How Worst-Case Are Adversarial Attacks? Linking Adversarial and Statistical Robustness

TL;DR

This paper interrogates whether adversarial perturbations provide a representative proxy for robustness to random noise. It introduces directional noisy risk, a probabilistic metric $\,\mathcal{R}(x; v, \kappa, r)$ that interpolates between isotropic noise ($\kappa=0$) and adversarial direction (large $\kappa$) via Gaussian perturbations projected onto the $\ell_p$-sphere, and proposes a directional noisy attack (DN-Attack) that optimizes for risk in low-$\kappa$ regimes. Through experiments on ImageNet-Val and CIFAR-10 across multiple architectures, the authors show that many standard attacks achieve high success only in highly directional, worst-case regimes, while DN-attacks reveal broader, noise-aligned failure regions that are more relevant for safety evaluations. The work provides practical guidelines for robustness assessment, highlighting when adversarial success reflects noisy risk and when it does not, and connects robustness evaluation to model confidence analyses and dimensionality considerations. Overall, the directional noisy risk framework and DN-attack offer a nuanced, statistically grounded approach to evaluating robustness beyond worst-case perturbations.

Abstract

Adversarial attacks are widely used to evaluate model robustness, yet their validity as proxies for robustness to random perturbations remains debated. We ask whether an adversarial perturbation provides a representative estimate of robustness under random noise of the same magnitude, or instead reflects an atypical worst-case event. To this end, we introduce a probabilistic metric that quantifies noisy risk with respect to directionally biased perturbation distributions, parameterized by a concentration factor $κ$ that interpolates between isotropic noise and adversarial direction. Using this framework, we study the limits of adversarial perturbations as estimators of noisy risk by proposing an attack strategy designed to operate in regimes statistically closer to uniform noise. Experiments on ImageNet and CIFAR-10 systematically benchmark widely used attacks, highlighting when adversarial success meaningfully reflects noisy risk and when it fails, thereby informing their use in safety-oriented evaluation.

Figures (8)

• Figure 1: Misclassification rates on ImageNet-Val and CIFAR-10 for ResNet-50 across multiple $\varepsilon$ on $\ell_\infty$. Solid lines denote adversarial attacks; dotted lines denote MC error search analysis.
• Figure 2: Illustration of the proposed metric in a 2D-example. (a) and (b) compare two adversarial directions for the same input $x_0$ that differ in their directional noisy risk values $\mathcal{R}_{\kappa=5}$. (c) depicts a corner-case adversarial direction with a low noisy risk score.
• Figure 3: The average risk-aware error $\bar{\mathcal{R}}$ (y-axis) is shown as a function of $\kappa$ for different attacks under $\ell_\infty$ (first and second rows, $\varepsilon = 8/255$ and $4/255$) and $\ell_2$ (third and fourth, $\varepsilon = 0.5$ and $\varepsilon = 1.0$) threat models, evaluated on ResNet-50, ViT-B, WideResNet-101, and VGG-16. The reference value $\kappa^*$ is indicated by dotted lines, highlighting a statistically plausible risk regime.
• Figure 4: Correlation between uniform project noise ($\mathcal{R}$ at $\kappa = 0$) and $\mathcal{R}$ varying $\kappa$, using DN. (a) per-sample relation on ImageNet-Val samples for $\ell_\infty$ with $\varepsilon = 16/255$. (b) Spearman correlation $\rho$ vs. $\kappa$ for ImageNet-Val (top: $\varepsilon = 16/255$ for $\ell_\infty$, $\varepsilon = 2.0$ for $\ell_2$) and CIFAR-10 (bottom: $\varepsilon = 8/255$ for $\ell_\infty$, $\varepsilon = 1.0$ for $\ell_2$)
• Figure 5: Analysis of $\mathcal{R}$ for ImageNet-Val samples, with $\varepsilon = 8/255$ and different values of $\kappa \in \{5, 20, 50\}$. The x-axis reports the softmax probability of the predicted class.