CANARY: An Adversarial Robustness Evaluation Platform for Deep Learning Models on Image Classification
-
Published:2023-08-30
Issue:17
Volume:12
Page:3665
-
ISSN:2079-9292
-
Container-title:Electronics
-
language:en
-
Short-container-title:Electronics
Author:
Sun Jiazheng12ORCID, Chen Li3, Xia Chenxiao3, Zhang Da1, Huang Rong1, Qiu Zhi1, Xiong Wenqi1, Zheng Jun12, Tan Yu-An12ORCID
Affiliation:
1. School of Cyberspace Science & Technology, Beijing Institute of Technology, Beijing 100081, China 2. Beijing Key Laboratory of Software Security Engineering Technology, Beijing 100081, China 3. School of Computer Science & Technology, Beijing Institute of Technology, Beijing 100081, China
Abstract
The vulnerability of deep-learning-based image classification models to erroneous conclusions in the presence of small perturbations crafted by attackers has prompted attention to the question of the models’ robustness level. However, the question of how to comprehensively and fairly measure the adversarial robustness of models with different structures and defenses as well as the performance of different attack methods has never been accurately answered. In this work, we present the design, implementation, and evaluation of Canary, a platform that aims to answer this question. Canary uses a common scoring framework that includes 4 dimensions with 26 (sub)metrics for evaluation. First, Canary generates and selects valid adversarial examples and collects metrics data through a series of tests. Then it uses a two-way evaluation strategy to guide the data organization and finally integrates all the data to give the scores for model robustness and attack effectiveness. In this process, we use Item Response Theory (IRT) for the first time to ensure that all the metrics can be fairly calculated into a score that can visually measure the capability. In order to fully demonstrate the effectiveness of Canary, we conducted large-scale testing of 15 representative models trained on the ImageNet dataset using 12 white-box attacks and 12 black-box attacks and came up with a series of in-depth and interesting findings. This further illustrates the capabilities and strengths of Canary as a benchmarking platform. Our paper provides an open-source framework for model robustness evaluation, allowing researchers to perform comprehensive and rapid evaluations of models or attack/defense algorithms, thus inspiring further improvements and greatly benefiting future work.
Subject
Electrical and Electronic Engineering,Computer Networks and Communications,Hardware and Architecture,Signal Processing,Control and Systems Engineering
Reference81 articles.
1. Hu, Y., Yang, J., Chen, L., Li, K., Sima, C., Zhu, X., Chai, S., Du, S., Lin, T., and Wang, W. (2023, January 18–22). Planning-oriented autonomous driving. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada. 2. Liu, Y., Yang, J., Gu, X., Guo, Y., and Yang, G.-Z. (June, January 29). EgoHMR: Egocentric Human Mesh Recovery via Hierarchical Latent Diffusion Model. Proceedings of the 2023 IEEE International Conference on Robotics and Automation (ICRA), ExCel, London, UK. 3. Shin, H., Kim, H., Kim, S., Jun, Y., Eo, T., and Hwang, D. (2023, January 18–22). SDC-UDA: Volumetric Unsupervised Domain Adaptation Framework for Slice-Direction Continuous Cross-Modality Medical Image Segmentation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada. 4. Liu, F., Wu, X., Ge, S., Fan, W., and Zou, Y. (2021, January 19–25). Exploring and distilling posterior and prior knowledge for radiology report generation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Nashville, TN, USA. 5. AIMM: Artificial intelligence merged methods for flood DDoS attacks detection;Jaszcz;J. King Saud Univ.-Comput. Inf. Sci.,2022
|
|