ROBY: Evaluating the Robustness of a Deep Model by its Decision Boundaries

Abstract

With the successful application of deep learning models in many real-world tasks, the model robustness becomes more and more critical. Often, we evaluate the robustness of the deep models by attacking them with purposely generated adversarial samples, which is computationally costly and dependent on the specific attackers and the model types. This work proposes a generic evaluation metric ROBY, a novel attack-independent robustness measure based on the model's decision boundaries. Independent of adversarial samples, ROBY uses the inter-class and intra-class statistic features to capture the features of the model's decision boundaries. We experimented on ten state-of-the-art deep models and showed that ROBY matches the robustness gold standard of attack success rate (ASR) by a strong first-order generic attacker. with only 1% of time cost. To the best of our knowledge, ROBY is the first lightweight attack-independent robustness evaluation metric that can be applied to a wide range of deep models. The code of ROBY is open sourced at https://github.com/baaaad/ROBY-Evaluating-the-Robustness-of-a-Deep-Model-by-its-Decision-Boundaries.

References in corpus (21)

• Deep learning in agriculture: A survey
• End to End Learning for Self-Driving Cars
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Actionable Recourse in Linear Classification
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Learning with a Strong Adversary
• Adversarial Examples: Opportunities and Challenges
• Towards the first adversarially robust neural network model on MNIST
• Simple Black-Box Adversarial Perturbations for Deep Networks
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Randomized Prediction Games for Adversarial Machine Learning
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Bridging Adversarial Robustness and Gradient Interpretability
• Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study
• Investigating Decision Boundaries of Trained Neural Networks