REVIEW 11 cited by
RobustBench: a standardized adversarial robustness benchmark
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
abstract
As a research community, we are still lacking a systematic understanding of the progress on adversarial robustness which often makes it hard to identify the most promising ideas in training robust models. A key challenge in benchmarking robustness is that its evaluation is often error-prone leading to robustness overestimation. Our goal is to establish a standardized benchmark of adversarial robustness, which as accurately as possible reflects the robustness of the considered models within a reasonable computational budget. To this end, we start by considering the image classification task and introduce restrictions (possibly loosened in the future) on the allowed models. We evaluate adversarial robustness with AutoAttack, an ensemble of white- and black-box attacks, which was recently shown in a large-scale study to improve almost all robustness evaluations compared to the original publications. To prevent overadaptation of new defenses to AutoAttack, we welcome external evaluations based on adaptive attacks, especially where AutoAttack flags a potential overestimation of robustness. Our leaderboard, hosted at https://robustbench.github.io/, contains evaluations of 120+ models and aims at reflecting the current state of the art in image classification on a set of well-defined tasks in $\ell_\infty$- and $\ell_2$-threat models and on common corruptions, with possible extensions in the future. Additionally, we open-source the library https://github.com/RobustBench/robustbench that provides unified access to 80+ robust models to facilitate their downstream applications. Finally, based on the collected models, we analyze the impact of robustness on the performance on distribution shifts, calibration, out-of-distribution detection, fairness, privacy leakage, smoothness, and transferability.
Forward citations
Cited by 11 Pith papers
-
Glitches in Decision Tree Ensemble Models
Introduces glitches as monotonic-oscillation anomalies in decision models and shows that detecting them in tree ensembles is NP-complete.
-
How Do Diffusion Models Improve Adversarial Robustness?
Diffusion models improve adversarial robustness mainly by compressing the input space, while the large gains reported earlier mostly come from evaluation randomness.
-
Sparse Autoencoders are Capable LLM Jailbreak Mitigators
CC-Delta defends LLMs against jailbreaks by statistically selecting and steering sparse-SAEs features that change when harmful prompts are embedded in jailbreak contexts, outperforming dense activation steering across...
-
Monitoring Robustness and Individual Fairness
Runtime monitoring of input-output robustness, covering adversarial robustness, semantic robustness, and individual fairness, is implemented as online fixed-radius nearest-neighbor search in the tool Clemont.
-
Adapting to Evolving Adversaries with Regularized Continual Robust Training
A logit-space regularization penalty (ALR) during adversarial training and fine-tuning improves robustness across sequences of evolving attacks and reduces drops in previously defended attacks.
-
Breaking TinyML: Why Quantized Neural Networks Need Domain-Specific Security Analysis
Surrogate extraction followed by FGSM/PGD reduces int-8 TinyML accuracy by up to 47% on CIFAR-10 with 50k queries, outperforming gray-box baselines and exposing hardware-specific QNN vulnerabilities.
-
SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming
On a unified VQE benchmark, QNBAD noise-induced attacks amplify energy error up to 8.84x, QTrojan up to 7.52x, and QDoor at most 1.37x.
-
On the Domain Robustness of Contrastive Vision-Language Models
DeepBench uses GPT-4o to generate domain-specific corruptions and evaluates CLIP, SigLIP, and ALIGN, finding CLIP most robust overall with large variation across domains and corruption types.
-
Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss
T-MIFPE adaptively rescales logits with a theoretically motivated t* per attack phase to reduce floating-point gradient errors, edging out MIFPE in PGD robustness evaluation.
-
A Red Teaming Roadmap Towards System-Level Safety
A position paper from Scale AI argues that red teaming research should prioritize product-level safety specifications, realistic attacker models, and system-level monitoring over abstract model-level harm benchmarks.
-
The Science of Evaluating Foundation Models
A survey-and-checklist proposal that organizes LLM evaluation into an ABCD framework (Algorithm, Big Data, Computation, Domain Expertise) for context-aware, documented assessment.
Discussion (0). Continue with ORCID to comment.