Is RobustBench/AutoAttack a suitable Benchmark for Adversarial Robustness?

TL;DR

The paper scrutinizes RobustBench and AutoAttack as a robustness benchmark for vision models, arguing that the default $l_\infty$ perturbation setting with $\epsilon=8/255$ is unrealistically strong and often detectable by simple Fourier-domain detectors. It introduces ASR and ASRD as practical metrics to gauge attack effectiveness under defense and demonstrates through extensive experiments across CIFAR-10, CIFAR-100, ImageNet-downsampled variants, and CelebaHQ-4-32 that AutoAttack is frequently detectable, especially at higher resolutions. The work also shows that results on low-resolution data do not necessarily generalize to higher-resolution tasks, where perturbations become more discernible and robustness assessments differ. Collectively, these findings suggest rethinking robustness benchmarks to better reflect real-world vision settings and to drive development of genuinely robust methods across diverse datasets and perturbation regimes.

Abstract

Recently, RobustBench (Croce et al. 2020) has become a widely recognized benchmark for the adversarial robustness of image classification networks. In its most commonly reported sub-task, RobustBench evaluates and ranks the adversarial robustness of trained neural networks on CIFAR10 under AutoAttack (Croce and Hein 2020b) with l-inf perturbations limited to eps = 8/255. With leading scores of the currently best performing models of around 60% of the baseline, it is fair to characterize this benchmark to be quite challenging. Despite its general acceptance in recent literature, we aim to foster discussion about the suitability of RobustBench as a key indicator for robustness which could be generalized to practical applications. Our line of argumentation against this is two-fold and supported by excessive experiments presented in this paper: We argue that I) the alternation of data by AutoAttack with l-inf, eps = 8/255 is unrealistically strong, resulting in close to perfect detection rates of adversarial samples even by simple detection algorithms and human observers. We also show that other attack methods are much harder to detect while achieving similar success rates. II) That results on low-resolution data sets like CIFAR10 do not generalize well to higher resolution images as gradient-based attacks appear to become even more detectable with increasing resolutions.

Figures (6)

• Figure 1: Attack Success Rates under Defence (ASRD) of different adversarial attack methods on several datasets for a simple defense:wb Fourier domain detector with random forest original: RobustBench's AutoAttack are so easy to detect that successful attacks are very unlikely compared with other methods.
• Figure 2: Blackbox ASRD comparison using a Random Forest classifier on different $32\times 32$ datasets.
• Figure 3: ASRD of AA with random forest for a range of different $\epsilon$ on ImageNet.
• Figure 4: ASRD of AA with random forest for a range of different $\epsilon$ on CelebHQ.
• Figure 5: ASRD with Random Forest classifiers on increasing resolutions of ImageNet.