GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models

ZAITANG LI1, Pin-Yu Chen2, Tsung-Yi Ho1,
1The Chinese University of Hong Kong, 2IBM Research
Paper arXiv

Abstract

Current studies on adversarial robustness mainly focus on aggregating local robustness results from a set of data samples to evaluate and rank different models. However, the local statistics may not well represent the true global robustness of the underlying unknown data distribution. To address this challenge, this paper makes the first attempt to present a new framework, called GREAT Score, for global robustness evaluation of adversarial perturbation using generative models. Formally, GREAT Score carries the physical meaning of a global statistic capturing a mean certified attack-proof perturbation level over all samples drawn from a generative model. For finite-sample evaluation, we also derive a probabilistic guarantee on the sample complexity and the difference between the sample mean and the true mean. GREAT Score has several advantages: (1) Robustness evaluations using GREAT Score are efficient and scalable to large models, by sparing the need of running adversarial attacks. In particular, we show high correlation and significantly reduced computation cost of GREAT Score when compared to the attack-based model ranking on RobustBench1. (2) The use of generative models facilitates the approximation of the unknown data distribution. In our ablation study with different generative adversarial networks (GANs), we observe consistency between global robustness evaluation and the quality of GANs. (3) GREAT Score can be used for remote auditing of privacy-sensitive black-box models, as demonstrated by our robustness evaluation on several online facial recognition services.

1 Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., & Hein, M. (2021). RobustBench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2). https://openreview.net/forum?id=SSKZPJCt7B

Method Overview of BEYOND

Method Overview of BEYOND

Figure 2. Overview of BEYOND. First, we augment the input image to obtain a bunch of its neighbors. Then, we perform the label consistency detection mechanism on the classifier’s prediction of the input image and that of neighbors predicted by SSL’s classification head. Meanwhile, the representation similarity mechanism employs cosine distance to measure the similarity among the input image and its neighbors. Finally, The input image with poor label consistency or representation similarity is flagged as AE.

GREAT Score Results

Table 1. Comparison of (Calibrated) GREAT Score v.s. minimal distortion found by CW attack on CIFAR-10. The results are averaged over 500 samples from StyleGAN2.
Model Name RobustBench Accuracy(%) AutoAttack Accuracy(%) GREAT Score Calibrated GREAT Score CW Distortion
Rebuffi_extra 82.32 87.20 0.507 1.216 1.859
Gowal_extra 80.53 85.60 0.534 1.213 1.324
Rebuffi_70_ddpm 80.42 90.60 0.451 1.208 1.943
Rebuffi_28_ddpm 78.80 90.00 0.424 1.214 1.796
Augustin_WRN_extra 78.79 86.20 0.525 1.206 1.340
Sehwag 77.24 89.20 0.227 1.143 1.392
Augustin_WRN 76.25 86.40 0.583 1.206 1.332
Rade 76.15 86.60 0.413 1.200 1.486
Rebuffi_R18 75.86 87.60 0.369 1.210 1.413
Gowal 74.50 86.40 0.124 1.116 1.253
Sehwag_R18 74.41 88.60 0.236 1.135 1.343
Wu2020Adversarial 73.66 84.60 0.128 1.110 1.369
Augustin2020Adversarial 72.91 85.20 0.569 1.199 1.285
Engstrom2019Robustness 69.24 82.20 0.160 1.020 1.084
Rice2020Overfitting 67.68 81.80 0.152 1.040 1.097
Rony2019Decoupling 66.44 79.20 0.275 1.101 1.165
Ding2020MMA 66.09 77.60 0.112 0.909 1.095
Comparison of local GREAT Score and CW attack

Figure 2. Comparison of local GREAT Score and CW attack in L2 perturbation on CIFAR-10 with Rebuffi_extra model. The x-axis is the image id. The result shows the local GREAT Score is indeed a lower bound of the perturbation level found by CW attack.

Robustness Certificate Definition

GREAT Score is designed to evaluate the global robustness of classifiers against adversarial attacks. It uses generative models to estimate a certified lower bound on true global robustness. For a K-way classifier f, we define a local robustness score g(G(z)) for a generated sample G(z), where G is a generator and z is sampled from a standard Gaussian distribution. This score measures the confidence gap between the correct class prediction and the most likely incorrect class. The GREAT Score, defined as the expectation of g(G(z)) over z, provides a certified lower bound on the true global robustness with respect to the data distribution learned by the generative model. This approach allows us to estimate global robustness without knowing the exact data distribution or minimal perturbations for each sample.

$$ \displaystyle \Omega(f) = \mathbb{E}_{x\sim P}[\Delta_{min}(x)]= \int_{x \sim P} \Delta_{\min}(x) p(x)dx $$

where f is a classifier, P is a data distribution, and Δmin(x) is the minimal perturbation for a sample x.

Performance of BEYOND against Adaptive Attacks

We evaluate the detection performance of BEYOND against adaptive attacks on different datasets and show the ROC curves under different perturbation budgets as follows:

Loading...

BibTeX

@article{li2024greatscore,
  title     = {GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models},
  author    = {Zaitang, Li and Pin-Yu, Chen and Tsung-Yi, Ho},
  journal   = {NeurIPS},
  year      = {2024},
}