RobustBench: a standardized adversarial robustness benchmark

By Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Mung Chiang, Prateek Mittal, Matthias Hein. NeurIPS Datasets and Benchmarks, 2020

928 citations recorded by the source corpus.

Evaluation of adversarial robustness is often error-prone leading to overestimation of the true robustness of models. While adaptive attacks designed for a particular defense are a way out of this, there are only approximate guidelines on how to perform them. Moreover, adaptive evaluations are highly customized for particular models, which makes it difficult to compare different defenses. Our goal is to establish a standardized benchmark of adversarial robustness, which as accurately as possible reflects the robustness of the considered models within a reasonable computational budget. This requires to impose some restrictions on the admitted models to rule out defenses that only make gradient-based attacks ineffective without improving actual robustness. We evaluate robustness of models for our benchmark with AutoAttack, an ensemble of white- and black-box attacks which was recently shown in a large-scale study to improve almost all robustness evaluations compared to the original publications. Our leaderboard, hosted at this http URL, aims at reflecting the current state of the art on a set of well-defined tasks in $\ell_\infty$- and $\ell_2$-threat models with possible extensions in the future. Additionally, we open-source the library this http URL that provides unified access to state-of-the-art robust models to facilitate their downstream applications. Finally, based on the collected models, we analyze general trends in $\ell_p$-robustness and its impact on other tasks such as robustness to various distribution shifts and out-of-distribution detection.

Subfields: Artificial Intelligence, Emergency Medicine

View Paper: https://www.semanticscholar.org/paper/2aab97e35c43d961d645e650808d5b052ec180ab

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Matthias Hein
2. Bernt Schiele
3. Percy Liang
4. Bo Li
5. Luc Van Gool
6. Mohit Bansal
7. Tianyu Pang
8. Quoc V. Le

In Emergency Medicine

1. Jacob Steinhardt

Citations in the corpus

• Interpretable deep learning: interpretation, interpretability, trustworthiness, and beyond (2021, methodology): “Perturbation-based examples can therefore be used for the trustworthiness evaluations of interpretation algorithms [41, 70, 143, 172].”
• Continual Test-Time Domain Adaptation (2022, methodology): “The ImageNet-to-ImageNet-C [15] experiments use the standard pre-trained resnet50 model in RobustBench [8].”
• SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks (2023, background): “36 [61] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein.”
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (2024, methodology): “In the field of image classification, benchmarks such as RobustBench (Croce et al., 2021) provide a unified platform for both evaluating the robustness of models in a standardized manner and for tracking state-of-the-art performance.”
• Better Diffusion Models Further Improve Adversarial Training (2023, methodology): “We use WRN-28-10 and WRN-70-16, the two most common architectures on RobustBench (Croce et al., 2021).”
• Adversarial Robustness with Semi-Infinite Constrained Learning (2021, methodology): “The third approximation of Algorithm 1, or more precisely, ( (cid:99) DI), is the use of a fixed ν > 0 , e.g., [53, 54, 95].”
• Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks (2024, positive): “R2D2 uses adversarial training (Madry et al., 2018), a technique effective for obtaining vision models robust to ℓ p -bounded adversarial perturbations (Madry et al., 2018; Croce et al., 2021), to make LLMs more robust to jailbreak attacks.”
• Unsolved Problems in ML Safety (2021, background): “Future research could do more work toward creating models with adversarially robust representations [41].”
• Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “B and C report RErr and RLoss, together with our average-and worst-case flatness (of RLoss) measures for the evaluated, pre-trained models from RobustBench [18].”
• Data Augmentation Can Improve Robustness (2021, methodology): “…we make the following contributions: • We demonstrate that, when combined with model weight averaging, data augmentation techniques such as Cutout [15], CutMix [57] and MixUp [61] [11] against A UTO A TTACK [10] on C IFAR -10 with ∞ perturbations of size 8 / 255 displayed in publication order.”
• Diffusion Models for Adversarial Purification (2022, methodology): “Particularly, we compare with the state-of-the-art defense methods reported by the standardized benchmark RobustBench (Croce et al., 2020) on CIFAR-10 and Ima-geNet while comparing with other adversarial purification methods on CIFAR-10 and CelebA-HQ following their settings.”
• Visual Adversarial Examples Jailbreak Aligned Large Language Models (2023, background): “Despite some advancements in adversarial training [49; 20] and robustness certification [19; 15; 79; 45] for adversarial defense, we note that their cost is prohibitive for modern models of the LLM scale.”
• WILDS: A Benchmark of in-the-Wild Distribution Shifts (2020, neutral): “Benchmarks for adversarial robustness also fall in this category of distribution shifts from transformations (Goodfellow et al., 2015; Croce et al., 2020).”
• Fixing Data Augmentation to Improve Adversarial Robustness (2021, methodology): “4https://robustbench.github.io/ (Croce et al., 2020) 5Our models and generated data will be available at https://github. com/deepmind/deepmind-research/tree/master/adversarial robustness”
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal (2024, neutral): “(2023) have been proposed, along with numerous robustness benchmarks (Kaufmann et al., 2019; Croce et al., 2020).”
• Improving Robustness using Generated Data (2021, background): “Most remarkably, despite not using any external data, against ∞ = 8/255, our best model beats all RobustBench [17] entries that used external data (see Table 6 in the appendix).”
• Trustworthy AI: From Principles to Practices (2021, background): “Development Functional Testing [164, 235, 381] Performance Benchmarking [40, 56, 88, 93, 123, 127, 153, 238, 248, 307, 327]”