Optimization for Robustness Evaluation Beyond ℓp Metrics
Hengyue Liang, Buyun Liang, Ying Cui, Tim Mitchell, Ju Sun
Abstract
Empirical evaluation of the adversarial robustness of deep learning models involves solving non-trivial constrained optimization problems. Popular numerical algorithms to solve these constrained problems rely predominantly on projected gradient descent (PGD) and mostly handle adversarial perturbations modeled by the ℓ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf>, ℓ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf>, and ℓ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">∞</inf> metrics. In this paper, we introduce a novel algorithmic framework that blends a general-purpose constrained-optimization solver PyGRANSO, With Constraint-Folding (PWCF), to add reliability and generality to robustness evaluation. PWCF 1) finds good-quality solutions without the need of delicate hyperparameter tuning and 2) can handle more general perturbation types, e.g., modeled by general ℓ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</inf> (where p > 0) and perceptual (nonℓ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</inf>) distances, which are inaccessible to existing PGD-based algorithms.
BibTeX
@inproceedings{icassp2023_optimizationforr,
title = {Optimization for Robustness Evaluation Beyond ℓp Metrics},
author = {Hengyue Liang and Buyun Liang and Ying Cui and Tim Mitchell and Ju Sun},
booktitle = {ICASSP 2023},
year = {2023}
}