging Time Score (ACTS)** To easily convey the intuitive idea of the proposed ACTS, we use 1D input domain and 2D hypersurface (_i.e._, lines). Fig. 1 (b) shows our idea intuitively.

Figure 1: (a) An example of 3D hypersurface, (b) intuition behind our ACTS.
As we can see, based on Eq. 1, the original input \(x\) is classified as \(t\)th class since \(y_{t}\) is in a lower position than \(y_{j}\) in the loss domain. Although adding a noise \(\delta x\) to \(x\) results in two new positions \(y^{\prime}_{t}\) and \(y^{\prime}_{j}\), the predicted label of \(x+\delta x\) is not changed (still \(t\)). If \(x+\delta x\) passes the converging point, the predicted label of \(x+\delta x\) changes to \(j\). From this point of view, the robustness of an input can be reflected by the magnitude of the added \(\delta x\) for reaching the converging point. For a DNN-based classifier, the collection of converging points forms the decision boundary. However, such decision boundary is extremely hard to be estimated, especially in a high-dimensional space. Instead, we can look at the converging point from the perspective of loss domain, where the distance between \(y^{\prime}_{j}\) and \(y^{\prime}_{t}\) is 0. In other words, the robustness of an input can be reflected by the time used to cover the distance \(y_{j}-y_{t}\), _i.e._, the less time it requires, the less robust it is. Compared to the decision boundary estimation, estimating the distance \(y_{j}-y_{t}\) is much easier. Hence, we propose the ACTS to estimate such time, which takes the following form:

\[ACTS \coloneqq\operatorname*{argmin}_{j}(f(\frac{y_{j}-y_{t}}{s_{t}-s _{j}}))\quad j\in 1\dots K,j\neq t, \tag{2}\] \[f(x) =\begin{cases}C,&x\leq 0\\ x,&x>0\end{cases}\]

where \(s_{j}\) and \(s_{t}\) are the moving speeds in the loss domain, which are driven by the added noise \(\delta x\). However, the minus sign in the denominator may be a bit tricky. An ideal misclassification attack should increase the target error value, results in a positive \(s_{t}\), and it should also decrease the error value of the potential misclassified class, which gives a negative \(s_{j}\) (as shown in Fig. 0(b)). Hence, the value of \(s_{t}-s_{j}\) should always be positive. However, the \(s_{t}-s_{j}\) could be a negative value in the following situations: (a) \(s_{t}\) decreases and \(s_{j}\) increases; (b) both of \(s_{t}\) and \(s_{j}\) decrease, but \(s_{t}\) decreases faster; (c) both of \(s_{t}\) and \(s_{j}\) increase, but \(s_{j}\) increases faster. If any of the above cases happen to an input, it means it is impossible to deliver a successful attack, and hence the ACTS of the specific input is a maximum score \(C\). The \(f(x)\) used in the Eq. (2) is for this purpose. Since ACTS represents the time to cover the distance \(y_{j}-y_{t}\) with a speed \(s_{t}-s_{j}\), an input with a smaller ACTS is more vulnerable to an adversarial attack, and vice-versa.

The key to the proposed ACTS is to estimate the moving speed. However, a local neighborhood on an output hypersurface is non-linear. It is very challenging to estimate the moving speed directly. To this end, we propose a novel \(DJM\) based scheme to estimate the required moving speed, which takes the non-linearity nature of an output hypersurface into account.

**Data Jacobian Matrix** Given an input \(x\), the Data Jacobian Matrix (DJM) of \(D\) is defined as:

\[DJM(x)=\frac{\partial D(x)}{\partial x}=\left[\frac{\partial D_{j}(x)}{ \partial x_{i}}\right]_{j\in 1\dots K,i\in 1\dots M} \tag{3}\]

On a hypersurface \(m_{j}\), the \(DJM_{j}(x)\) (i.e., \(j\)th row of \(DJM(x)\)) defines the best linear approximation of \(D\) for points close to point \(x\)[52]. Therefore, with \(DJM(x)\), a small change \(\delta x\) in the input domain of \(D\) can be linearly mapped to the change on the hypersurfaces \(m_{j}\). Mathematically, it can be described as:

\[D(x+\delta x)=D(x)+DJM(x)\times\delta x+\delta e, \tag{4}\]

where \(\delta e\in R^{K}\) is the approximation error. Essentially, the \(DJM(x)\) is very similar to the gradient backpropagated through a DNN during a training process. The only difference is \(DJM(x)\) differentiates with respect to the input \(x\) rather than network parameters.

**One-step attack** Based on the Eq. (4), with an input \(x\) and an added noise \(\delta x\), the original point \(y_{j}(a.k.a.,D_{j}(x))\) is shifted to the point \(y^{\prime}_{j}\) on the hypersurface \(m_{j}\), and the approximated shifted
position of \(y^{\prime}_{j}\) can be estimated as (shown in Fig. 1 (b)):

\[y^{\prime}_{j}\approx D_{j}(x)+DJM_{j}(x)\times\delta x, \tag{5}\]

where \(DJM_{j}(x)\) is the \(j\)th row of the \(DJM(x)\). For one-step attack (_e.g._, FGSM), \(\delta x\) can be regarded as a vector \(\vec{d}\). The direction of \(\vec{d}\) is fixed and only the length of \(\vec{d}\) varies for delivering a successful attack. Therefore, the moving speed \(s_{j}\) from point \(y_{j}\) to \(y^{\prime}_{j}\) on the surface \(m_{j}\) driven by the shift \(\delta x\) in the input domain can be estimated as:

\[s_{j}=\frac{y^{\prime}_{j}-y_{j}}{\|\delta x\|}\approx\frac{DJM_{j}(X)\times \delta x}{\|\delta x\|}\quad j\in 1\dots K. \tag{6}\]

It is worth to mention that the \(DJM\) is an linear approximation for a small \(\delta x\). The approximation accuracy decreases while \(\delta x\) increases.

**Multi-step attack** In a multi-step attack (_e.g._, BIM), each step changes the \(\vec{d}\) (_i.e._, \(\delta x\)) in terms of both direction and length. Compared to one-step attacks, the different directions reveal more curvatures of a local neighborhood, and it increases the probability of discovering a more optimal moving speed to reduce the "time" (_i.e._, added noise) for converting a clean sample to an adversarial one. That is also the reason that multi-step attacks are more effective than one-step attacks. However, the dynamics introduced by multi-step attacks is also troublesome to estimate the desired moving speed. To deal with it, we propose an average moving speed from \(y_{j}\) to \(y^{\prime}_{j}\) based on all explored directions as follow:

\[s_{j}\approx\frac{1}{N}\sum_{q}^{N}\frac{DJM_{j}(x)\times\delta x_{q}}{\| \delta x_{q}\|}\quad j\in 1\dots K, \tag{7}\]

where \(N\) is the total steps used in the multi-step attack, and \(\delta x_{q}\) is the added noise in the \(q\)th step. Even though the estimated average speed has limited accuracy, our experiments show the effectiveness of the proposed average speed.

### Toy Example

We design a toy experiment to validate the proposed ACTS, where a simple two-layer feed-forward network was trained to proximate a AND gate. The testing accuracy of the trained model was 99.7%.

Figure 2: (a) the output of the toy example AND gate model, (b) the ACTS distribution of the toy example AND gate model for all input samples where \(x_{1}\wedge x_{2}=1\).
Mathematically, we define the AND gate as:

\[x_{1}\wedge x_{2}=1,\quad x_{1}\geq 0.5\text{ and }x_{2}\geq 0.5\] \[x_{1}\wedge x_{2}=0,\quad\text{ otherwise}\]

where \(x_{i}\in[0,1.0]\). Based on this definition, as shown in Fig. 2 (a), [0.5, 1.0] is the decision boundaries on both \(x_{1}\) and \(x_{2}\) axes, where lower ACTSs are expected. We use FGSM method, with \(\epsilon=0.1\), to generate adversarial samples only for the clear sample pairs of \(x_{1}\wedge x_{2}=1\). For the rest pairs, ACTSs are set to 0. As shown in Fig. 2 (b), the input pairs closer to the decision boundary have lower ACTSs. Also, we observe an increasing trend in the ACTSs as the input values move further away from the boundary. The maximum ACTS is observed at point \((x_{1},x_{2})=(1.0,1.0)\). These observations illustrate the proposed ACTSs is able to reflect the robustness under the FGSM attack.

## 4 Experiments

In this section, we first validate the effectiveness and generalization capacity of the proposed ACTS metric against different state-of-the-art DNN models and adversarial attack approaches on the ImageNet [11] dataset in Section 4.2. We then compare the proposed ACTS with CLEVER [51] (the only method that can be adapted to deep models and large-scale ImageNet dataset), to show that our method provides a more effective and practical robustness metric in different adversarial settings in Section 4.3.

### Experimental Setting

**Evaluation dataset and methods** To evaluate the effectiveness of proposed method on large-scale datasets, we choose the ImageNet Large Scale Visual Recognition Challenge (ILSVR) 2012 dataset, which has 1.2 million training and 50,000 validation images. We evaluate our method on three representative state-of-the-art deep networks with pre-trained models provided by PyTorch [42], _i.e._, the InceptionV3 [47], ResNet50 [22] and VGG16 [44], as these deep networks have their own network architectures. To evaluate the robustness of our method against different attacks, we consider three different state-of-the-art white-box attack approaches, _i.e._, (FGSM [21], BIM [26], and PGD [34]).

**Implementation details** We have implemented our ACTS using the PyTorch framework, and all attack methods using the adversarial robustness PyTorch library: Torchattacks [43]. A GPU-Server with an Intel E5-2650 v4 2.20GHz CPU (with 32GB RAM) and one NVIDIA Tesla V100 GPU (with 24GB memory) is used in our experiments. For preprocessing, we normalize the data using mean and standard deviation. The images are loaded in the range of \([0,1]\) and then normalized using a \(mean=[0.485,0.456,0.406]\) and \(std=[0.229,0.224,0.225]\)[42]. To control the noise levels in order not to bring any noticeable perceptual differences and show the consistent performance of the proposed ACTS, we add the noise of three different levels: \(\epsilon=\{0.00039\ (0.1/255),\ 0.00078\ (0.2/255),\ 0.00117\ (0.3/255)\}\) to the FGSM [21], BIM [26] and PGD [34], respectively. We use N1, N2 and N3 to represent these three different noise levels, respectively. We use three steps and set the step size = \(\epsilon/2\) to both BIM [26] and PGD [34]. We use the untargeted attack setting in all attacks. For each image, we evaluate its top-10 class (_i.e._, the class with the top-10 maximum probabilities except for the true class, which is usually the easiest target to attack) [51] in \(DJM\).

### ACTS Validation Results

This section evaluates the effectiveness and generalization properties of our proposed ACTS method in various adversarial environments.
**Evaluating the effectiveness of ACTS** To be an effective adversarial robustness metric, the proposed ACTS should faithfully reflect that the samples with lower ACTS scores are more prone to be attacked successfully than those with higher scores. To validate such property of the ACTS, we design the following experiments. First, we apply these three DNN models on the ImageNet validation dataset and selected those correctly classified images. Secondly, we estimate the ACTS scores for all the selected images and apply the three chosen attack methods to them. It can be seen from Table 1 that, the adversarial accuracy is gradually decreased to a moderate extent with increased levels of noise. Third, in order to show the consistent performance of the proposed ACTS, we increase the noise level to N1, N2 and N3 and record the ACTS scores for those who are successfully attacked. Fig. 3 shows the histograms of the three chosen DNN models under different attacks, respectively. The blue color indicates the ACTS scores of the images that are correctly classified on ImageNet validation dataset under the initial noise \(\epsilon\) = 0.0002, and the other three colors indicate the ones that are attacked successfully with noise level N1, N2 and N3. For all the models and attacks, the green, yellow and

Figure 3: Noise Effectiveness charts for different models under different attacks. Area under the blue color denotes ACTS scores for the correctly classified samples on ImageNet validation dataset. Green, yellow, red colors denoted the ACTS scores of the samples that were successfully attacked. Each color denotes the noise level added to the dataset with respect to the corresponding attack.
red regions are always on the very left side of the respective charts. This shows the inputs with lower ACTS scores are easier to be attacked successfully. We can also see that with increased noise levels, images with relatively lower ACTS scores would be attacked successfully first (from green to red). In addition, Fig. 3 and Table 1 show that these aforementioned observations are consistent in different adversarial environments (_i.e._, different DNN architectures and different attacks). Based on the distribution of the obtained ACTS, we are able to gain a relatively precise intuition about DNNs' performance under different attack methods. For example, based on the each row figures of Fig. 3, it is obvious that ACTS histograms of green, yellow, red colors become much wider range than previous, which indicate BIM and PGD are more powerful attack methods when compared to FGSM attack method. This observations can be confirmed by the corresponding adversarial accuracy rates shown in Table 1.

In addition to the qualitative results in Fig. 3, we also present the quantitative results to show the effectiveness of ACTS. Fig. 4, Fig. 5 and Fig. 6 show the detailed histogram results in different adversarial environments. The orange color indicates the samples that are attacked successfully, and the light blue color indicates the ones that are attacked unsuccessfully. Only an ideal robustness metric could separate the two groups without any overlap, and existing approaches may have different overlap regions between the two groups. Hence, the size of overlap regions can be leveraged as an indicator to show the effectiveness of a robustness metric. For each histogram, we calculate the overlap percentage by \(S_{o}/S_{a}\), where \(S_{o}\) is the size (_i.e._, count) of an overlap area, and \(S_{a}\) is the total area of a histogram. Hence, for Overlap%, the lower its values, the better the evaluating results are. All results are shown in Table 2. As we can see, almost all Overlap% values are below 10%. In terms

\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{Attack} & \multirow{2}{*}{Model} & \multirow{2}{*}{Clean} & \multicolumn{2}{c}{Adversarial} & Accuracy \\  & & & N1 & N2 & N3 \\ \hline \multirow{4}{*}{FGSM} & InceptionV3 & 77.21\% & 61.16\% & 50.03\% & 43.05\% \\  & ResNet50 & 76.13\% & 57.45\% & 43.94\% & 34.77\% \\  & VGG16 & 71.59\% & 52.35\% & 37.73\% & 27.71\% \\  & InceptionV3 & 77.21\% & 55.10\% & 43.05\% & 36.68\% \\ \multirow{4}{*}{BIM} & ResNet50 & 76.13\% & 50.08\% & 34.77\% & 25.47\% \\  & VGG16 & 71.59\% & 44.38\% & 27.71\% & 18.46\% \\ \multirow{4}{*}{PGD} & InceptionV3 & 77.21\% & 60.20\% & 45.86\% & 36.31\% \\  & ResNet50 & 76.13\% & 56.13\% & 39.15\% & 26.56\% \\ \cline{1-1}  & VGG16 & 71.59\% & 51.77\% & 34.48\% & 22.28\% \\ \hline \hline \end{tabular}
\end{table}
Table 1: Clean and Adversarial accuracy in different adversarial environments.

\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{Attack} & \multirow{2}{*}{Model} & Overlap\% & Overlap\% & Overlap\% \\  & & N1 & N2 & N3 \\ \hline \multirow{4}{*}{FGSM} & InceptionV3 & 1.46\% & 3.54\% & 4.71\% \\  & ResNet50 & 2.95\% & 6.42\% & 9.14\% \\ \multirow{4}{*}{BIM} & VGG16 & 2.14\% & 4.29\% & 5.71\% \\  & InceptionV3 & 2.53\% & 4.71\% & 6.26\% \\ \multirow{4}{*}{BIM} & ResNet50 & 4.89\% & 9.13\% & 10.89\% \\  & VGG16 & 3.02\% & 5.71\% & 6.47\% \\ \multirow{4}{*}{PGD} & InceptionV3 & 1.33\% & 3.26\% & 4.85\% \\  & ResNet50 & 1.72\% & 4.70\% & 6.62\% \\ \cline{1-1}  & VGG16 & 1.87\% & 3.73\% & 4.89\% \\ \hline \hline \end{tabular}
\end{table}
Table 2: ACTS Overlap% values in different adversarial environments.
Figure 4: ACTS scores histograms of **InceptionV3** in different experimental configurations. In each histogram, the orange color indicates the samples that are attacked successfully, and the light blue color indicates the ones that are attacked unsuccessfully.

Figure 5: ACTS scores histograms of **ResNet50** in different experimental configurations. In each histogram, the orange color indicates the samples that are attacked successfully, and the light blue color indicates the ones that are attacked unsuccessfully.
of DNN architecture, ACTS shows better performance on InceptionV3 and VGG16. We guess the reason is the local areas on output hypersurfaces of InceptionV3 and VGG16 around the output points of all tested images are flatter (i.e., the radius of curvature is small) than ResNet50. In this case, the \(DJM\) provides a more accurate linear approximation. It is worth to mention that the overlap area is getting larger when \(\epsilon\) increases in different adversarial environments. It confirms with the limitation of the DJM that the linear approximation accuracy decreases while \(\delta x\) increases. In the process of statistics, we found an interesting phenomenon called the _attack flip_: the image with a successful attack at a lower noise level may fail at a higher noise level. The result is shown in Table 3. _Attack flip_ is a good explanation for why there are very small ACTS scores in the overlap at a higher noise level. In other words, some small ACTS scores are counted as orange histogram at a lower noise level and then counted as blue histogram at a higher noise level. This flip will result in small ACTS scores in the overlap at a higher noise level. Besides, another reason is that the limitation of the proposed approach is that the proposed approach is not able to detect the
the DJM. The linear approximation accuracy of the DJM decreases while \(\delta x\) increases which will lead to the error. _Attack flip_ also suggests that the lower bound may not always make sense.

**Evaluating the Generalization of ACTS** In Fig. 3, the histogram of each row represent the results of the same model under different attack, and each column represent the results of different models under the same attack method. From the results, we can see that ACTS has a good generalization ability across different attack methods and models.

**Correlations to CLEVER** We are interested in whether our ACTS align with the CLEVER. To this end, we compute the average score of all the tested images as the CLEVER's reported robustness number. The higher the CLEVER score, the more robust the model is. We also calculate the average ACTS score of all the tested images to represent the robustness of the network. From the results shown in Table 4, we get the same ranking correlation to CLEVER. It also demonstrates that models with higher ACTS scores are more robust. The results we obtained are basically consistent with the results in Table (3) (b) of CLEVER (The column of Top-2 Target) [51]. Besides, we conclude that VGG16 model with highest scores are more robust than other on test image set. This conclusion can also be found in [46]. It is worth to mention that the score distribution may change dramatically on different test image sets.

**Determining k** To investigate the impact of the top-\(k\) class in \(DJM\), for each image, we evaluate its top-\(k\) class ACTS scores in Table 5. From the results, we can see that with the increase of \(k\), the value of Overlap% changes very slightly. Considering the balance between computational consumption and ACTSs' performance, it is reasonable to set the k to 10.

### Comparing With the State-of-the-art CLEVER

We compare our method with state-of-the-art method CLEVER in this section. CLEVER score is designed for estimating the lower bound on the minimal distortion required to craft an adversarial sample, and it used \(L_{2}\) and \(L_{\infty}\) norms for their validations. We follow the setting in [51] to compute CLEVER \(L_{2}\) and \(L_{\infty}\) norms scores for 1,000 images out of the all 5,000 ImageNet validation set, as CLEVER is more computational expensive. The same set of randomly selected 1,000 images from the ImageNet validation set is also used in our method. Instead of sampling a high-dimension-space ball, our method only requires normal backpropagations, which is significantly faster than CLEVER. Our experiment results in Table 6 confirm this.

For each image, we calculate its CLEVER and ACTS scores on an NVIDIA Tesla V100 graphics card, the average computation speed of our method is three orders of magnitude faster than CLEVER method on different models. We also use the Overlap% indicator to compare the effectiveness of different robustness metrics, inspired by the ROC curve, which visualizes all possible classification thresholds to quantify the performance of a classifier. Since ACTS and CLEVER only care about whether the distribution of image scores are consistent with successful/unsuccessful results in different adversarial environments, we can use the Overlap% indicator as "mis-classification rate". In Table 7, we calculate \(L_{2}\) CLEVER, \(L_{\infty}\) CLEVER and ACTS Overlap% values respectively. From the results, we can see that the value range of the \(L_{2}\) CLEVER and \(L_{\infty}\) CLEVER Overlap% is almost in

\begin{table}
\begin{tabular}{c c c} \hline \hline Model & CLEVER & ACTS \\ \hline VGG16 & 0.370 & 4.459 \\ \hline InceptionV3 & 0.215 & 3.047 \\ \hline ResNet50 & 0.126 & 2.558 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Using CLEVER method and ACTS method to measure the ranking correlation of the robustness of different models.
10% ~ 20%, and the value range of the ACTS Overlap% is almost in 0% ~ 10%. CLEVER scores have almost more than twice larger Overlap% values on average for all testing configurations. Even though \(L_{\infty}\) CLEVER scores give slightly less Overlap% values than the ones based on \(L_{2}\) CLEVER scores, ACTS still outperform them in a significant margin with all testing configurations. These results indicate that ACTS is a more effective metric than CLEVER in different adversarial environments.

\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{Model} & \multirow{2}{*}{Metric} & Average & ACTS \\  & & Computation & speed\_up \\  & & Time (second) & \\ \hline \multirow{2}{*}{InceptionV3} & CLEVER & 331.42 & \multirow{2}{*}{6628/2549} \\  & ACTS & 0.05/0.13 & & \\ \hline \multirow{2}{*}{ResNet50} & CLEVER & 196.25 & \multirow{2}{*}{4906/2181} \\  & ACTS & 0.04/0.09 & & \\ \hline \multirow{2}{*}{VGG16} & CLEVER & 286.85 & \multirow{2}{*}{5737/2207} \\  & ACTS & 0.05/0.13 & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: The average computation time of CLEVER and ACTS on different models for a single image in ImageNet. Blue and red fonts in the third column represent ACTS average computation time under one-step and multi-step attacks, respectively. The fourth column is the corresponding lifting multiple.

\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{Attack} & \multirow{2}{*}{Model} & \multirow{2}{*}{Metric} & Overlap\% & Overlap\% & Overlap\% \\  & & & N1 & N2 & N3 \\ \hline \multirow{6}{*}{FGSM} & \multirow{2}{*}{InceptionV3} & ACTS-10 & 1.56\% & 2.08\% & 5.2\% \\  & & ACTS-20 & 1.56\% & 2.08\% & 5.2\% \\  & & ACTS-50 & 1.56\% & 2.08\% & 5.2\% \\  & & ACTS-10 & 2.39\% & 7.98\% & 9.84\% \\  & & ACTS-20 & 2.39\% & 7.98\% & 9.71\% \\  & & ACTS-10 & 1.3\% & 3.46\% & 6.63\% \\  & & ACTS-20 & 1.3\% & 3.46\% & 6.77\% \\  & & ACTS-50 & 1.3\% & 3.46\% & 6.92\% \\ \hline \multirow{6}{*}{BIM} & \multirow{2}{*}{InceptionV3} & ACTS-10 & 1.43\% & 5.2\% & 6.37\% \\  & & ACTS-20 & 1.43\% & 5.2\% & 6.37\% \\  & & ACTS-50 & 1.43\% & 5.2\% & 6.37\% \\  & & ACTS-10 & 4.39\% & 9.84\% & 10.9\% \\  & & ACTS-20 & 4.26\% & 9.71\% & 11.17\% \\  & & ACTS-10 & 2.74\% & 3.63\% & 5.91\% \\  & & ACTS-20 & 2.74\% & 3.63\% & 5.91\% \\  & & ACTS-50 & 2.74\% & 3.63\% & 5.91\% \\ \hline \multirow{6}{*}{PGD} & \multirow{2}{*}{InceptionV3} & ACTS-10 & 0.91\% & 3.25\% & 4.81\% \\  & & ACTS-20 & 0.91\% & 3.25\% & 4.42\% \\  & & ACTS-50 & 0.91\% & 2.99\% & 4.68\% \\  & & ACTS-10 & 0.93\% & 5.32\% & 6.12\% \\  & & ACTS-20 & 0.93\% & 5.45\% & 6.52\% \\  & & ACTS-50 & 0.93\% & 5.19\% & 6.38\% \\  & & ACTS-10 & 1.3\% & 3.03\% & 4.61\% \\  & & ACTS-20 & 1.44\% & 3.17\% & 4.61\% \\  & & ACTS-50 & 1.44\% & 3.17\% & 4.76\% \\ \hline \hline \end{tabular}
\end{table}
Table 5: Top-_k_ class ACTS Overlap% values in different environments.
## 5 Conclusion and Future Work

In this work, we have proposed the Adversarial Converging Time Score (ACTS) as an instance-specific adversarial robustness metric. ACTS is inspired by the geometrical insight of the output hypersurfaces of a DNN classifier. We perform a comprehensive set of experiments to substantiate the effectiveness and generalization of our proposed metric. Compared to CLEVER, we prove that ACTS can provide a faster and more effective adversarial robustness prediction for different attacks across various DNN models. More importantly, ACTS solves the adversarial robustness problem from a geometrical point of view. We believe it provides a meaningful angle and insight into the adversarial robustness problem, which will help the future work in the same vein.

In the future, we will focus on improving DNN's adversarial performance by leveraging the proposed ACTS. Another interesting direction to look into is extending the ACTS to make it work under black-box attack methods.

## Acknowledgments

This work was supported in part by National Key Research and Development Program of China (2022ZD0210500), the National Natural Science Foundation of China under Grant 61972067/U21A20 491/U1908214, and the Distinguished Young Scholars Funding of Dalian (No. 2022RJ01).

\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{Attack} & \multirow{2}{*}{Model} & \multirow{2}{*}{Metric} & \multicolumn{2}{c}{Overlap\%} & Overlap\% & Overlap\% \\  & & & N1 & N2 & N3 \\ \hline \multirow{8}{*}{FGSM} & & \(L_{2}\) CLEVER & 14.34\% & 15.36\% & 17.80\% \\  & InceptionV3 & \(L_{\infty}\) CLEVER & 13.7\% & 15.88\% & 17.67\% \\  & & ACTS & **1.56\%** & **2.08\%** & **5.2\%** \\  & & \(L_{2}\) CLEVER & 17.11\% & 18.6\% & 19.14\% \\  & ResNet50 & \(L_{\infty}\) CLEVER & 13.61\% & 15.5\% & 17.25\% \\  & & ACTS & **2.39\%** & **7.98\%** & **9.84\%** \\  & & \(L_{2}\) CLEVER & 10.43\% & 11.59\% & 13.48\% \\  & VGG16 & \(L_{\infty}\) CLEVER & 8.99\% & 10.43\% & 12.75\% \\  & & ACTS & **1.3\%** & **3.46\%** & **6.63\%** \\ \hline \multirow{8}{*}{BIM} & & \(L_{2}\) CLEVER & 11.91\% & 12.16\% & 10.88\% \\  & InceptionV3 & \(L_{\infty}\) CLEVER & 11.91\% & 11.65\% & 10.5\% \\  & & ACTS & **1.43\%** & **5.2\%** & **6.37\%** \\  & & \(L_{2}\) CLEVER & 16.44\% & 16.31\% & 14.42\% \\  & ResNet50 & \(L_{\infty}\) CLEVER & 13.34\% & 15.23\% & 13.34\% \\  & & ACTS & **4.39\%** & **9.84\%** & **10.9\%** \\  & & \(L_{2}\) CLEVER & 10.72\% & 11.45\% & 14.2\% \\  & VGG16 & \(L_{\infty}\) CLEVER & 9.13\% & 10.58\% & 13.19\% \\  & & ACTS & **2.74\%** & **3.63\%** & **5.91\%** \\ \hline \multirow{8}{*}{PGD} & & \(L_{2}\) CLEVER & 12.04\% & 11.4\% & 11.91\% \\  & InceptionV3 & \(L_{\infty}\) CLEVER & 11.01\% & 11.27\% & 11.78\% \\  & ACTS & **0.91\%** & **3.25\%** & **4.81\%** \\  & & \(L_{2}\) CLEVER & 14.15\% & 15.77\% & 14.82\% \\  & ResNet50 & \(L_{\infty}\) CLEVER & 12.13\% & 12.94\% & 12.8\% \\  & ACTS & **0.93\%** & **5.32\%** & **6.12\%** \\  & & \(L_{2}\) CLEVER & 7.54\% & 10.14\% & 13.77\% \\  & VGG16 & \(L_{\infty}\) CLEVER & 7.68\% & 8.7\% & 12.17\% \\  & ACTS & **1.3\%** & **3.03\%** & **4.61\%** \\ \hline \hline \end{tabular}
\end{table}
Table 7: Comparing ACTS with CLEVER Overlap% values in different adversarial environments.