GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models

Abstract

Current studies on adversarial robustness mainly focus on aggregating local robustness results from a set of data samples to evaluate and rank different models. However, the local statistics may not well represent the true global robustness of the underlying unknown data distribution. To address this challenge, this paper makes the first attempt to present a new framework, called GREAT Score, for global robustness evaluation of adversarial perturbation using generative models. Formally, GREAT Score carries the physical meaning of a global statistic capturing a mean certified attack-proof perturbation level over all samples drawn from a generative model. For finite-sample evaluation, we also derive a probabilistic guarantee on the sample complexity and the difference between the sample mean and the true mean. GREAT Score has several advantages: (1) Robustness evaluations using GREAT Score are efficient and scalable to large models, by sparing the need of running adversarial attacks. In particular, we show high correlation and significantly reduced computation cost of GREAT Score when compared to the attack-based model ranking on RobustBench¹. (2) The use of generative models facilitates the approximation of the unknown data distribution. In our ablation study with different generative adversarial networks (GANs), we observe consistency between global robustness evaluation and the quality of GANs. (3) GREAT Score can be used for remote auditing of privacy-sensitive black-box models, as demonstrated by our robustness evaluation on several online facial recognition services.

¹ Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., & Hein, M. (2021). RobustBench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2). https://openreview.net/forum?id=SSKZPJCt7B

Method Overview of GREAT Score

Figure 1. Overview of GREAT Score. The process involves three main steps: (1) Data Generation: We use a generative model to create synthetic samples. (2) Local Robustness Evaluation: For each generated sample, we calculate a local robustness score based on the classifier's confidence. (3) Global Robustness Estimation: We aggregate the local scores to estimate the overall robustness of the classifier. This method provides a certified lower bound on the true global robustness without requiring access to the original dataset or exhaustive adversarial attacks.

Robustness Certificate Definition

GREAT Score is designed to evaluate the global robustness of classifiers against adversarial attacks. It uses generative models to estimate a certified lower bound on true global robustness. For a K-way classifier f, we define a local robustness score g(G(z)) for a generated sample G(z), where G is a generator and z is sampled from a standard Gaussian distribution. This score measures the confidence gap between the correct class prediction and the most likely incorrect class. The GREAT Score, defined as the expectation of g(G(z)) over z, provides a certified lower bound on the true global robustness with respect to the data distribution learned by the generative model. This approach allows us to estimate global robustness without knowing the exact data distribution or minimal perturbations for each sample.

True Global Robustness Global Robustness Estimate Local Robustness Score

$$ \displaystyle \Omega(f) = \mathbb{E}_{x\sim P}[\Delta_{min}(x)]= \int_{x \sim P} \Delta_{\min}(x) p(x)dx $$

where f is a classifier, P is a data distribution, and Δ_min(x) is the minimal perturbation for a sample x.

GREAT Score Results

**Table 1.** Comparison of (Calibrated) GREAT Score v.s. minimal distortion found by CW attack on CIFAR-10. The results are averaged over 500 samples from StyleGAN2.
Model Name	RobustBench Accuracy(%)	AutoAttack Accuracy(%)	GREAT Score	Calibrated GREAT Score	CW Distortion
Rebuffi_extra	82.32	87.20	0.507	1.216	1.859
Gowal_extra	80.53	85.60	0.534	1.213	1.324
Rebuffi_70_ddpm	80.42	90.60	0.451	1.208	1.943
Rebuffi_28_ddpm	78.80	90.00	0.424	1.214	1.796
Augustin_WRN_extra	78.79	86.20	0.525	1.206	1.340
Sehwag	77.24	89.20	0.227	1.143	1.392
Augustin_WRN	76.25	86.40	0.583	1.206	1.332
Rade	76.15	86.60	0.413	1.200	1.486
Rebuffi_R18	75.86	87.60	0.369	1.210	1.413
Gowal	74.50	86.40	0.124	1.116	1.253
Sehwag_R18	74.41	88.60	0.236	1.135	1.343
Wu2020Adversarial	73.66	84.60	0.128	1.110	1.369
Augustin2020Adversarial	72.91	85.20	0.569	1.199	1.285
Engstrom2019Robustness	69.24	82.20	0.160	1.020	1.084
Rice2020Overfitting	67.68	81.80	0.152	1.040	1.097
Rony2019Decoupling	66.44	79.20	0.275	1.101	1.165
Ding2020MMA	66.09	77.60	0.112	0.909	1.095

Model Ranking Comparison

**Table 2.** Spearman's rank correlation coefficient on CIFAR-10 using GREAT Score, RobustBench (with test set), and Auto-Attack (with generated samples).
	Uncalibrated	Calibrated
GREAT Score vs. RobustBench Correlation	0.6618	0.8971
GREAT Score vs. AutoAttack Correlation	0.3690	0.6941
RobustBench vs. AutoAttack Correlation	0.7296	0.7296

We compare the model ranking on CIFAR-10 using GREAT Score (evaluated with generated samples), RobustBench (evaluated with Auto-Attack on the test set), and Auto-Attack (evaluated with Auto-Attack on generated samples). Table 2 presents their mutual rank correlation (higher value means more aligned ranking) with calibrated and uncalibrated versions. We note that there is an innate discrepancy between Spearman's rank correlation coefficient (way below 1) of RobustBench vs. Auto-Attack, which means Auto-Attack will give inconsistent model rankings when evaluated on different data samples. In addition, GREAT Score measures classification margin, while AutoAttack measures accuracy under a fixed perturbation budget ε. AutoAttack's ranking will change if we use different ε values. E.g., comparing the ranking of ε=0.3 and ε=0.7 on 10000 CIFAR-10 test images for AutoAttack, the Spearman's correlation is only 0.9485. Therefore, we argue that GREAT Score and AutoAttack are complementary evaluation metrics and they don't need to match perfectly. Despite their discrepancy, before calibration, the correlation between GREAT Score and RobustBench yields a similar value. With calibration, there is a significant improvement in rank correlation between GREAT Score to Robustbench and Auto-Attack, respectively.

GREAT Score vs CW Attack Comparison

Figure 2. Comparison of local GREAT Score and CW attack in L₂ perturbation on CIFAR-10 with Rebuffi_extra model. The x-axis is the image id. The result shows the local GREAT Score is indeed a lower bound of the perturbation level found by CW attack.

BibTeX

@article{li2024greatscore,
  title     = {GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models},
  author    = {Zaitang, Li and Pin-Yu, Chen and Tsung-Yi, Ho},
  journal   = {NeurIPS},
  year      = {2024},
}