Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studies

2024/04/14 by Brian R. Bartoldson, Bartoldson, Brian R., James Diffenderfer +5 · 10 citations
Computer Science · Medicine · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #COVID-19 diagnosis using AI #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2404.09349

openalex publication_date 2024/04/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

This paper revisits the simple, long-studied, yet still unsolved problem of making image classifiers robust to imperceptible perturbations. Taking CIFAR10 as an example, SOTA clean accuracy is about 100%, but SOTA robustness to ℓ_∞-norm bounded perturbations barely exceeds 70%. To understand this gap, we analyze how model size, dataset size, and synthetic data quality affect robustness by developing the first scaling laws for adversarial training. Our scaling laws reveal inefficiencies in prior art and provide actionable feedback to advance the field. For instance, we discovered that SOTA methods diverge notably from compute-optimal setups, using excess compute for their level of robustness. Leveraging a compute-efficient setup, we surpass the prior SOTA with 20% (70%) fewer training (inference) FLOPs. We trained various compute-efficient models, with our best achieving 74% AutoAttack accuracy (+3% gain). However, our scaling laws also predict robustness slowly grows then plateaus at 90%: dwarfing our new SOTA by scaling is impractical, and perfect robustness is impossible. To better understand this predicted limit, we carry out a small-scale human evaluation on the AutoAttack data that fools our top-performing model. Concerningly, we estimate that human performance also plateaus near 90%, which we show to be attributable to ℓ_∞-constrained attacks' generation of invalid images not consistent with their original labels. Having characterized limiting roadblocks, we outline promising paths for future research.

Cited by

• Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillation
• Diffusion Models are Robust Pretrainers
• Adversarial Attacks Leverage Interference Between Features in Superposition
• Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networks
• Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness
• The Impact of Scaling Training Data on Adversarial Robustness
• DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysis
• On the Escaping Efficiency of Distributed Adversarial Training Algorithms
• Does simple trump complex? Comparing strategies for adversarial robustness in DNNs
• DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples

Related

• Is RobustBench/AutoAttack a suitable Benchmark for Adversarial Robustness?
• Improving Robustness using Generated Data
• Unlabeled Data Improves Adversarial Robustness
• RobustBench: a standardized adversarial robustness benchmark
• Intriguing Properties of Robust Classification