Research map / Adversarial robustness and security / Certified and empirical robustness
OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shift
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces OODRobustBench, a benchmark evaluating adversarial robustness of 706 robust models under 23 dataset shifts and 6 threat shifts, finding robustness degrades under OOD and that ID robustness linearly predicts OOD robustness, implying existing methods are unlikely to reach high OOD robustness.
Problem
Adversarial robustness is typically evaluated only in-distribution; it is unclear how robustness generalizes under input distribution shifts (dataset shifts) and unforeseen threat models (threat shifts).
Approach
A benchmark pairing natural and corruption dataset shifts with unforeseen adversarial threat shifts, applied at large scale to hundreds of robust models, revealing a linear ID-OOD robustness trend that is used to predict an upper limit on OOD robustness for existing methods.
Key results
- Robustness degrades on average by 18%/31%/24% under dataset shifts for CIFAR10 Linf, CIFAR10 L2 and ImageNet Linf respectively.
- ID and OOD robustness show strong positive linear correlation under many dataset shifts (R^2 > 0.9 for most shifts), enabling OOD prediction from ID performance.
- Predicted upper limit of OOD robustness under dataset shift is only 43% on ImageNet Linf, suggesting existing methods are unlikely to achieve high OOD robustness.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with extra data instead of without extra data | Robust training · OOD dataset and threat shifts | adversarial robustness | Helped |
| Use real extra data rather than synthetic extra data | Robust training · OOD threat shift | adversarial effective robustness | Helped |
| Use advanced data augmentation instead of RandomCrop | Robust training · OOD dataset and threat shifts | robustness | Helped |
| Use advanced data augmentation other than TA instead of RandomCrop | Robust training · OOD dataset shift | adversarial effective robustness | Hurt |
| Use an advanced model architecture instead of ResNet | Robust training · OOD dataset and threat shifts | adversarial effective robustness | Helped |
| Scale up model size | Robust training · OOD threat shift | adversarial effective robustness | Hurt |
| Add variation regularization (VR) | Adversarial training · OOD threat shift | adversarial effective robustness | Helped |
| Use HS, MMA, or AS instead of PGD training | Adversarial training · OOD threat shift | adversarial effective robustness: 16.22\%, 10.74\%, and 9.41\% | Helped |
| Use CARD-Deck or PLAT without adversarial training | OOD generalization methods · CIFAR10 ℓ∞ OOD adversarial robustness | robustness: 0.0 and 0.5 | Hurt |
| Combine multi-attack defense with REx | MSD+REx · CIFAR10 ℓ∞ OOD dataset and threat shifts | adversarial robustness: 26.2; 26.1 | Hurt |
| Use adversarial contrastive learning | ACL · CIFAR10 ℓ∞ OOD dataset shift | adversarial effective robustness: 0.1\% | No clear effect |
| Increase ID robustness using existing ℓp robust training methods | Existing robust training methods · OOD dataset shift | robustness: 66\%/71\%/43\% | Mixed |
Surprising findings
- Adversarial training boosts ID-OOD linear correlation under corruption shifts, with R^2 rising from near 0 for standard models to about 0.8 for AT models under Gaussian and shot noise.
- Lp robustness correlates poorly with non-Lp robustness (e.g., LPA and StAdv), with R^2 near 0 for some Linf settings.
Limitations
- Benchmark excludes dynamic preprocessing-based defenses and certified robustness due to evaluation reliability concerns.
- Only a subset of non-Lp attacks is included due to computational constraints.
- Catastrophic robustness degradation outliers are observed but not fully explained.
Experimental setup
Datasets: CIFAR10 ImageNet CIFAR10.1 CIFAR10.2 CINIC CIFAR10-R ImageNet-V2 ImageNet-A ImageNet-R ObjectNet CIFAR-10-C ImageNet-C
Benchmarks: OODRobustBench RobustBench
Metrics: adversarial robustness clean accuracy effective robustness adversarial effective robustness R^2 of linear regression predicted upper limit of OOD robustness
Baselines: PGD AT ACL ReColor AT StAdv AT PAT-Alexnet PAT-Self VR GAT MAAT PLAT CARD-Deck MSD+REx
Builds on: RobustBench AutoAttack effective robustness PAT REx
Closest papers by meaning
- On the Adversarial Robustness of Out-of-distribution Generalization Models (NeurIPS 2023 · similarity 0.93)
- RobustBench: a standardized adversarial robustness benchmark (NeurIPS 2021 · similarity 0.92)
- Fantastic Robustness Measures: The Secrets of Robust Generalization (NeurIPS 2023 · similarity 0.92)
- Adversarially Robust Out-of-Distribution Detection Using Lyapunov-Stabilized Embeddings (ICLR 2025 · similarity 0.90)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.89)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.