Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume

TL;DR

This paper introduces the adversarial hypervolume metric to comprehensively evaluate deep learning model robustness across perturbation levels, and proposes a training algorithm to improve uniform adversarial resilience.

Contribution

It presents a novel robustness metric based on multi-objective optimization and a training method that enhances robustness uniformly across perturbation intensities.

Findings

Adversarial hypervolume effectively captures subtle robustness differences.

The proposed training algorithm improves robustness uniformly across perturbation levels.

Empirical results validate the metric's ability to reveal insights missed by adversarial accuracy.

Abstract

The escalating threat of adversarial attacks on deep learning models, particularly in security-critical fields, has underscored the need for robust deep learning systems. Conventional robustness evaluations have relied on adversarial accuracy, which measures a model's performance under a specific perturbation intensity. However, this singular metric does not fully encapsulate the overall resilience of a model against varying degrees of perturbation. To address this gap, we propose a new metric termed adversarial hypervolume, assessing the robustness of deep learning models comprehensively over a range of perturbation intensities from a multi-objective optimization standpoint. This metric allows for an in-depth comparison of defense mechanisms and recognizes the trivial improvements in robustness afforded by less potent defensive strategies. Additionally, we adopt a novel training algorithm that enhances adversarial robustness uniformly across various perturbation intensities, in contrast to methods narrowly focused on optimizing adversarial accuracy. Our extensive empirical studies validate the effectiveness of the adversarial hypervolume metric, demonstrating its ability to reveal subtle differences in robustness that adversarial accuracy overlooks. This research contributes a new measure of robustness and establishes a standard for assessing and benchmarking the resilience of current and future defensive models against adversarial threats.