PaperlayerView exact revision on arXiv

Source-linked AI summary

A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking

Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, Shibao Zheng

arXiv:2302.14301v1cs.CV

TL;DR

Deep learning robustness evaluations have struggled to keep pace with diverse models, noise patterns, and distribution shifts. The paper introduces ARES-Bench to benchmark 55 ImageNet models across natural and adversarial settings using robustness curves, finding trade-offs between robustness dimensions and gains from training choices and architecture.

  • Problem

    Existing robustness benchmarks are often outdated, emphasize adversarial robustness, and use point-wise metrics that inadequately cover natural distribution shifts and varying noise levels.

  • Method

    ARES-Bench evaluates 55 ImageNet models across CNN and Transformer architectures, four learning paradigms, natural-robustness datasets, adversarial attacks, and robustness curves.

  • Results

    The benchmark finds an adversarial–natural robustness trade-off, stronger adversarial training results on Transformers, and improved natural robustness from large-scale or self-supervised pre-training.

  • Takeaways & Limitations

    Robustness assessment should jointly consider natural and adversarial settings, architectures, learning paradigms, diverse attacks, and performance across noise levels.

  • Takeaways & Limitations

    Adversarial training typically degrades natural robustness on most OOD datasets, so it is not universally applicable as a robustness solution.

Abstract

from arXiv · show

The robustness of deep neural networks is usually lacking under adversarial examples, common corruptions, and distribution shifts, which becomes an important research problem in the development of deep learning. Although new deep learning methods and robustness improvement techniques have been constantly proposed, the robustness evaluations of existing methods are often inadequate due to their rapid development, diverse noise patterns, and simple evaluation metrics. Without thorough robustness evaluations, it is hard to understand the advances in the field and identify the effective methods. In this paper, we establish a comprehensive robustness benchmark called \textbf{ARES-Bench} on the image classification task. In our benchmark, we evaluate the robustness of 55 typical deep learning models on ImageNet with diverse architectures (e.g., CNNs, Transformers) and learning algorithms (e.g., normal supervised training, pre-training, adversarial training) under numerous adversarial attacks and out-of-distribution (OOD) datasets. Using robustness curves as the major evaluation criteria, we conduct large-scale experiments and draw several important findings, including: 1) there is an inherent trade-off between adversarial and natural robustness for the same model architecture; 2) adversarial training effectively improves adversarial robustness, especially when performed on Transformer architectures; 3) pre-training significantly improves natural robustness based on more training data or self-supervised learning. Based on ARES-Bench, we further analyze the training tricks in large-scale adversarial training on ImageNet. By designing the training settings accordingly, we achieve the new state-of-the-art adversarial robustness. We have made the benchmarking results and code platform publicly available.

1 Introduction

ARES-Bench addresses incomplete robustness evaluation by jointly benchmarking natural and adversarial robustness across diverse models, datasets, attacks, and learning paradigms. Its experiments reveal trade-offs between robustness dimensions and identify effects of adversarial training, pre-training, and architecture.

  • Motivation: Existing benchmarks become outdated, emphasize adversarial robustness, and often cannot reveal relationships between natural and adversarial robustness.Point-wise metrics can also provide an incomplete view because results vary with noise budgets.
  • Benchmark: ARES-Bench evaluates 55 ImageNet models spanning CNNs, Transformers, supervised training, pre-training, self-supervised learning, and adversarial training.The benchmark covers natural robustness on seven OOD datasets and adversarial robustness under white-box and black-box attacks.
  • Findings: Adversarial training improves adversarial robustness but typically degrades natural robustness for a given architecture.The paper attributes this pattern to robust, shape-biased features that generalize poorly to real-world distribution shifts.
  • Findings: Adversarial training on Transformers performs better than on CNNs, with Swin Transformer exceeding 60% robustness against 4/255 ℓ∞ perturbations.The paper identifies hierarchical architecture and self-attention as advantages for concentrating on global features.
  • Findings: Pre-training on large datasets and self-supervised learning significantly improve natural robustness, while pre-training also provides better initialization for adversarial training.The benchmark further analyzes large-scale adversarial-training tricks and reports state-of-the-art robustness.
  • Resources: The authors release benchmark results, the ARES robustness platform, and the benchmark model collection.The stated goal is to support future research through publicly available leaderboards, code, and models.

2 Related Work

Prior work established adversarial attacks, natural-shift evaluations, robustness platforms, and benchmarks, but coverage remained fragmented. ARES-Bench expands this landscape with broader datasets and models, stronger results, and robustness curves across noise levels.

  • Adversarial robustness: Adversarial attacks expose prediction failures through imperceptible perturbations, while adversarial training is a prominent defense.The related work distinguishes attack development from training models on generated adversarial examples.
  • Natural robustness: Natural robustness research evaluates common corruptions, transformations, and real-world out-of-distribution generalization.ImageNet-C/P and real-world datasets are cited as evaluation resources for natural distribution shifts.
  • Platforms and benchmarks: Existing robustness platforms implement popular attacks but generally omit the latest state-of-the-art models and benchmarking results.Examples include CleverHans, Foolbox, and ART.
  • ARES-Bench: ARES-Bench integrates 3 IID and 7 OOD datasets, evaluates top-performing models, and uses robustness curves to compare performance across varying noise levels.These design choices broaden natural-robustness evaluation and provide a global rather than point-wise comparison.

3 Benchmark Design

ARES-Bench evaluates natural and adversarial robustness across diverse datasets, attacks, architectures, and training paradigms. It uses robustness curves alongside standard error metrics to characterize performance across corruption severities and perturbation budgets.

  • Benchmark scope: ARES-Bench evaluates 55 ImageNet models spanning CNNs and Transformers, normal supervision, pre-training, self-supervised learning, and adversarial training.The benchmark covers both natural and adversarial robustness.
  • Natural robustness: Natural robustness is measured on IID, real-world OOD, synthesized OOD, and corruption datasets representing varied distribution shifts and image degradations.The evaluation includes ImageNet validation, ImageNet-V2, ImageNet-Real, ObjectNet, ImageNet-A, ImageNet-R, ImageNet-V, and ImageNet-C.
  • Evaluation metrics: Robustness curves plot accuracy against corruption severity or perturbation budget, providing performance profiles across multiple difficulty levels.For black-box attacks, the benchmark also reports transferability heatmaps across models.
  • Adversarial robustness: Adversarial robustness is evaluated with three white-box attacks and five transfer-based black-box attacks under norm-bounded perturbation budgets.The attacks include FGSM, PGD, AutoAttack, MIM, DIM, TIM, SI-NI-FGSM, and VMI-FGSM.
  • Training paradigms: The benchmark also studies self-supervised learning and training tricks such as augmentation, regularization, weight averaging, and pre-training in adversarial training.These components are examined to understand robustness-related training choices, including large-scale adversarial training on ImageNet.

4 Evaluation Results

The evaluation compares natural and adversarial robustness across architectures, pre-training methods, adversarial training, and training tricks. Results show that pre-training improves natural robustness, Transformer and modern CNN architectures can be competitive under adversarial evaluation, and robustness depends on perturbation severity and training choices.

  • Natural robustness across architectures: 57.4% natural robustness is achieved by both pre-trained ConvNextL and ViTL, while normally trained ConvNextL reaches 51.0%.These results show that modern CNNs can match Transformer natural robustness, with pre-training providing a substantial benefit.
  • Pre-training and self-supervised learning: Pre-training on ImageNet-21K increases ViTL natural robustness from 35.4% to 57.4%.The authors attribute this improvement to more training data reducing overfitting to a particular distribution.
  • Pre-training and self-supervised learning: Self-supervised learning improves natural robustness, but remains inferior to ImageNet-21K pre-training; MAE substantially improves ViT, while MOCOv3 is only slightly better than normal training.The comparison supports an advantage for larger-scale supervised pre-training in the reported natural-robustness results.
  • Adversarial training: Adversarial training improves adversarial robustness but significantly reduces natural robustness for almost all models, except ViT.The authors relate this trade-off to the shift between adversarial and natural noise, while noting stronger performance on some style-shift datasets.
  • Normally trained and pre-trained models: ViT is the most resistant architecture to large perturbations, whereas SwinB, XciTL, and T2T24 with higher clean accuracy tend to decline faster as perturbation budgets increase.The authors associate ViT’s advantage with a smoother loss landscape and the other models’ faster decline with decision boundaries closer to data points.
  • Adversarially trained models: 62.3% robust accuracy is achieved by SwinL and 60.1% by ConvNextL under AutoAttack with ϵ = 4/255, compared with 49.6% for XciTL in RobustBench.The results indicate competitive adversarial robustness for modern CNNs and Transformers, while robustness curves reveal budget-dependent reversals between training settings.
  • Training tricks: Mixup adds 5.2% robust accuracy after RandAugment adds 1.0% to a 48.7% baseline, while label smoothing adds 0.5% and EMA adds 0.2%.The ablation attributes the augmentation gains to reducing overfitting to particular attack patterns.
  • Pre-training for adversarial training: Fine-tuning can suffer catastrophic forgetting, and SimMIM features are not beneficial to downstream adversarial training.The reported clean accuracy initially decreases during fine-tuning, while SimMIM fine-tuned robustness remains close to training from scratch.

4.3 Black-box Adversarial Robustness Evaluation

The study evaluates normally and adversarially trained models under transfer-based black-box attacks using VMI-FGSM and transferability heatmaps. Adversarial training improves transfer robustness, with architecture-specific differences among CNNs and Transformers.

  • ViTs are generally more robust than other normally trained models under black-box attacks, while ConvNext models are the strongest surrogate models.Adversarial examples generated from ConvNext models achieve higher attack success rates than those generated from other surrogate models.
  • Adversarial training significantly improves robustness to transfer-based black-box attacks.
  • Higher white-box robustness generally corresponds to better black-box robustness among adversarially trained models.
  • ConvNexts have the best transfer-based robustness among CNNs, while Swins have the best transfer-based robustness among Transformers.These architecture rankings are highly consistent with white-box robustness results.

4.4 Relationship Between Frequency bias and Robustness

The frequency analysis compares normalized ACC-LPB curves for normally and adversarially trained models to characterize adversarial training’s frequency bias. Adversarially trained models emphasize lower-frequency information more strongly and exhibit lower frequency bias.

  • Adversarially trained models’ ACC-LPB curves rise faster at lower LPB and flatten at higher LPB than normally trained models’ curves.The curve shape indicates greater attention to information in the lower-LPB region.
  • The higher LPB adds more high-frequency information to images and increases model accuracy.Regions with higher growth rates indicate information ranges receiving more model attention.
  • Frequency analysis is used to explain adversarial training’s frequency-attention bias rather than as a completed regularization method.The paper identifies developing frequency analysis into a regularization method as future work.

5 Conclusions and Discussions

The conclusions synthesize a benchmark of natural and adversarial robustness across architectures, training paradigms, and datasets. They report trade-offs between robustness types, comparable performance from modern CNNs and Transformers, gains from pre-training, and an adversarial-training recipe based on mitigating overfitting.

  • Benchmark and evaluation: ARES-Bench evaluates natural robustness on 10 datasets and adversarial robustness with AutoAttack, spanning CNNs and Transformers trained under four paradigms.The study also includes ablations of large-scale adversarial-training tricks and frequency-bias analysis.
  • Robustness trade-off: Adversarial training generally improves adversarial robustness but significantly degrades natural robustness on most OOD datasets for a fixed architecture.The paper concludes that achieving both forms of robustness remains an open problem.
  • Architectural findings: Modern ConvNext models achieve natural robustness comparable to Transformers and slightly worse adversarial robustness than the best Transformer.
  • Architectural findings: Modern architectural designs, rather than self-attention alone, are identified as essential to robustness.The cited designs include patchified inputs, enlarged kernels, and reduced activation and normalization layers.
  • Training paradigms: Pre-training on large datasets or through self-supervised learning significantly improves natural robustness.Large-dataset pre-training also provides better initializations for adversarial-training fine-tuning.
  • Training paradigms: Data augmentation, regularization, and weight averaging can improve adversarial robustness by mitigating adversarial-training overfitting.The ablations yield a recipe for training robust ImageNet models with appropriately designed tricks.

Appendix A Experimental settings

The appendix specifies the attacks, perturbation settings, optimization schedule, preprocessing, and augmentation used for robustness evaluation and adversarial training.

  • Adversarial attacks: White-box evaluation uses FGSM, PGD100, and AutoAttack, while black-box evaluation uses MIM, DIM, TIM, SI-NI-FGSM, and VMI-FGSM.
  • Adversarial attacks: All L∞ white-box attacks use attack epsilon 4/255.FGSM uses a step size of 4/255; the passage also specifies PGD100 settings beyond the supplied excerpt.
  • Adversarial training: Adversarial training generates examples with PGD-3 using epsilon ϵ = 4/255 and attack step 3.The attack step size is calculated as size = 2 ∗ ϵ/step.
  • Model training: Transformer and ConvNext training uses AdamW with momentum 0.9, weight decay 0.0, a 300-epoch cosine schedule, learning rate 5e-4, and 5 warmup epochs.Inputs are center-cropped, resized to 224, normalized, and augmented with color jitter, RandAugment, Random Erasing, Mixup, label smoothing, and EMA.

Appendix B Results on ImageNet-C

ImageNet-C robustness curves are organized by architecture and show that pre-training, model scale, and adversarial training affect natural robustness differently.

  • 21K pre-training and self-supervised learning greatly improve natural robustness.The passage attributes these gains to reduced overfitting to particular distributions and more representative features.
  • Larger model size improves natural robustness across the evaluated architectures.The passage links larger capacity with improved natural robustness.
  • Normally-trained, 21K pre-trained, and self-supervised pre-trained models show similar variation trends.
  • Adversarially-trained models have flatter robust curves at high corruption severity.The passage attributes this resistance to severe noise to greater reliance on shape-biased features after adversarial training.

Appendix C Result for different models

Across model groups, pre-training and self-supervised learning affect adversarial robustness unevenly, while architecture and training choices shape the resulting robust curves.

  • 21K pre-training improves adversarial robustness on ConvNexts and ViTs but decreases robustness on Swins.
  • MAE and MOCOv3 improve adversarial robustness on ViTs.
  • Model size is less correlated with adversarial robustness because normally-trained models have uniformly poor robustness.
  • ConvNext Large performs best among CNNs, while Swin Transformer Large performs best among Transformers.The passage associates their performance with modern architecture designs, including patchified inputs, enlarged kernels, and fewer activation and normalization layers.
  • Adversarially-trained models with the same architecture have similar robust curves, but perturbation budgets create trade-offs.ResNet152 FD uses epsilon 8/255, whereas the other models use epsilon 4/255.

Appendix D White-box attacks

White-box evaluations under L2 perturbations produce conclusions similar to those from L∞ attacks, with ConvNextL and SwinL leading their architecture groups.

  • ConvNextL is the most robust CNN and SwinL is the most robust Transformer under L2 white-box attacks.The evaluation uses FGSM, PGD100, and AutoAttack with epsilon 0.5.

Appendix E Black-box attacks

Black-box evaluations examine multiple transfer-based attacks and show architecture- and training-dependent differences in robustness.

  • The black-box evaluation covers MIM, DIM, TIM, and SI-NI-FGSM for naturally- and adversarially-trained models.
  • ViT models are generally more robust than other models under the black-box setting.
  • ConvNext models act as the best surrogate models in the black-box evaluation.
  • Naturally-trained models are generally less robust on DIM attacks, whereas adversarially-trained models are generally less robust on MIM attacks.The passage relates this difference to the roles of transferability and surrogate-model attack ability.
Loading 2302.14301v1…