The Pros and Cons of Adversarial Robustness

TL;DR

This paper examines the advantages and disadvantages of adversarial robustness in machine learning, highlighting limitations of current definitions and exploring alternative uses of adversarial examples beyond robustness.

Contribution

It critically analyzes existing robustness definitions and certification methods, revealing their limitations and proposing broader perspectives on adversarial examples.

Findings

Limitations in current robustness definitions

Challenges in robustness certification methods

Broader applications of adversarial examples

Abstract

Robustness is widely regarded as a fundamental problem in the analysis of machine learning (ML) models. Most often robustness equates with deciding the non-existence of adversarial examples, where adversarial examples denote situations where small changes on some inputs cause a change in the prediction. The perceived importance of ML model robustness explains the continued progress observed for most of the last decade. Whereas robustness is often assessed locally, i.e. given some target point in feature space, robustness can also be defined globally, i.e. where any point in feature space can be considered. The importance of ML model robustness is illustrated for example by the existence of competitions evaluating the progress of robustness tools, namely in the case of neural networks (NNs) but also by efforts towards robustness certification. More recently, robustness tools have also been used for computing rigorous explanations of ML models. In contrast with the observed successes of robustness, this paper uncovers some limitations with existing definitions of robustness, both global and local, but also with efforts towards robustness certification. The paper also investigates uses of adversarial examples besides those related with robustness.