adversarial robustness evaluation

Adversarial Robustness Evaluation is the systematic assessment of a model's resistance to adversarial attacks — measuring how much imperceptible perturbation is needed to change the model's prediction, using standardized attack methods and metrics.

Evaluation Methodology

• Attacks: PGD (Projected Gradient Descent), AutoAttack, C&W (Carlini & Wagner), DeepFool.
• Metrics: Adversarial accuracy (accuracy under attack), minimum perturbation distance, certified radius.
• Norms: Evaluate under $L_\infty$, $L_2$, and $L_1$ perturbation budgets ($epsilon$-balls).
• Benchmarks: RobustBench provides standardized leaderboards for adversarial robustness.

Why It Matters

• Security: Quantifies how vulnerable a model is to adversarial manipulation.
• Standardization: AutoAttack provides a reliable, standardized evaluation (avoids "gradient masking" that fools weaker attacks).
• Trade-Off: Adversarial robustness typically trades off against clean accuracy — evaluation quantifies this trade-off.

Adversarial Robustness Evaluation is stress-testing against worst-case inputs — measuring how resistant the model is to deliberately crafted adversarial perturbations.