Dl Framework Robustness Eval

dl-framework-robustness-eval

An Orchestrated Empirical Study on Deep Learning Frameworks and Platforms — Qianyu Guo et al. (2018) (arXiv:1811.05187, 2018)

What this evaluates

Evaluates the robustness of deep learning models trained on different frameworks (TensorFlow, Theano, Torch) against adversarial attacks. It measures how well models maintain correct predictions when subjected to white-box, black-box, and decision-based perturbations.

Datasets

• MNIST — total ?; splits: test (-1)
• CIFAR-10 — total ?; splits: test (-1)

Metrics

• robustness indicator R(m_i) (primary) — range: other
  • R(m_i) = sum_{j=1 to k} P(m_i, A_j), where P normalizes the attack success rate S_A^m_i between the min and max success rates across all compared models for attack A_j. If min equals max, P is 0. Lower R indicates better robustness.

Input / output format

Input: 1000 randomly selected correctly classified images from the validation/test set of MNIST or CIFAR-10.

Output: Model predictions (class labels) after applying adversarial perturbations generated by FGSM, Single-Pixel-Attack, and Boundary-Attack.

Scoring recipe

def compute_robustness_indicator(success_rates, models, attacks):
    R = {m: 0.0 for m in models}
    for A in attacks:
        rates = [success_rates[(m, A)] for m in models]
        min_r, max_r = min(rates), max(rates)
        for m in models:
            if min_r < max_r:
                R[m] += (success_rates[(m, A)] - min_r) / (max_r - min_r)
            else:
                R[m] += 0
    return R

Common pitfalls

• The robustness indicator R(m_i) is relative to the specific set of models being compared in a given experiment, not an absolute score.
• Attack success rates must be averaged over 10 repetitions to reduce randomness before computing the indicator.
• Only images that are correctly predicted by all compared models are used as inputs for the attacks.

Evidence (verbatim from paper)

For each dataset, we randomly select 1000 images, which are predicted correctly by all the models, as the inputs of aforementioned attacks. To reduce randomness during the attack, each attack is repeated 10 times. ... R(m_i) quantifies the robustness of m_i in terms of attacks A_1,...,A_n, also known as the robustness indicator. The smaller value R(m_i) is, the better robustness it exhibits.

Citation

@misc{guo2018orchestrated,
  title={An Orchestrated Empirical Study on Deep Learning Frameworks and Platforms},
  author={Qianyu Guo et al. (2018)},
  year={2018},
  note={arXiv:1811.05187}
}

• arXiv: 1811.05187