On the Robustness of Adversarial Training Against Uncertainty Attacks

TL;DR

This paper investigates how adversarial training enhances the robustness of uncertainty estimates in machine learning models, ensuring more trustworthy outputs under attack scenarios, supported by empirical and theoretical analysis on CIFAR-10 and ImageNet.

Contribution

It demonstrates that defending against adversarial examples inherently improves the security and reliability of uncertainty measures without additional defenses.

Findings

Adversarial training leads to more trustworthy uncertainty estimates.

Robust models maintain better uncertainty calibration under attack.

Empirical validation on CIFAR-10 and ImageNet supports the theoretical claims.

Abstract

In learning problems, the noise inherent to the task at hand hinders the possibility to infer without a certain degree of uncertainty. Quantifying this uncertainty, regardless of its wide use, assumes high relevance for security-sensitive applications. Within these scenarios, it becomes fundamental to guarantee good (i.e., trustworthy) uncertainty measures, which downstream modules can securely employ to drive the final decision-making process. However, an attacker may be interested in forcing the system to produce either (i) highly uncertain outputs jeopardizing the system's availability or (ii) low uncertainty estimates, making the system accept uncertain samples that would instead require a careful inspection (e.g., human intervention). Therefore, it becomes fundamental to understand how to obtain robust uncertainty estimates against these kinds of attacks. In this work, we reveal both empirically and theoretically that defending against adversarial examples, i.e., carefully perturbed samples that cause misclassification, additionally guarantees a more secure, trustworthy uncertainty estimate under common attack scenarios without the need for an ad-hoc defense strategy. To support our claims, we evaluate multiple adversarial-robust models from the publicly available benchmark RobustBench on the CIFAR-10 and ImageNet datasets.