Source-linked AI summary
Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, Yupeng Gao
TL;DR
The paper investigates whether improving image-classification accuracy compromises robustness to adversarial examples. It benchmarks 18 ImageNet models with attacks, transfer tests across 306 model pairs, and CLEVER, finding a clear accuracy–robustness trade-off alongside architecture- and transferability-related patterns.
Problem
Rising classification accuracy has not been matched by thorough evidence about whether robustness has been sacrificed.
Method
The study evaluates 18 ImageNet models using adversarial attacks, distortion and success-rate metrics, transfer attacks across 306 model pairs, and CLEVER scores.
Results
The experiments find a clear accuracy–robustness trade-off: better testing accuracy generally reduces robustness, while architecture matters more than model size and transferability is family-dependent.
Takeaways & Limitations
The disclosed accuracy–robustness Pareto frontier is proposed as an evaluation criterion for ImageNet network designers.
Takeaways & Limitations
The study focuses on image classification and notes that its findings may provide insights for, rather than directly establish conclusions about, other computer-vision tasks.
Abstract
from arXiv · showhide
The prediction accuracy has been the long-lasting and sole standard for comparing the performance of different image classification models, including the ImageNet competition. However, recent studies have highlighted the lack of robustness in well-trained deep neural networks to adversarial examples. Visually imperceptible perturbations to natural images can easily be crafted and mislead the image classifiers towards misclassification. To demystify the trade-offs between robustness and accuracy, in this paper we thoroughly benchmark 18 ImageNet models using multiple robustness metrics, including the distortion, success rate and transferability of adversarial examples between 306 pairs of models. Our extensive experimental results reveal several new insights: (1) linear scaling law - the empirical $\ell_2$ and $\ell_\infty$ distortion metrics scale linearly with the logarithm of classification error; (2) model architecture is a more critical factor to robustness than model size, and the disclosed accuracy-robustness Pareto frontier can be used as an evaluation criterion for ImageNet model designers; (3) for a similar network architecture, increasing network depth slightly improves robustness in $\ell_\infty$ distortion; (4) there exist models (in VGG family) that exhibit high adversarial transferability, while most adversarial examples crafted from one model can only be transferred within the same family. Experiment code is publicly available at \url{https://github.com/huanzhang12/Adversarial_Survey}.
1 Introduction
The paper asks whether rising ImageNet accuracy has reduced robustness and benchmarks 18 models to examine accuracy–robustness trade-offs and influencing factors.
- Study motivation: The study benchmarks 18 ImageNet models spanning multiple architecture families, sizes, and classification performance levels.These models support analysis of how architecture and model size relate to robustness.
- Accuracy–robustness trade-off: Higher classification performance is associated with reduced robustness, as ℓ2 and ℓ∞ adversarial distortions scale almost linearly with the logarithm of classification errors.Models with very low test errors are reported to be highly vulnerable to adversarial attacks.
- Factors influencing robustness: Architecture family has a larger impact on robustness than model size, with models in the same family sharing similar robustness properties.The study highlights an accuracy–robustness Pareto frontier for evaluating ImageNet models.
- Factors influencing robustness: For ResNets, Inception Nets, and DenseNets, increasing depth slightly improves ℓ∞ robustness.The observation applies to similar network architectures with different depths.
- Adversarial transferability: VGG-generated adversarial examples transfer well to all other 17 models, whereas examples from most other models transfer mainly within the same family.The paper links this transferability pattern to possible black-box architecture reverse-engineering.
2 Background and Experimental Setup
The paper defines adversarial attacks and evaluates 18 ImageNet classifiers using white-box attacks, transfer attacks across 306 model pairs, and CLEVER scores.
- Attack formulation: Untargeted attacks seek an adversarial image close to the original but misclassified, while targeted attacks seek classification as a specified target class.The original image is assumed correctly classified to avoid a trivial solution.
- Model selection: The examined models include multiple architecture families, including AlexNet, VGG Nets, ResNets, and DenseNets.Table 1 presents the 18 ImageNet models selected for robustness examination.
- Evaluation approaches: Robustness evaluation combines adversarial attack success rates and distortions with transferability tests and the attack-agnostic CLEVER metric.Transfer attacks use one model’s adversarial examples against another model in a black-box setting.
- Adversarial attacks: The study evaluates FGSM and iterative FGSM, with iterative FGSM applying finer perturbations over multiple steps and achieving more than 99% attack success in cited prior work.FGSM is a one-step gradient-sign attack, whereas I-FGSM repeatedly applies the attack.
- Adversarial attacks: C&W uses a logit-based loss, while EAD-L1 combines ℓ1 and ℓ2 regularization and is reported to be highly transferable.C&W is described as finding adversarial examples with small ℓ2 perturbations; EAD-L1 generalizes its formulation with elastic-net regularization.
- Dataset and sampling: ImageNet is chosen because the models were designed for it and because it is larger, more challenging, and harder to defend than smaller benchmark datasets.The benchmark uses 1,000 randomly selected validation images, while CLEVER is computed on 100 images.
3 Experiments
Experiments evaluate adversarial attack success, robustness–accuracy relationships, model size and architecture effects, and transferability across 18 ImageNet models. The results show attack-dependent behavior, an empirical accuracy–robustness scaling law, architecture-driven robustness differences, and strong family-specific transfer patterns.
- 3.1 Evaluation of Adversarial Attacks: Targeted FGSM succeeds below 3% in all settings, whereas 10-step I-FGSM performs very well and C&W/EAD-L1 approach 100% success when κ = 0.Increasing ϵ decreases targeted FGSM success, while iterative or optimization-based attacks are substantially stronger.
- 3.1 Evaluation of Adversarial Attacks: Large κ makes C&W and EAD-L1 attacks harder, increasing distortion and sometimes transferability while reducing success rate, so success rate is not a reliable robustness measure.For MobileNet-0.50-160, success is close to 0 at κ = 40 despite the model being among the most vulnerable by distortion.
- 3.2 Linear Scaling Law in Robustness v.s. Accuracy: Robustness metrics scale linearly with the logarithm of classification error across Pareto-frontier ImageNet models.The study uses ℓ∞ distortion from I-FGSM, ℓ2 distortion from C&W, and ℓ2 CLEVER scores, with attack success rates nearly 100%.
- 3.3 Robustness of Different Model Sizes and Architectures: Architecture influences robustness more than model size: AlexNet has about 60 million parameters yet the best robustness, while MobileNet-0.50-160 has 1.5 million and is more vulnerable across metrics.Models within an architecture family show similar robustness despite differences in depth and parameter count.
- 3.3 Robustness of Different Model Sizes and Architectures: Within DenseNet, ResNet, and Inception families, greater depth slightly improves robustness under the ℓ∞ distortion metric.The observation is presented as a possible design insight for improving the accuracy–robustness Pareto frontier.
- 3.4 Transferability of Adversarial Examples: Transferability varies by attack and direction: untargeted attacks transfer better, FGSM and I-FGSM outperform EAD-L1, and VGG examples transfer especially well across models.Most examples from other models transfer mainly within the same family, while VGG 16 and VGG 19 produce strong cross-family transfer.
4 Conclusions
The study benchmarks 18 ImageNet models to examine accuracy–robustness trade-offs and focuses on image classification, while noting possible relevance to other vision tasks using the same pretrained classifiers.
- The paper presents a large-scale study of adversarial examples across 18 ImageNet models, including transferability analysis over 306 network pairs.
- Higher testing accuracy generally coincides with lower robustness, with an empirical linear relation between distortion metrics and the logarithm of classification error.
- The analysis is scoped to image classification, although the authors suggest its findings may inform tasks that reuse these classifiers for feature extraction.
5 Supplementary Materials
Supplementary experiments reinforce the accuracy–robustness trade-off and characterize how attack settings, target choice, and architecture affect transferability.
- Additional robustness validation: On 327 images correctly classified by all 18 models, C&W and I-FGSM targeted attacks show trends consistent with the main accuracy–robustness results.
- Least-likely attacks: Least-likely-target attacks achieve close to 100% success rates despite being more challenging, while AlexNet is most robust and NASNet most vulnerable.
- C&W transferability: C&W with an ℓ2 norm transfers less successfully than I-FGSM and EAD-L1, and increasing its confidence parameter κ only slightly improves transferability.
- I-FGSM transferability: I-FGSM transferability improves with larger ϵ, fewer iterations, untargeted attacks, VGG source models, and shared architecture families.
- Interpretation of robustness: The paper contrasts its pixel-space ℓp robustness measures on 1000-class ImageNet with prior work measuring semantic class-label sensitivity.
- Interpretation of robustness: Increasing sensitivity may improve accuracy while also producing smaller adversarial perturbations, linking the two reported robustness perspectives.