Research map / Adversarial robustness and security / Certified and empirical robustness
How Many Perturbations Break This Model? Evaluating Robustness Beyond Adversarial Accuracy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add data augmentation (Crop+Resize, Ricap, Cutout, Mixup, etc.) to standard training without adversarial training (ablation) | ResNet-18 standard training · CIFAR10 L2 eps=0.5 and Linf eps=0.03 | residual sparsity: L2 0.180 -> 0.225 (Crop+Resize); Linf 56.8 -> 64.0 (Crop+Resize) | Helped |
| Add CutMix augmentation to standard training (ablation) | ResNet-18 standard training · CIFAR10 L2 and Linf | residual sparsity: L2 0.180 -> 0.185; Linf 56.8 -> 50.8 | No clear effect |
| Add RICAP augmentation to standard training (ablation) | ResNet-18 standard training · CIFAR10 L2 and Linf | residual sparsity: L2 0.180 -> 0.272; Linf 56.8 -> 105 | Helped |
| Preprocessing defenses (JPEG, feature squeezing, spatial smoothing) on broken-defense ResNet-18 under L2 | ResNet-18 with preprocessing defenses · CIFAR10 L2 eps=0.5 | L2 sparsity: JPEG 0.161, FS 0.178, SPS 0.147 vs 0.180 baseline | No clear effect |
| JPEG compression defense | ResNet-18 broken preprocessing defense · CIFAR10 Linf eps=0.03 | Linf sparsity: 56.8 -> 80.9 (+20.9 vs baseline per text) | Helped |
| Spatial smoothing defense | ResNet-18 broken preprocessing defense · CIFAR10 Linf eps=0.03 | Linf sparsity: 56.8 -> 77.7 (+18.7) | Helped |
| Feature squeezing defense | ResNet-18 broken preprocessing defense · CIFAR10 Linf eps=0.03 | Linf sparsity: 56.8 -> 60.1 | No clear effect |
| Adversarial training (PGD-based, strong) vs undefended | ResNet-18 · CIFAR10 L2 and Linf | residual sparsity: L2 0.180 -> 0.5+ range; Linf 56.8 -> 200+ range | Helped |
| Higher adversarial accuracy among robust models | robust models in Table 1 · CIFAR10 Linf | residual sparsity | Mixed |
| Standard training with data augmentation applied to ViT fine-tuning (ViT-B-16) vs ResNet-18 | ViT-B-16 fine-tuned on CIFAR10 · CIFAR10 L2 eps=0.5 | L2 sparsity: ViT 0.183 vs ResNet-18 augmented ~0.18-0.2 | No clear effect |
Closest papers by meaning
- Adversarial Training and Robustness for Multiple Perturbations (NeurIPS 2019 · similarity 0.92)
- Increasing Confidence in Adversarial Robustness Evaluations (NeurIPS 2022 · similarity 0.91)
- Accurate, reliable and fast robustness evaluation (NeurIPS 2019 · similarity 0.90)
- Adversarial Robustness Against the Union of Multiple Perturbation Models (ICML 2020 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.