A Comprehensive Assessment Benchmark for Rigorously Evaluating Deep Learning Image Classifiers

TL;DR

The paper tackles the insufficiency of current evaluation protocols for image classifiers by proposing a Comprehensive Assessment Benchmark that tests robustness across five data types: clean, corrupt, adversarial, novel, and unrecognisable. It adopts a single metric, DAR, derived from an extended rejection-evaluation framework, and demonstrates that existing models—including state-of-the-art robust models—exhibit weaknesses when evaluated comprehensively across diverse data scenarios. By comparing MSP and other post-hoc rejection methods and applying the benchmark to multiple datasets, the work reveals systematic trade-offs between accuracy on known data and the ability to reject unknown or corrupted inputs, challenging prevailing assumptions about robustness. The proposed framework promotes reproducible, cross-type evaluation and suggests that robustness improvements may require ensemble or architectural strategies, with practical implications for deploying reliable image classifiers in real-world, diverse environments.

Abstract

Reliable and robust evaluation methods are a necessary first step towards developing machine learning models that are themselves robust and reliable. Unfortunately, current evaluation protocols typically used to assess classifiers fail to comprehensively evaluate performance as they tend to rely on limited types of test data, and ignore others. For example, using the standard test data fails to evaluate the predictions made by the classifier to samples from classes it was not trained on. On the other hand, testing with data containing samples from unknown classes fails to evaluate how well the classifier can predict the labels for known classes. This article advocates benchmarking performance using a wide range of different types of data and using a single metric that can be applied to all such data types to produce a consistent evaluation of performance. Using the proposed benchmark it is found that current deep neural networks, including those trained with methods that are believed to produce state-of-the-art robustness, are vulnerable to making mistakes on certain types of data. This means that such models will be unreliable in real-world scenarios where they may encounter data from many different domains, and that they are insecure as they can be easily fooled into making the wrong decisions. It is hoped that these results will motivate the wider adoption of more comprehensive testing methods that will, in turn, lead to the development of more robust machine learning methods in the future. Code is available at: https://codeberg.org/mwspratling/RobustnessEvaluation

Figures (3)

• Figure 1: A synthetic example of the sort of predictions made by a deep learning classifier when tested in different ways after being trained to recognise images of objects from categories including "phone" and "radio". Each sub-figure illustrates a different method of testing the accuracy of the classifier, it shows four sample images and the ground-truth and predicted classes for those images. (a) Samples from the test/validation data-set (this data looks very similar to the training data). (b) Samples used to assess generalisation. (c) Adversarially perturbed samples (the modifications to the images are virtually imperceptible but cause significant change to the classifier's prediction). (d) Samples showing objects from categories not included in the training data. (e) Samples that differ from images of natural objects or that have been synthetically generated to fool the classifier into making incorrect, high confidence, predictions. Kumano_etal22.
• Figure 2: Decision trees illustrating standard assessment methods for (a) known class data, and (b) unknown class rejection. (c) The method proposed by Zhu_etal22 for dealing with test data from both known and unknown classes.
• Figure 3: An illustration of the regions of feature-space explored by different methods of testing the accuracy of the classifier. The shaded regions in each sub-figure show regions of a hypothetical feature-space truly occupied by two categories on which a classifier has been trained. (a) Samples from the clean test data-set probe sub-regions within each known category. (b) Samples used to assess generalisation probe larger or different regions within each known category. (c) Adversarially perturbed samples probe along the decision boundary between known classes. (d) Samples from novel classes and (e) unrecognisable samples probe regions of feature-space outside the regions occupied by the known classes.