CARBEN: Composite Adversarial Robustness Benchmark

1 Background

Deep neural networks (DNNs) have transformed computer vision and have been used in many fields, including aviation, climate forecasting, and medicine, among others. However, when a DNN encounters carefully crafted images, it can exhibit various vulnerabilities: for instance, lack of robustness in the face of adversarial attack [Szegedy et al., 2013]. By utilizing adversarial attacks to optimize perturbations, one can intentionally derive a perturbed sample from a normal image, and make it imperceptible to human beings. In other words, despite the original and adversarial images looking very much alike to us, the latter can lead well-trained DNN models to make wrong predictions.

Previous studies have sought to create bounded perturbations in a metric manner [Goodfellow et al., 2015; Chen et al., 2018]. Most such work has focused on ℓp-norm perturbation (i.e., ℓ1, ℓ2, and ℓ∞) and utilized gradient-based optimization - i.e., fast gradient sign method (FGSM), projected gradient descent (PGD), or C&W - to effectively generate the adversarial example. However, it is possible to extend adversarial perturbations beyond the ℓp-norm bounds. For instance, Laidlaw et al. generated their perturbation in a perceptual distance metric [Laidlaw et al., 2021], and Hosseini and Poovendran proposed a method of modifying images semantically to create semantic adversarial examples [Hosseini and Poovendran, 2018]. Additionally, Mao et al. studied adversarial examples generated from multiple-threat models, and demonstrated that they were more effective than single-threat ones against DNN targets [Mao et al., 2021].

∗Contact Author

Recently, Tsai et al. combined the ℓ∞-norm and semantic perturbations (i.e., hue, saturation, rotation, brightness, and contrast), and proposed a novel approach - composite adversarial attack (CAA) - capable of generating unified adversarial examples [Tsai et al., 2022]. The main differences between CAA and previously proposed perturbations are a) that CAA incorporates several threat models simultaneously, and b) that CAA's adversarial examples are semantically similar and/or natural-looking, but nevertheless result in large differences in ℓp-normmeasures.

Various defense strategies have also recently been proposed. For example, adversarial training (AT) is one of the most efficient ways to defend against adversarial attacks. However, recent results showed that ℓ∞-robust models (e.g., [Madry et al., 2018]) might become fragile when they encounter composite perturbations [Tsai et al., 2022]. Motivated by this limitation in ℓ∞-centric robustness, generalized adversarial training (GAT) overcomes this weakness and

<

l

a

t

e

x

i

s

h

1

_

b

6

4

=

"

S

d

c

n

V

N

T

U

3

J

+

E

I

B

G

L

D

Y

>

A

8

Z

F

P

q

W

9

M

g

u

C

r

o

H

p

k

O

m

5

Q

f

w

0

R

z

/

K

7

v

y

j

2

X

shows the robustness against a variety of composite perturbations [Tsai et al., 2022].

To systematically track the progress of adversarial robustness, [Croce et al., 2021] created a leaderboard and benchmarks for 120+ state-of-the-art models' performance on an image-classification task conducted under ℓp-threat and common corruptions. However, their approach did not cover evaluation of robustness against semantic attacks or composite perturbations, and these absences could potentially have led to bias in their interpretation and ranking of DNN models. To bridge this gap, familiarize other researchers with the concept of composite adversarial robustness, and ultimately, create more trustworthy AI, we developed a browser-based composite perturbation generation demo, CARBEN (composite adversarial robustness benchmark).

As shown in Figure 1, CARBEN is a web application featuring interactive and real-time perturbation panels in which its users render the perturbed image and can see the models' predictions in real time. Figure 2 presents examples of several perturbation types. CARBEN also includes an interactive section that lets users generate images in any attack combination. We have also created a leaderboard that tracks the accuracy of robustness against CAA.

2 SystemDesign

The main purpose of CARBEN is to visualize the mechanism of generating composite perturbations, and thereby help its users to understand how models change their predictions or confidences when under adversarial attack. In this demonstration, users can adjust the attack parameters manually, to explore the effects such adjustments will have, and gain valuable hands-on experience of generating desired examples. Once users understand the concept of CAA and attack ordering, they can use our Google Colab demonstration and the automated CAA to generate a set of composite adversarial examples for robustness evaluation, and report their modelperformance results on our leaderboard.

2.1 Composite Perturbations in CustomOrder

To demonstrate how attack order can affect the outcomes of composite perturbations, we designed CARBEN to allow its

• (b) Adjustment of perturbation order. Users can change the perturbation order by exchanging perturbation blocks.

Figure 4: CARBEN's interactive perturbation panel. Users can change the attack level and render the perturbed image on the canvas at right. Real-time model inference about the resulting instance is also provided, and marked in green (red) if it gives the correct (incorrect) prediction. The model used here is naturally trained model from torchvision package.

users to explore order effects. Figure 3 shows some perturbation examples in different orders of CAA. We pre-generated the images with all attack combinations and orders, and one can move the arrow-shaped attack blocks to the desired position to see the images in that selected order. Furthermore, we also presented the highest confidence scores for each instance, measured with an ℓ∞-robust model. This visualization also illustrates why previous models are more susceptible to semantic perturbations and lead to erroneous predictions when it comes to semantic and compositional scenarios.

2.2 Perturbation Panel

Because each attack component has its own perturbation level (or attack parameter), CARBEN also includes a perturbation panel, as shown in Figure 4, in which users can create composite perturbations on images. More specifically, a user can slide the bar to specify the attack level, and if it is set to Normal, the attack will be disabled. However, it should be noted that for purposes of this CARBEN feature, the attack order is fixed as: ℓ∞ → Hue → Saturation → Brightness → Contrast → Rotation.

In addition, we provide several ImageNet examples and real-time model prediction on the user-generated image, including a standard training model, ℓ∞-robust model, and GAT. Potentially, CARBEN could also be extended to support uploading images from user's phone or computer.

2.3 Colab Demonstration and Leaderboard

Colab Demonstration. The opensource code for generating a composite adversarial example with an automatically optimized attack order is currently available on GitHub. 1 We provide a step-by-step tutorial on Colab to guide users on how to execute this CAA in the notebook and see the results. The CIFAR-10 dataset was used for the experiment in our Colab notebook. Because CAA is implemented based on gradient optimization, computational cost and computing time will increase significantly as the number of enabled attacks increases. Therefore, we recommend using NVIDIA 2080Ti or above GPU to get better efficiency.

Benchmark and Leaderboard. When we compared the robustness rankings of the top 10 models on RobustBench (CIFAR-10, ℓ∞) [Croce et al., 2021], the results show that rankings between Auto-Attack and CAA (Full attacks) have a low correlation, suggesting that only considering perturbations in ℓp ball for robustness evaluation is biased and incomplete. Statistically, the Spearman's rank correlation coefficients between Auto-Attack and CAA (Semantic attacks and Full attacks) are as follows: 0.16 for semantic attacks, and 0.38 for full attacks.

To provide a complete robustness evaluation, we sought to offer several metrics for measuring the model performance. Therefore, we maintain leaderboards to facilitate tracking and benchmarking adversarial robustness progress across literature. Inspired from RobustBench, CARBEN's leaderboard focuses on tracking the robustness of model's robust accuracy not merely AutoAttack but also two CAAs (Semantic/Full attacks). Figure 5 shows the top three models on our leaderboard, as evaluated using CIFAR-10 and ImageNet datasets. In our leaderboard, models are ranked according to their Full Attacks robust accuracy; their architectures and papers are also listed.

In this leaderboard, we focus on "white-box" scenarios in which the attacker has all knowledge of the models. We have provided similar entries to those in the RobustBench leaderboard, and hereby solicit model submissions to compete against composite perturbations in our leaderboard.

3 Potential Impacts

CARBEN is believed to be the first demo aimed at explaining composite perturbations, and demonstrates the effects on model prediction of altering the attack order. As such, it can help its users gain valuable insights into composite adversarial robustness, and thereby accelerate research devoted to the design of robust models.

1 https://github.com/twweeb/composite-adv

Figure 5: The current top three entries on our leaderboard for model accuracy and robustness evaluation

Looking beyond conventional ℓp-norm perturbations, our demo focuses on semantic adversarial attacks and composite perturbations, which are closer to real-life scenarios demanding robustness. For example, a brightness attack may happen during adjustments to a camera's aperture, and a hueand-saturation attack may occur when the camera lens is fitted with a filter or mask. Our CARBEN demo and leaderboard offer unprecedentedly realistic and comprehensive robustness assessment. Our web-based demonstration and hands-on interaction can also help to build awareness of AI and robustness, and thus serve as an education toolkit for trustworthiness in AI.

4 Conclusion

This demonstration enables CARBEN users to gain familiarity with CAAs. Its design features interactive sections, and provides Colab tutorials for both manual and automated composite-attack generation. Our robustness evaluation and leaderboard are believed to be the first attempts to benchmark model performance against complex and realistic threats beyond small-norm and single-type perturbations.

Acknowledgments

This work is supported by Ministry of Science and Technology, Taiwan (MOST 111-2218-E-005-006-MBK).