Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics

Haya Brama, Lihi Dery, Tal Grinshpoun

TL;DR

Two metrics are presented specifically designed to measure the effect of attacks, or the recovery effect of defenses, on the output of neural networks in multiclass classification tasks, which demonstrate superior informativeness and distinctiveness.

Abstract

The problem of attacks on neural networks through input modification (i.e., adversarial examples) has attracted much attention recently. Being relatively easy to generate and hard to detect, these attacks pose a security breach that many suggested defenses try to mitigate. However, the evaluation of the effect of attacks and defenses commonly relies on traditional classification metrics, without adequate adaptation to adversarial scenarios. Most of these metrics are accuracy-based, and therefore may have a limited scope and low distinctive power. Other metrics do not consider the unique characteristics of neural networks functionality, or measure the effect of the attacks indirectly (e.g., through the complexity of their generation). In this paper, we present two metrics which are specifically designed to measure the effect of attacks, or the recovery effect of defenses, on the output of neural networks in multiclass classification tasks. Inspired by the normalized discounted cumulative gain and the reciprocal rank metrics used in information retrieval literature, we treat the neural network predictions as ranked lists of results. Using additional information about the probability of the rank enabled us to define novel metrics that are suited to the task at hand. We evaluate our metrics using various attacks and defenses on a pretrained VGG19 model and the ImageNet dataset. Compared to the common classification metrics, our proposed metrics demonstrate superior informativeness and distinctiveness.

Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics

TL;DR

Two metrics are presented specifically designed to measure the effect of attacks, or the recovery effect of defenses, on the output of neural networks in multiclass classification tasks, which demonstrate superior informativeness and distinctiveness.

Abstract

The problem of attacks on neural networks through input modification (i.e., adversarial examples) has attracted much attention recently. Being relatively easy to generate and hard to detect, these attacks pose a security breach that many suggested defenses try to mitigate. However, the evaluation of the effect of attacks and defenses commonly relies on traditional classification metrics, without adequate adaptation to adversarial scenarios. Most of these metrics are accuracy-based, and therefore may have a limited scope and low distinctive power. Other metrics do not consider the unique characteristics of neural networks functionality, or measure the effect of the attacks indirectly (e.g., through the complexity of their generation). In this paper, we present two metrics which are specifically designed to measure the effect of attacks, or the recovery effect of defenses, on the output of neural networks in multiclass classification tasks. Inspired by the normalized discounted cumulative gain and the reciprocal rank metrics used in information retrieval literature, we treat the neural network predictions as ranked lists of results. Using additional information about the probability of the rank enabled us to define novel metrics that are suited to the task at hand. We evaluate our metrics using various attacks and defenses on a pretrained VGG19 model and the ImageNet dataset. Compared to the common classification metrics, our proposed metrics demonstrate superior informativeness and distinctiveness.
Paper Structure (15 sections, 7 equations, 5 figures, 1 table)

This paper contains 15 sections, 7 equations, 5 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. Adversarial Attacks
  4. Defense methods
  5. Evaluation Metrics
  6. Methodology
  7. $\mathit{NDCG}$-based Evaluation Metric
  8. Relevance score
  9. Setting k
  10. Ideal ranking for normalization
  11. Defense Reciprocal Rank
  12. Experimental Evaluation
  13. Experimental Setting
  14. Results
  15. Conclusion

Figures (5)

  • Figure 1: Representative examples and their top-1 predictions that demonstrate three possible types of deceiving. (a) Minor misclassification: adversarial (left) and benign (right) images classified as 'green mamba'. The original seed of the AE is classified as 'green snake', and 'green mamba' is the second highest prediction. (b) Major misclassification: adversarial (left) and benign (right) images classified as 'baseball'. The original seed of the AE has 'baseball' prediction in the 117th place. (c) Wrong prioritization: AE classified as 'hay', where the image does present hay. The original seed is classified as 'harvester', and 'hay' is the second highest prediction. Images were taken from ImageNet and evaluated using VGG19.
  • Figure 2: $\mathit{NDCG}$ scores of the top-10 predictions for different attacks
  • Figure 3: Evaluation of attacks using different metrics
  • Figure 4: Evaluation of defenses against targeted attacks using different metrics
  • Figure 5: Evaluation of defenses against untargeted attacks using different metrics