Spaces:
Running
Running
| <html> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta name="description" | |
| content="Demo Page of GREAT Score Neurips 2024."> | |
| <meta name="keywords" content="GREAT Score, Adversarial robustness, Generative models"> | |
| <meta name="viewport" content="width=device-width, initial-scale=1"> | |
| <title>GREAT Score: Global Robustness Evaluation of | |
| Adversarial Perturbation using Generative Models</title> | |
| <link href="https://fonts.googleapis.com/css?family=Google+Sans|Noto+Sans|Castoro" | |
| rel="stylesheet"> | |
| <link rel="stylesheet" href="./static/css/bulma.min.css"> | |
| <link rel="stylesheet" href="./static/css/bulma-carousel.min.css"> | |
| <link rel="stylesheet" href="./static/css/bulma-slider.min.css"> | |
| <link rel="stylesheet" href="./static/css/fontawesome.all.min.css"> | |
| <link rel="stylesheet" | |
| href="https://cdn.jsdelivr.net/gh/jpswalsh/academicons@1/css/academicons.min.css"> | |
| <link rel="stylesheet" href="./static/css/index.css"> | |
| <link rel="stylesheet" href="./static/css/custom.css"> | |
| <link rel="icon" href="./static/images/favicon.svg"> | |
| <!-- <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script> --> | |
| <script src="https://code.jquery.com/jquery-3.6.0.js"></script> | |
| <script src="https://code.jquery.com/ui/1.13.2/jquery-ui.js"></script> | |
| <script defer src="./static/js/fontawesome.all.min.js"></script> | |
| <script src="./static/js/bulma-carousel.min.js"></script> | |
| <script src="./static/js/bulma-slider.min.js"></script> | |
| <script src="./static/js/index.js"></script> | |
| <!-- for mathjax support --> | |
| <!-- <script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script> --> | |
| <script id="MathJax-script" async src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script> | |
| <script> | |
| $(document).ready(function(){ | |
| $('#adaptive-loss-formula-list').on('click', 'a', function(e) { | |
| e.preventDefault(); | |
| if (!$(this).hasClass('selected')) { | |
| $('.formula-content').hide(200); | |
| $('.formula-list > a').removeClass('selected'); | |
| $(this).addClass('selected'); | |
| var target = $(this).attr('href'); | |
| $(target).show(200); | |
| } | |
| }); | |
| $('#adaptive-dataset').on('click', 'a', function(e) { | |
| e.preventDefault(); | |
| if (!$(this).hasClass('selected')) { | |
| $('.interpolation-video-column').hide(); | |
| $('#adaptive-dataset > a').removeClass('selected'); | |
| $(this).addClass('selected'); | |
| var target = $(this).attr('href'); | |
| $(target).show(); | |
| } | |
| }); | |
| }) | |
| </script> | |
| <style type="text/css"> | |
| .tg {border-collapse:collapse;border-spacing:0;} | |
| .tg td{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px; | |
| overflow:hidden;padding:10px 5px;word-break:normal;} | |
| .tg th{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px; | |
| font-weight:normal;overflow:hidden;padding:10px 5px;word-break:normal;} | |
| .tg .tg-baqh{text-align:center;vertical-align:top} | |
| .tg .tg-amwm{font-weight:bold;text-align:center;vertical-align:top} | |
| .tg .tg-2imo{font-style:italic;text-align:center;text-decoration:underline;vertical-align:top} | |
| </style> | |
| </head> | |
| <body> | |
| <section class="hero"> | |
| <div class="hero-body"> | |
| <div class="container is-max-desktop"> | |
| <div class="columns is-centered"> | |
| <div class="column has-text-centered"> | |
| <h1 class="title is-1 publication-title">GREAT Score: Global Robustness Evaluation of | |
| Adversarial Perturbation using Generative Models</h1> | |
| <div class="is-size-5 publication-authors"> | |
| <span class="author-block"> | |
| <a href="#" target="_blank">ZAITANG LI</a><sup>1</sup>,</span> | |
| <span class="author-block"> | |
| <a href="https://sites.google.com/site/pinyuchenpage/home" target="_blank">Pin-Yu Chen</a><sup>2</sup>, | |
| </span> | |
| <span class="author-block"> | |
| <a href="https://tsungyiho.github.io/" target="_blank">Tsung-Yi Ho</a><sup>1</sup>, | |
| </span> | |
| </div> | |
| <div class="is-size-5 publication-authors"> | |
| <span class="author-block"><sup>1</sup>The Chinese University of Hong Kong,</span> | |
| <span class="author-block"><sup>2</sup>IBM Research</span> | |
| </div> | |
| <div class="column has-text-centered"> | |
| <div class="publication-links"> | |
| <!-- PDF Link. --> | |
| <span class="link-block"> | |
| <a href="https://arxiv.org/abs/2304.09875" target="_blank" | |
| class="external-link button is-normal is-rounded is-dark"> | |
| <span class="icon"> | |
| <i class="fas fa-file-pdf"></i> | |
| </span> | |
| <span>Paper</span> | |
| </a> | |
| </span> | |
| <span class="link-block"> | |
| <a href="https://arxiv.org/abs/2304.09875" target="_blank" | |
| class="external-link button is-normal is-rounded is-dark"> | |
| <span class="icon"> | |
| <i class="ai ai-arxiv"></i> | |
| </span> | |
| <span>arXiv</span> | |
| </a> | |
| </span> | |
| <!-- Video Link. --> | |
| <!-- <span class="link-block"> | |
| <a href="https://www.youtube.com/watch?v=MrKrnHhk8IA" target="_blank" | |
| class="external-link button is-normal is-rounded is-dark"> | |
| <span class="icon"> | |
| <i class="fab fa-youtube"></i> | |
| </span> | |
| <span>Video</span> | |
| </a> | |
| </span> --> | |
| <!-- Code Link. --> | |
| <!-- <span class="link-block"> | |
| <a href="https://github.com/google/nerfies" target="_blank" | |
| class="external-link button is-normal is-rounded is-dark"> | |
| <span class="icon"> | |
| <i class="fab fa-github"></i> | |
| </span> | |
| <span>Code</span> | |
| </a> | |
| </span> --> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- <section class="hero teaser"> | |
| <div class="container is-max-desktop"> | |
| <div class="hero-body"> | |
| <video id="teaser" autoplay muted loop playsinline height="100%"> | |
| <source src="./static/videos/teaser.mp4" | |
| type="video/mp4"> | |
| </video> | |
| <h2 class="subtitle has-text-centered"> | |
| <span class="dnerf">Nerfies</span> turns selfie videos from your phone into | |
| free-viewpoint | |
| portraits. | |
| </h2> | |
| </div> | |
| </div> | |
| </section> --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <!-- Abstract. --> | |
| <div class="columns is-centered has-text-centered"> | |
| <div class="column is-four-fifths"> | |
| <h2 class="title is-3">Abstract</h2> | |
| <div class="content has-text-justified"> | |
| <p> | |
| Current studies on adversarial robustness mainly focus on aggregating <i>local</i> robustness results from a set of data samples to evaluate and rank different models. However, the local statistics may not well represent the true <i>global</i> robustness of the underlying unknown data distribution. To address this challenge, this paper makes the first attempt to present a new framework, called <strong>GREAT Score</strong>, for global robustness evaluation of adversarial perturbation using generative models. Formally, GREAT Score carries the physical meaning of a global statistic capturing a mean certified attack-proof perturbation level over all samples drawn from a generative model. For finite-sample evaluation, we also derive a probabilistic guarantee on the sample complexity and the difference between the sample mean and the true mean. GREAT Score has several advantages: (1) Robustness evaluations using GREAT Score are efficient and scalable to large models, by sparing the need of running adversarial attacks. In particular, we show high correlation and significantly reduced computation cost of GREAT Score when compared to the attack-based model ranking on RobustBench<sup>1</sup>. (2) The use of generative models facilitates the approximation of the unknown data distribution. In our ablation study with different generative adversarial networks (GANs), we observe consistency between global robustness evaluation and the quality of GANs. (3) GREAT Score can be used for remote auditing of privacy-sensitive black-box models, as demonstrated by our robustness evaluation on several online facial recognition services. | |
| </p> | |
| </div> | |
| <!-- References --> | |
| <div class="content"> | |
| <p> | |
| <sup>1</sup> Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., & Hein, M. (2021). RobustBench: a standardized adversarial robustness benchmark. In <i>Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2)</i>. <a href="https://openreview.net/forum?id=SSKZPJCt7B" target="_blank">https://openreview.net/forum?id=SSKZPJCt7B</a> | |
| </p> | |
| </div> | |
| </div> | |
| </div> | |
| <!--/ Abstract. --> | |
| </div> | |
| </section> | |
| <!-- Overview --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <h2 class="title is-3">Method Overview of GREAT Score</h2> | |
| <div class="columns is-centered"> | |
| <div class="column container-centered"> | |
| <img src="./static/images/GREAT_Score_overview.png" alt="Method Overview of GREAT Score"/> | |
| <p><strong>Figure 1. Overview of GREAT Score.</strong> The process involves three main steps: | |
| (1) Data Generation: We use a generative model to create synthetic samples. | |
| (2) Local Robustness Evaluation: For each generated sample, we calculate a local robustness score based on the classifier's confidence. | |
| (3) Global Robustness Estimation: We aggregate the local scores to estimate the overall robustness of the classifier. | |
| This method provides a certified lower bound on the true global robustness without requiring access to the original dataset or exhaustive adversarial attacks.</p> | |
| </div> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- Overview --> | |
| <!-- Robustness Certificate Definition --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <h2 class="title is-3">Robustness Certificate Definition</h2> | |
| <div class="columns is-centered"> | |
| <div class="column container formula"> | |
| <p> | |
| GREAT Score is designed to evaluate the global robustness of classifiers against adversarial attacks. It uses generative models to estimate a certified lower bound on true global robustness. For a K-way classifier f, we define a local robustness score g(G(z)) for a generated sample G(z), where G is a generator and z is sampled from a standard Gaussian distribution. This score measures the confidence gap between the correct class prediction and the most likely incorrect class. The GREAT Score, defined as the expectation of g(G(z)) over z, provides a certified lower bound on the true global robustness with respect to the data distribution learned by the generative model. This approach allows us to estimate global robustness without knowing the exact data distribution or minimal perturbations for each sample. | |
| </p> | |
| </div> | |
| </div> | |
| <div class="columns is-centered"> | |
| <div class="column container-centered"> | |
| <div id="adaptive-loss-formula" class="container"> | |
| <div id="adaptive-loss-formula-list" class="row align-items-center formula-list"> | |
| <a href=".true-global-robustness" class="selected">True Global Robustness</a> | |
| <a href=".global-robustness-estimate">Global Robustness Estimate</a> | |
| <a href=".local-robustness-score">Local Robustness Score</a> | |
| <div style="clear: both"></div> | |
| </div> | |
| <div class="row align-items-center adaptive-loss-formula-content"> | |
| <span class="formula true-global-robustness formula-content"> | |
| $$ | |
| \displaystyle | |
| \Omega(f) = \mathbb{E}_{x\sim P}[\Delta_{min}(x)]= \int_{x \sim P} \Delta_{\min}(x) p(x)dx | |
| $$ | |
| </span> | |
| <span class="formula global-robustness-estimate formula-content" style="display: none;"> | |
| $$ | |
| \displaystyle | |
| \widehat{\Omega}(f) = \mathbb{E}_{x\sim P}[g(x)]= \int_{x \sim P} g(x) p(x)dx | |
| $$ | |
| </span> | |
| <span class="formula local-robustness-score formula-content" style="display: none;"> | |
| $$ | |
| \displaystyle | |
| g\left(G(z)\right) = \sqrt{\cfrac{\pi}{2}} \cdot \max\{ f_c(G(z)) - \max_{k \in \{1,\ldots,K\},k\neq c} f_k(G(z)),0 \} | |
| $$ | |
| </span> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| <div class="columns is-centered"> | |
| <div class="column container adaptive-loss-formula-content"> | |
| <p class="formula true-global-robustness formula-content"> | |
| where f is a classifier, P is a data distribution, and Δ<sub>min</sub>(x) is the minimal perturbation for a sample x. | |
| </p> | |
| <p class="formula global-robustness-estimate formula-content" style="display: none"> | |
| where g(x) is a local robustness statistic, and this estimate is used when the exact probability density function of P and local minimal perturbations are unknown. | |
| </p> | |
| <p class="formula local-robustness-score formula-content" style="display: none;"> | |
| where G(z) is a generated data sample, f<sub>c</sub> is the confidence score for the correct class c, and f<sub>k</sub> are the confidence scores for other classes. | |
| </p> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- Results --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <h2 class="title is-3">GREAT Score Results</h2> | |
| <div class="columns is-centered"> | |
| <div class="column container-centered"> | |
| <table class="tg" border="1" style="width:100%;"> | |
| <caption><strong>Table 1.</strong> Comparison of (Calibrated) GREAT Score v.s. minimal distortion found by CW attack on CIFAR-10. The results are averaged over 500 samples from StyleGAN2.</caption> | |
| <thead> | |
| <tr> | |
| <th class="tg-amwm">Model Name</th> | |
| <th class="tg-baqh">RobustBench Accuracy(%)</th> | |
| <th class="tg-baqh">AutoAttack Accuracy(%)</th> | |
| <th class="tg-baqh">GREAT Score</th> | |
| <th class="tg-baqh">Calibrated GREAT Score</th> | |
| <th class="tg-baqh">CW Distortion</th> | |
| </tr> | |
| </thead> | |
| <tbody> | |
| <tr> | |
| <td class="tg-baqh">Rebuffi_extra</td> | |
| <td class="tg-baqh">82.32</td> | |
| <td class="tg-baqh">87.20</td> | |
| <td class="tg-baqh">0.507</td> | |
| <td class="tg-baqh">1.216</td> | |
| <td class="tg-baqh">1.859</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Gowal_extra</td> | |
| <td class="tg-baqh">80.53</td> | |
| <td class="tg-baqh">85.60</td> | |
| <td class="tg-baqh">0.534</td> | |
| <td class="tg-baqh">1.213</td> | |
| <td class="tg-baqh">1.324</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rebuffi_70_ddpm</td> | |
| <td class="tg-baqh">80.42</td> | |
| <td class="tg-baqh">90.60</td> | |
| <td class="tg-baqh">0.451</td> | |
| <td class="tg-baqh">1.208</td> | |
| <td class="tg-baqh">1.943</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rebuffi_28_ddpm</td> | |
| <td class="tg-baqh">78.80</td> | |
| <td class="tg-baqh">90.00</td> | |
| <td class="tg-baqh">0.424</td> | |
| <td class="tg-baqh">1.214</td> | |
| <td class="tg-baqh">1.796</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Augustin_WRN_extra</td> | |
| <td class="tg-baqh">78.79</td> | |
| <td class="tg-baqh">86.20</td> | |
| <td class="tg-baqh">0.525</td> | |
| <td class="tg-baqh">1.206</td> | |
| <td class="tg-baqh">1.340</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Sehwag</td> | |
| <td class="tg-baqh">77.24</td> | |
| <td class="tg-baqh">89.20</td> | |
| <td class="tg-baqh">0.227</td> | |
| <td class="tg-baqh">1.143</td> | |
| <td class="tg-baqh">1.392</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Augustin_WRN</td> | |
| <td class="tg-baqh">76.25</td> | |
| <td class="tg-baqh">86.40</td> | |
| <td class="tg-baqh">0.583</td> | |
| <td class="tg-baqh">1.206</td> | |
| <td class="tg-baqh">1.332</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rade</td> | |
| <td class="tg-baqh">76.15</td> | |
| <td class="tg-baqh">86.60</td> | |
| <td class="tg-baqh">0.413</td> | |
| <td class="tg-baqh">1.200</td> | |
| <td class="tg-baqh">1.486</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rebuffi_R18</td> | |
| <td class="tg-baqh">75.86</td> | |
| <td class="tg-baqh">87.60</td> | |
| <td class="tg-baqh">0.369</td> | |
| <td class="tg-baqh">1.210</td> | |
| <td class="tg-baqh">1.413</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Gowal</td> | |
| <td class="tg-baqh">74.50</td> | |
| <td class="tg-baqh">86.40</td> | |
| <td class="tg-baqh">0.124</td> | |
| <td class="tg-baqh">1.116</td> | |
| <td class="tg-baqh">1.253</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Sehwag_R18</td> | |
| <td class="tg-baqh">74.41</td> | |
| <td class="tg-baqh">88.60</td> | |
| <td class="tg-baqh">0.236</td> | |
| <td class="tg-baqh">1.135</td> | |
| <td class="tg-baqh">1.343</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Wu2020Adversarial</td> | |
| <td class="tg-baqh">73.66</td> | |
| <td class="tg-baqh">84.60</td> | |
| <td class="tg-baqh">0.128</td> | |
| <td class="tg-baqh">1.110</td> | |
| <td class="tg-baqh">1.369</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Augustin2020Adversarial</td> | |
| <td class="tg-baqh">72.91</td> | |
| <td class="tg-baqh">85.20</td> | |
| <td class="tg-baqh">0.569</td> | |
| <td class="tg-baqh">1.199</td> | |
| <td class="tg-baqh">1.285</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Engstrom2019Robustness</td> | |
| <td class="tg-baqh">69.24</td> | |
| <td class="tg-baqh">82.20</td> | |
| <td class="tg-baqh">0.160</td> | |
| <td class="tg-baqh">1.020</td> | |
| <td class="tg-baqh">1.084</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rice2020Overfitting</td> | |
| <td class="tg-baqh">67.68</td> | |
| <td class="tg-baqh">81.80</td> | |
| <td class="tg-baqh">0.152</td> | |
| <td class="tg-baqh">1.040</td> | |
| <td class="tg-baqh">1.097</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Rony2019Decoupling</td> | |
| <td class="tg-baqh">66.44</td> | |
| <td class="tg-baqh">79.20</td> | |
| <td class="tg-baqh">0.275</td> | |
| <td class="tg-baqh">1.101</td> | |
| <td class="tg-baqh">1.165</td> | |
| </tr> | |
| <tr> | |
| <td class="tg-baqh">Ding2020MMA</td> | |
| <td class="tg-baqh">66.09</td> | |
| <td class="tg-baqh">77.60</td> | |
| <td class="tg-baqh">0.112</td> | |
| <td class="tg-baqh">0.909</td> | |
| <td class="tg-baqh">1.095</td> | |
| </tr> | |
| </tbody> | |
| </table> | |
| </div> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- Results --> | |
| <!-- Model Ranking Comparison Section --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <h2 class="title is-3">Model Ranking Comparison</h2> | |
| <div class="columns is-centered"> | |
| <div class="column is-full-width"> | |
| <div class="content has-text-justified"> | |
| <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth"> | |
| <caption><strong>Table 2.</strong> Spearman's rank correlation coefficient on CIFAR-10 using GREAT Score, RobustBench (with test set), and Auto-Attack (with generated samples).</caption> | |
| <thead> | |
| <tr> | |
| <th></th> | |
| <th>Uncalibrated</th> | |
| <th>Calibrated</th> | |
| </tr> | |
| </thead> | |
| <tbody> | |
| <tr> | |
| <td>GREAT Score vs. RobustBench Correlation</td> | |
| <td>0.6618</td> | |
| <td>0.8971</td> | |
| </tr> | |
| <tr> | |
| <td>GREAT Score vs. AutoAttack Correlation</td> | |
| <td>0.3690</td> | |
| <td>0.6941</td> | |
| </tr> | |
| <tr> | |
| <td>RobustBench vs. AutoAttack Correlation</td> | |
| <td>0.7296</td> | |
| <td>0.7296</td> | |
| </tr> | |
| </tbody> | |
| </table> | |
| <p> | |
| We compare the model ranking on CIFAR-10 using GREAT Score (evaluated with generated samples), RobustBench (evaluated with Auto-Attack on the test set), and Auto-Attack (evaluated with Auto-Attack on generated samples). | |
| Table 2 presents their mutual rank correlation (higher value means more aligned ranking) with calibrated and uncalibrated versions. | |
| We note that there is an innate discrepancy between Spearman's rank correlation coefficient (way below 1) of RobustBench vs. Auto-Attack, which means Auto-Attack will give inconsistent model rankings when evaluated on different data samples. In addition, GREAT Score measures <em>classification margin</em>, while AutoAttack measures <em>accuracy</em> under a fixed perturbation budget ε. AutoAttack's ranking will change if we use different ε values. E.g., comparing the ranking of ε=0.3 and ε=0.7 on 10000 CIFAR-10 test images for AutoAttack, the Spearman's correlation is only 0.9485. Therefore, we argue that GREAT Score and AutoAttack are <em>complementary</em> evaluation metrics and they don't need to match perfectly. | |
| Despite their discrepancy, before calibration, the correlation between GREAT Score and RobustBench yields a similar value. With calibration, there is a significant improvement in rank correlation between GREAT Score to Robustbench and Auto-Attack, respectively. | |
| </p> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- Model Ranking Comparison Section --> | |
| <!-- GREAT Score vs CW Attack Comparison Section --> | |
| <section class="section"> | |
| <div class="container is-max-desktop"> | |
| <h2 class="title is-3">GREAT Score vs CW Attack Comparison</h2> | |
| <div class="columns is-centered"> | |
| <div class="column container-centered"> | |
| <div> | |
| <img src="./static/images/new_figure_2_2.png" | |
| class="method_overview" | |
| alt="Comparison of local GREAT Score and CW attack"/> | |
| <p> | |
| <strong>Figure 2.</strong> Comparison of local GREAT Score and CW attack in L<sub>2</sub> perturbation on CIFAR-10 with Rebuffi_extra model. | |
| The x-axis is the image id. The result shows the local GREAT Score is indeed a lower bound of the perturbation level found by CW attack. | |
| </p> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </section> | |
| <!-- GREAT Score vs CW Attack Comparison Section --> | |
| <section class="section" id="BibTeX"> | |
| <div class="container is-max-desktop content"> | |
| <h2 class="title">BibTeX</h2> | |
| <pre><code>@article{li2024greatscore, | |
| title = {GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models}, | |
| author = {Zaitang, Li and Pin-Yu, Chen and Tsung-Yi, Ho}, | |
| journal = {NeurIPS}, | |
| year = {2024}, | |
| }</code></pre> | |
| </div> | |
| </section> | |
| <footer class="footer"> | |
| <div class="container"> | |
| <!-- <div class="content has-text-centered"> | |
| <a class="icon-link" target="_blank" | |
| href="./static/videos/nerfies_paper.pdf"> | |
| <i class="fas fa-file-pdf"></i> | |
| </a> | |
| <a class="icon-link" href="https://github.com/keunhong" target="_blank" class="external-link" disabled> | |
| <i class="fab fa-github"></i> | |
| </a> | |
| </div> --> | |
| <div class="columns is-centered"> | |
| <div class="column is-8"> | |
| <div class="content"> | |
| <p> | |
| This website is licensed under a <a rel="license" target="_blank" | |
| href="http://creativecommons.org/licenses/by-sa/4.0/">Creative | |
| Commons Attribution-ShareAlike 4.0 International License</a>. | |
| </p> | |
| <p> | |
| This means you are free to borrow the <a target="_blank" | |
| href="https://github.com/nerfies/nerfies.github.io">source code</a> of this website, | |
| we just ask that you link back to this page in the footer. | |
| Please remember to remove the analytics code included in the header of the website which | |
| you do not want on your website. | |
| </p> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| </footer> | |
| </body> | |
| </html> | |