Is Robustness the Cost of Accuracy? - A Comprehensive Study on the Robustness of 18 Deep Image Classification Models

By Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, Yupeng Gao. 2018

421 citations recorded by the source corpus.

The prediction accuracy has been the long-lasting and sole standard for comparing the performance of different image classification models, including the ImageNet competition. However, recent studies have highlighted the lack of robustness in well-trained deep neural networks to adversarial examples. Visually imperceptible perturbations to natural images can easily be crafted and mislead the image classifiers towards misclassification. To demystify the trade-offs between robustness and accuracy, in this paper we thoroughly benchmark 18 ImageNet models using multiple robustness metrics, including the distortion, success rate and transferability of adversarial examples between 306 pairs of models. Our extensive experimental results reveal several new insights: (1) linear scaling law - the empirical \(\ell _2\) and \(\ell _\infty \) distortion metrics scale linearly with the logarithm of classification error; (2) model architecture is a more critical factor to robustness than model size, and the disclosed accuracy-robustness Pareto frontier can be used as an evaluation criterion for ImageNet model designers; (3) for a similar network architecture, increasing network depth slightly improves robustness in \(\ell _\infty \) distortion; (4) there exist models (in VGG family) that exhibit high adversarial transferability, while most adversarial examples crafted from one model can only be transferred within the same family. Experiment code is publicly available at https://github.com/huanzhang12/Adversarial_Survey.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Natural Adversarial Examples (2019, background): “, 2018 [47] remind us that most p adversarial examples crafted from one model can only be transferred within the same family of models.”
Towards Robust Vision Transformer (2021, background): “…study on the robustness of CNNs and aim to strengthen it in different ways, e.g., stronger data augmentation [16, 18, 33], carefully designed [36,44] or searched [9,13] network architecture, improved training strategy [22, 26, 47], quantization [24] and pruning [49] of the weights, better…”
Robustness May Be at Odds with Accuracy (2018, background): “Su et al. (2018) empirically observe a similar trade-oﬀ between the accuracy and robustness of standard models across diﬀerent deep architectures on ImageNet.”
Theoretically Principled Trade-off between Robustness and Accuracy (2019, background): “This has led to an empirical line of work on adversarial defense that incorporates various kinds of assumptions (Su et al., 2018; Kurakin et al., 2017).”
Identifying Statistical Bias in Dataset Replication (2020, background): “Previous work has characterized cross-dataset generalization(Torralba & Efros, 2011), and explored the impact of synthetic perturbations on generalization, such as adversarial examples (Kurakin et al., 2016; Tsipras et al., 2019; Ilyas et al., 2019; Su et al., 2018) or various other corruption robus”
Few-shot learning with adaptively initialized task optimizer: a practical meta-learning approach (2019, background): “…applied in various ﬁelds, like long-tail class-imbalance classiﬁcation (Wang et al. 2017b; Ren et al. 2018), domain adaptation (Motiian et al. 2017; Zhang et al. 2018), intimation learning (Yu et al. 2018), density estimation (Reed et al. 2017), unsupervised learning (Garg…”
Adversarial Examples on Object Recognition (2020, positive): “The results are strengthened by Su et al. [157] who run a large scale study of transferability between diﬀerent DNN architectures and show that targeted adversarial examples do not transfer between architectures.”
Bridging Adversarial Robustness and Gradient Interpretability (2019, background): “Previous works have observed that there may be a trade-off between accuracy and adversarial robustness (Tsipras et al., 2018; Su et al., 2018).”
Beyond Preserved Accuracy: Evaluating Loyalty and Robustness of BERT Compression (2021, background): “Previous work (Su et al., 2018) found that small convolutional neural networks (CNN) are more vulnerable to adversarial attacks compared to bigger ones.”
Explainable, trustworthy, and ethical machine learning for healthcare: A survey (2021, background): “In addition, the trade-off analysis between the accuracy and adversarial robustness of eighteen well known ImageNet classiﬁers with different metrics is presented in [83].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, background): “Moreover, a number of studies reported the relation between these two properties (Tsipras et al., 2018; Su et al., 2018; Stutz et al., 2019; Zhang et al., 2019b).”
Toward Interpretable Machine Learning: Transparent Deep Neural Networks and Beyond (2020, background): “are (a) robustness of the system to measurement artefacts or adversarial perturbations [141], (b) resilience to drifting data distributions [40], (c) ability to accurately assess the confidence of its own predictions [111], [107], (d) safety and security aspects [19], [66], [23], [153], (e) legal re”
When NAS Meets Robustness: In Search of Robust Architectures Against Adversarial Attacks (2019, background): “It has been observed in many previous studies [30, 21] that, within the same family of architectures, increasing the number of parameters of the network would bring improvement of robustness.”
Batch Normalization is a Cause of Adversarial Vulnerability (2019, background): “The superior standard test accuracy of these models is somewhat moot given a trade-off between standard test accuracy and robustness, demonstrated in this work and elsewhere (Tanay & Grifﬁn, 2016; Galloway et al., 2018; Su et al., 2018; Tsipras et al., 2019).”
AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks (2018, background): “However, its attack performance can be severely degraded due to poor attack transferability (Su et al. 2018).”