Neural Architecture Design and Robustness: A Dataset
Authors: Steffen Jung
Jovita Lukasik
Margret Keuper
Venue: ICLR 2023 poster (2023)
Keywords: dataset
robustness
architecture design

Abstract: Deep learning models have proven to be successful in a wide range of machine learning tasks. Yet, they are often highly sensitive to perturbations on the input data which can lead to incorrect decisions with high confidence, hampering their deployment for practical use-cases. Thus, finding architectures that are (more) robust against perturbations has received much attention in recent years. Just like the search for well-performing architectures in terms of clean accuracy, this usually involves a tedious trial-and-error process with one additional challenge: the evaluation of a network's robustness is significantly more expensive than its evaluation for clean accuracy. Thus, the aim of this paper is to facilitate better streamlined research on architectural design choices with respect to their impact on robustness as well as, for example, the evaluation of surrogate measures for robustness. We therefore borrow one of the most commonly considered search spaces for neural architecture search for image classification, NAS-Bench-201, which contains a manageable size of 6466 non-isomorphic network designs. We evaluate all these networks on a range of common adversarial attacks and corruption types and introduce a database on neural architecture design and robustness evaluations. We further present three exemplary use cases of this dataset, in which we (i) benchmark robustness measurements based on Jacobian and Hessian matrices for their robustness predictability, (ii) perform neural architecture search on robust accuracies, and (iii) provide an initial analysis of how architectural design choices affect robustness. We find that carefully crafting the topology of a network can have substantial impact on its robustness, where networks with the same parameter count range in mean adversarial robust accuracy from 20%-41%. Code and data is available at http://robustness.vision/.

Published as a conference paper at ICLR 2023
NEURAL ARCHITECTURE DESIGN AND ROBUSTNESS: A DATASET
Steffen Jung!2" Jovita Lukasik", MMrrgret Keuper'. Max Planck Institute for Informatics. Saarland Informatics Campus (steffen. jung, jlukasik, keuper @mpiiinff mpg. de 2 University of Siegen
ABSTRACT
Deep learning models have proven to be successful in wide range of machine learning tasks. Yet. they are often highly sensitive to perturbations on the input data which can lead to incorrect decisions with high confidence, hampering their deployment for practical use-cases. Thus, finding architectures that are (more) robust against perturbations has received much attention in recent years. Just like the search for well- performmnng architectures in terms of clean accuracy, this usually involves a tedious trial-and-error process with one additional challenge: the evaluation of network's robustness is significantly more expensive than its evaluation for clean accuracy. Thus, the aim of this paper is to facilitate better architectural design choices with respect to their impact streamlined research on robustness as well as, for example, the evaluation of surrogate measures for robustness. We therefore borrow one of the most commonly considered search spaces for neural architecture search for image classification, which contains a manageable size of 6 4666 non-isomorphic network designs. We evaluate all these networks on a range of common adversarial attacks and corruption types and introduce database on neural architecture design and robustness evalua- tions. We further present three exemplary use cases of this dataset, in which we (i) benchmark robustness measurements based on Jacobian and Hessian matrices for their robustness predictability. (ii) perform neural architecture search robust accuracies, and (iii) provide an initial analysis of how architectural design choices affect robustness. We find that carefully crafting the topology of a network can have substantial impact on its robustness, where networks with the same parameter count range in mean adversarial robust accuracy from 20% 41%. Code and data is available at httt:://robusteesss vision/
INTRODUCTION
One factor in the ever-improving performance of deep neural networks is based innovations in architecture design. The starting point was the unprecedented result of AlexNet (Krizhevsky et al. 2012) on the visual recognition challenge ImageNet (Deng et al., 2009). Since then, the goal is to lind better performing models, surpassing human performance. However, human design of new better performing architectures requires huge amount of trial-and-error and good intuition, such that the automated search for new architectures (NAS) receives rapid and growing interest (Zoph & Le 2017] Real et al. 2017 Ying et al. 2019 Dong & Yang 2020). The release tabular benchmarks (Ying et al. 2019 Dong & Yang 2020) led to a research change; new NAS methods can be evaluated in transparent and reproducible manner for better comparison.
The rapid growth in NAS research with the main focus on finding architecture designs with ever-better performance is recently accompanied by the search for architectures that are robust against adversarial attacks and corruptions. This is important, since image classification networks can be easily fooled by adversarial attacks crafted by already light perturbations on the image data, which invisible for humans. This leads false predictions of the neural network with high confidence.
Robustness in NAS research combines the objective of high performing and robust architectures
(Dong & Yang 2019: Devaguptapu et al. 2021 Dong al. 2020a Hosseini al. 2021 Mok

---

Published as a conference paper at ICLR 2023
et al. 2021). However, there was attempt so far to evaluate full search space robustness, but rather architectures in the wild. This paper is a first step towards closing this gap. We are the first introduce robustness dataset based on evaluating complete NAS search space, such as to allow benchmarking neural architecture search approaches for the robustness of the found architectures. This will facilitate better streamlined research neural architecture design choices and their robustness. We evaluate all 64666 unique pretrained architectures from the NAS-Bench-200
benchmark (Dong & Yang 2020) on common adversarial attacks (Goodfellow et al. 2015 Kurakin
et al. 2017: Croce & Hein 2020) and corruption types (Hendrycks & Dietterich 2019). We thereby follow the argumentation in NÁS research that employing one common training scheme for the entire search space will allow for comparability between architectures. Having the combination of pretrained models and the evaluation results our dataset at hand, we further provide the evaluation of common training- free robustness measurements, such as the Frobenius norm of the Jacobian matrix (Hoffman et al. 2019) and the largest cigenvalue of the Hessian matrix (Zhao et al. 2020), on the full architecture search space and use these measurements architecture. To prove the promise of our dataset to promote research in neural architecture search for robust models we perform several common NAS algorithms the clean well as the robust accuracy of different image classification tasks. Additionally, we conduct a first analysis of how certain architectural design choices affect robustness with the potential of doubling the robustness of networks with the same number of parameters. This is only possible, since we evaluate the whole search space of NAS-Bench-2D (Dong & Yang 2020), enabling us to investigate the effect of small architectural changes. To our knowledge we are the first paper to introduce a robustness dataset covering a full (widely used) search space allowing to track the outcome of fine ine-grained architectural changes. In summary we make the following contributions:
method to find the supposedly most robust
We present the first robustness dataset evaluating a complete NAS architectural search space.
We present different use cases for this dataset; from training-free measurements for robust- ness to neural architecture search.
Lastly, our dataset shows that a model's robustness against corruptions and adversarial at- tacks is highly sensitive towards the architectural design, and carefully crafting architectures can substantially improve their robustness.
2 RELATED WORK
Common Corruptions While neural architectures achieve results in image classification that super- sede human performance (He et al,) 2015). common corruptions such as Gaussian noise or blur can cause this performance to degrade substantially (Dodge & Karam| 2017). For this reason, (eaonn/kedrycks & Dietterich| (2019) propose a benchmark that enables researchers to evaluate their network design on several common corruption types.
Adversarial Attacks (zegedy et al. (2014) showed that image classification networks can be fooled by crafting image perturbations, so called adversarial attacks, that maximize the networks' prediction towards a class different to the image label. Surprisingly, these perturbations can be small enough such that they not visible to the human eye. One of the first adversarial attacks, called fast gradient sign method (FGSM) (Goodfellow et al.] (005)) tries to flip the label of an image a single perturbation step of limited size. This is achieved by maximizing the loss of the network and requires access to its gradients. Later gradient-base al. 2017), iteratively perturb the image in multiple gradient steps. To evaluate robustness in structured manner, CCoce & Hein (2020) propose an ensemble of different attacks, including an adaptive version of PGD (APGD) CCrce & Hein 2020) and blackbox attack called Square Attack (Andriushchenko et al. 2020) that has no access to network gradients. [Crce et al. (2021) conclude the next step robustness research by providing an adversarial robustness benchmark, RobustBench, tracking state-of-the the--rt models in adversarial robustness.
methods, like projected gradient descent (PGD) (Kurakin
NAS Neural Architecture Search (NAS) is an optimization problem with the objective to find an optimal combination of operations in a predefined, constrained search space. Early NAS approaches differ by their search strategy within the constraint search space. Common NAS strategies are
evolutionary methods (Real et al. [2117] 2019), reinforcement learning (RL) (Zoph & Le 2017
et al. 2018). random search (Bergstra & Bengio 2012 Li & Talwalkar 2019). local search (White
al. 2021b), and Bayesian optimization (BO) (Kandasamy al. 2018
Ru et al. 2021 2 White et al.
2

---

Published as a conference paper at ICLR 2023
Image
recictual blook
reeatiaa block
global Bng pool
Cell
Goeatiios
convolation
convolution
OAR
2x5 arg, pooling
connect
zaroiza
Figure 1: (top) Macro architecture. Gray highlighted cells differ between architectures, while the other components stay fixed. (bottom) Cell structure and the set of possible, predefined operations. (Figure adapted from (Dong& & Yang 2020
2021a).
Recently, several NAS approaches use generative models to search within a continuous latent space of architectures (Lukasik et al., 2021] Rezaei et al.) [021]] Lukasik et al., 2022). To further improve the search strategy efficiency, the research focus shift from discrete optimization methods to faster differentiable search methods, using weight-sharing approaches (Pham al. 2018 Liu et al.,
2019 [ender et al. 20188) Cai et al.] | et al.) 2209b iZela et al. 2000)). In order to compare NAS approaches properly, NAS benchmarks were introduced and opened the path for fast evaluations. The tabular benchmarks NAS-Bench-100 (Ying et al. 2019) and NAS-Bench-201 (Dong & Yang 2020) provide exhaustive evaluations of performances and metrics within their predefined search space image classification tasks. TransNAS Bench- 101 (Duan et al. (021) introduces a benchmark containing performance and metric information across different vision tasks. We will give a more detailed overview about the NAS-Bench-201 (Dong & Yang 2020) benchmark in subsection 3.1
Robustness in NAS With the increasing interest in NAS in general, the aspect of robustness of the optimized architectures has become more and more relevant. |Devaguptapu al. (2021) provide large-scale study that investigates how robust architectures, found by several NAS methods such as (Liu al., 2019: Cai al., 2019 Xu al. 2020). are against several adversarial attacks. They show that these architectures are vulnerable to various different adversarial attacks. Guo et al. (2020) first search directly for a robust neural architecture using one-shot NAS and discover family of robust architectures. Dong et al. (2020a) constrain the architectures' parameters within a supernet to reduce the Lipschitz constant and therefore increase the resulting networks' robustness. Few prior works such as (Carlini et al.) 2019: Xie et al. 2019a] Pang et al., 2021 Xie et al. 2020) propose more in-depth statistical analyses. In particular, Su et al. (2018) evaluate 18 ImageNet models with respect to their adversarial robustness. Ling et al. (019)) Dong et al. (2020b) provide platforms to evaluate adversarial attacks. Tang et al. (2021) provide a robustness investigation benchmark based ImageNet. Recently new line of differentiable robust NAS arose, namely including differentiable network measurements to the one-shot loss target to increase the robustness (Hosseini et al., 202 Mokk et al. (021). Hosseini al. (2021) define two differentiable metrics to measure the robustness of the architecture, certified lower bound and Jacobian norm bound, and searches for architectures by maximizing these metrics, respectively, |Mok] et al. (2021) propose a search algorithm using the intrinsic robustness of neural network being represented by the smoothness of the network's 's input loss landscape, i.e. the Hessian matrix.
on different architectures and training techniques
DATASET GENERATION
3.1 ARCHITECTURES IN NAS-BENCH-
(Dong& & Yang 2020) is a cell-based architecture search space. Each cell has in total 4 nodes and 6 edges. The nodes in this search space correspond to the architecture's feature maps and the edges represent the architectures operation, which are chosen from the operation set O 0= (1 conv. 3 x 3 conv. 3 x 3 avg. pooling, skip zeroo} (see Figure 1}. This search space contains in total 5 = 15 625 architectures, from which only 6 466 are unique, since the operations skip and zero can cause isomorphic cells (see Figure 8 appendix), where the latter operation zero stands for dropping the edge. Each architecture is trained on three different image datasets for 200 epochs: CIFAR-10 (Krizhevsky 2009), CIFAR- (Krizhevsky) 2009) and ImageNet16-122
3

---

Published as a conference paper at ICLR 2023
c2e FGSM accurdes
che
diartD LLED
diart SQLIRE
33
31
42
2.655
6.1 0.5
01 85
0.1 65
Figure 2: Accuracy boxplots over all 6 466 unique architectures in NAS- Bench-201 for different adversarial attacks (FGSM (Goodfellow al. 2013), PGD (Kurakin et al. 2017), APGD (Croce & Hein 2020), Square (Andriushchenko et al. 2020)) and perturbation magnitude values e, evaluated on CIFAR-10. Red line corresponds to guessing. The large spread indicates towards architectural influence on robust performance.
04 sogede e=0
dodc e-05
ae end
ow
cac at Shggle e-3 aa sogd square an souare, as aqaate e=1
ae souste e=2
na a0las a=3 de coree and
10000 e-g se sessee.....
dean. o
Igam e-0.1
Ream e=03
Igsm n-1
foom e-7
fgem. e-3
c-5
ream e=7
fgem. e-8
fysm. c-255
pad. a-0
per, e=0.5
a2 a0nde
st s990
(gam
ugg
0g6,
1.00
fgom, 6-0.5
tosm, e=1
fgsm, e=?
0.75
fgsm, e=3
tosm, 6-4
fgsm, em5
0.50
fosm,
fgsm, 255
pgo. e=0
pgd, e-0.5
pgd. em1
pod. e=2
pod. 0-3
0.00
pgd.
apgd-ce.
apgd-ce, as cp
-0.25
3a sppdccc, e=2
aa sngopgd-ce, e=3
ao_apgd-ce, 6-4
as_apgd-ce, e=8
aa_qqure, e-0.5
squar, a8 squrru as square a3 square, e=4
-0.75
squre, e=8
-1.00
Figure 3: Kendall rank correlation coefficient between clean accuracies and robust accuracies on different attacks and magnitude values e on CIFAR-10 for all unique architectures MAS-Bench-201. There seem to be architectural distinctions for susceptibility to different attacks.
CCrabaszzzz et al. 2017). For our evaluations, we consider all unique architectures in the search space and test splits of the corresponding datasets. Hence, we evaluate 3 64466 19 398 pretrained networks in total. In the following, we describe which evaluations we collect.
3.2 ROBUSTNESS TO ADVERSARIAL ATTACKS
We start by collecting evaluations different adversarial attacks, namely FGSM, PGD, APGD, and Square Attack. Following, we describe each attack and the collection of their results in more detail.
FGSM FGSM (Goodfellow al. 2015) finds adversarial examples via
f 2: + esign( A. (0,
(1)
4

---

Published as a conference paper at ICLR 2023
where i is the adversarial example, is the input image, y the corresponding label, the magnitude of the perturbation, and 9 the network parameters. J(e, x. y) is the loss function used to train the attacked network. In the case of architectures trained for NAS-Bench-201, this is cross entropy (CH). Since attacks via FGSM can be evaluated fairly efficiently, we evaluate all architectures for 6 E FEGSs architecture. We use Foolbox (Rauber et al. 2017) to perform the attacks, and collect (a) accuracy, (b) average prediction confidences, as well as (c) confusion matrices for each network and E combination.
f.1,-5, 1, 1,2, ..... 8, 255 /255, for total of |ErasM| = 11 times for each
PGD While FGSM perturbs the image in single step of size e, PGD (Kurakin el al. 2017) iteratively perturbs the image via
In+1 = - - asign( , T., 0))), Tu = x;
(2)
where T is the least likely predicted class of the network, and (-) is function clipping to range [z C, x + c). Due to its iterative nature, PGD is more efficient in finding adversarial examples, but requires more computation time. Therefore, we find it sufficient to evaluate PGD for E FRGD (-1, -5, 1, 3. 4, 8) /255, so for total of | = 7 times for each architecture. As for FGSM, we use Foolbox (Rauber et al. (2017) to perform the attacks using their I. PGD) implementation and keep the default settings, which are 0.01/0. /0.3 for 40 attack iterations. We collect (a) accuracy, (b) average prediction confidences, and (c) confusion matrices for each network and combination.
APGD AutoAttack (Croce & Hein 2020) offers an adaptive version of PGD that reduces its step size over time without the need for hyperparameters. We perform this attack using the Loo implementation provided by (Croce& & Hein 2020) on CE and choose FARGD = FRGDD We kept the default number of attack iterations that is 100. We collect (a) accuracy, (b) average prediction confidences, and (c) confusion matrices for each network and c combination.
Square Attack In contrast to the before- mentioned attacks, Square Attack is blackbox attack that has no access to the networks' gradients. It solves the following optimization problem using random search:
min {f. - (x))), s.t. I|
x11p Se
(3)
where f-,o(-) are the network predictions for class given an image. We perform this attack using the Loo implementation provided by (Croce & Hein 2020) and choose Esquare = EPOD- We kept the default number of search iterations at 500. We collect (a) accuracy, (b) average prediction confidences, and (c) confusion matrices for each network and combination.
Summary Figure 2 shows aggregated evaluation results on the before-mentionel attacks on CIFAR-10 w.r.t. accuracy. Growing gaps between mean and max accuracies indicate that the ar- chitecture has an impact on robust performances. [Fiuure deppcts the correlation of ranking all architectures based on different attack scenarios. While there is larger correlation within the same adversarial attack and different values of c, there seem to be architectural distinctions for susceptibility different attacks.
3.3 ROBUSTNESS TO COMMON CORRUPTIONS
To evaluate all unique
Dong & Yang (2020) architectures on common corruptions, we evaluate them on the benchmark data provided by (Hendrycks & Dietterich 2019). Two datasets are available: CIFAR10-C, which is a corrupted version of CIFAR-I0 and CIFAR-100-
which corrupted version of CIFAR-100. Both datasets are perturbed with a total of 15 corruptions at 5 severity levels (see Figure 18 in the Appendix for an example). The training procedure of MAS-Bench-22 only augments the training data with random flipping and random cropping. Hence, no influence should be expected of the training augmentation pipeline on the performance of the networks to those corruptions. We evaluate each of the 15 5 = 75 datasets individually for each network and collect (a) accuracy, (b) average prediction confidences, and (c) confusion matrices.
Summary Figure 4 depicts mean accuracies for different corruptions at increasing severity levels. Similar to Figure 2 growing gap between mean and max accuracies for most of the corruptions can be observed, which indicates towards architectural influences on robustness to common corruptions. Figure 5 the ranking correlation for all architectures between clean and corrupted accuracies. Ranking architectures based on accuracy on different kinds of corruption is mostly uncorrelated. This indicates high diversity of sensitivity to different kinds of corruption based architectural design.
5

---

Published as a conference paper at ICLR 2023
chrll
cbrtr contrst
chart deficue,
ottr elatii transfum
0.2
02
accuracy
cournicy
gaussian, accuracy
raccuracy
3.5
3.5
Sewerty
Seaerty
Figure 4: Accuracy boxplots over all unique architectures in NAS-Bench- for different corruption types at different severity levels, evaluated on LIFAR-1--C Red line corresponds to guessing. All corruptions can be found in Figure 21 The large spread indicates towards architectural influence robust performance.
elastic cranform. s=3
joeg comoressson,, s=3
roise, s=3
s=3
glass blur. s=3
motion olur, s-3
shat nolke, s=3
zoom, b0r, s=3
contrast. s=3
defocus blur,
pixelate 5
brightness,
mussial 5-3
snow, s=3
tog, 5-3
dean
frst,
1.00
clean
brightness, 5=3
0.75
contrast, s=3
defocus blur, 5-3
elastic trannsfomm,. s=3
0.50
fog,
frost, s=3
0.25
gaussian noise,
0.00
glass blur, s=3
imoulse noise,
0.25
jpeg, compression, 5=3
motion blur,
pixelate, ==3
shot noise, $=3
snow, 5-3
zoom_blu blur. 5=3
Figure 5: Kendall rank correlation coefficient between clean accuracies and accuracies on different corruptions at severity level 3 on CIFAR-10-C for all unique architectures in NAS-Bench-25 The mostly uncorrelated ranking indicates towards high diversity sensitivity to different kinds of corruption based architectural design.
4
USE CASES
4.1 TRAINING-FREE MEASUREMENTS FOR ROBUSTNESS
Recently, new research focus in differentiable NAS shifted towards finding not only high-scoring architectures but also finding adversarially robust architectures against several adversarial attacks (Hosseini et al.] 2021 Mok al. (021)) using training characteristics of neural networks. On the one hand, (Hosseini et al. (221) uses Jacobian incobian-based differentiable metrics to measure robustness. On the other hand, (Mok al. 2021) improves the search for robust architectures by including the

---

Published as a conference paper at ICLR 2023
30300 ext
c-1
segrce c-s
c-05
suuae u=2
squte c-3
and
squrr um8
fgom 0-05
1gm m-t
(g w
1gm c-6
1gm ext
fpom c-8
fgrm C-255
500 o-1
33 2002
squir
s00
hessin_ttes test, pretrained
1.0
hesstan_ted
hosslan,
jacobian test, pratraieed
heodon_trail train, random
0.0
jacablan test, random
jacotian train, pretrined jacobin
-05
gu022 anunooo 5m3
deficin Mon 5m3
abetti jrastomm
1100 come cossin.
compressiin
mode sur awd
conneal x-3
5-3
impuse nole
bnginmes
Fost, eo
seow am3
fog.
zown
1.0
hesslnn teet, internned
hessiinztee
bessan,train,
sessian trais, random boblan_test: test, pretroined
08
Jacobian,traan jecotlen train, random
Figure 6: Kendall rank correlation coefficient between Jacobian- and Hessian-based robustness measurements computed on all unique MAS-Bench-201 architectures to corresponding rankings given by (top) different adversarial attacks and (bottom) different common corruptions. Measurements and accuracies are computed CIFAR-10 / CIFAR-10-C Measurements initialized and pretrained networks contained in AAS-Bench-201. Jacobian-based and Hessian-based measurements correlate well for smaller values, but not for larger e values.
computed randomly
smoothness of the loss landscape of neural network. In this section, we evaluate these training-free gradient-based measurements with our dataset.
Background: Jacobian To improve the robustness of neural architectures, (Hoffman et al. 2019) introduced an efficient Jacobian regularization method with the goal to minimize the network's ' output change in case of perturbed input data, by minimizing the Frobenius norm of the network's Jacobian matrix, J. The Frobenius norm is defined as |x(()) = VEo.o ()),(()) Let fo RR + RC be
neural network with weights denoted by 0 and let E I. be the input data and I be the output score. Let ह = x + e be a perturbed input, with E E IRD being a perturbation vector. The output of the neural network shifts then to fo,c(x (1r) The input-output Jacobian matrix be used as a measurement for the networks stability against input perturbations (Hoffman et al. 2019):
Ofo.cu
f0 +) (z)
Σ Ed
(x)
Σ (z) Eds d=1
Oxa
according Taylor-expansion. From [qquation 4 can directly see that the larger the Jacobian components, the larger is the output change and thus the more unstable is the neural network against perturbed input data. In order increase the stability of the network, (Hoffman proposes to decrease the Jacobian components by minimizing the square of the Frobenius norm of the Jacobian. Following (Hosseini et al. (02T). we use the efficient algorithm presented in (Hoffman et al. 2019) to compute the Frobenius norm based on random projection for each neural network in NAS-Bench-201 (Dong & Yang 2020) benchmark.
al.) 2019)
Benchmarking Results: Jacobian The smaller the Frobenius norm of the Jacobian of a network, the more robust the network is supposed to be. Our dataset allows for direct evaluation of this statement on all 6 466 unique architectures. We use 10 mini-batches of size 256 of the training well as test dataset for both randomly initialized and pretrained networks and compute the mean Frobenius norm. The results in terms of ranking correlation adversarial robustness is shown in Figure 6 (top), and in terms ranking correlation to robustness towards common corruptions in Figure (bbottom) We can observe that the lacobian-based measurement correlates well with rankings after attacks by FGSM
7

---

Published as a conference paper at ICLR 2023
and smaller values for other attacks. However, this is not true anymore when increases, especially in the case of APGD.
Background: Hessian Zhao et al. 2020) investigate the loss landscape of regular neural network and robust neural network against ad adversarial attacks. Let L (=)) denote the standard classification loss of neural network fo for clean input data x: E IR D and [(fo( + E)) be the adversarial loss with perturbed input data x + e, E IR.. Zhao et al. (2020) provide theoretical justification that the latter adversarial loss is highly correlated with the largest eigenvalue of the input Hessian matrix H (x) of the clean input data 2, denoted by Amax- Therefore the eigenspectrum of the Hessian matrix of the regular network can be used for quantifying the robustness: large Hessian spectrum implies a sharp minimum resulting in a more vulnerable neural network against adversarial attacks. Whereas in the case of a neural network with small Hessian spectrum, implying a flat minimum, more perturbation on the input is needed to leave the minimum. We make use of (Chatzimichailidi, et al.) 2019) to compute the largest eigenvalue Amax for each neural network in the NAS-Bench-200 (Dong Yang 2020) benchmark.
Benchmarking Results: Hessian For this measurement, we calculate the largest eigenvalues of all unique architectures using the Hessian approximation in (Chatzimichailldis et al. (209)). We use 10 mini-batcheer of size 256 of the training as well as test dataset for both randomly initialized and pretrained networks and compute the mean largest eigenvalue. These results are also shown in Figure 6) We can observe that the beesiannbbase measurement behaves similarly to the Jacobian-basee measurement.
Table 1: Neural Architecture Search on the clean test accuracy and the FGSM (e = 1) robust test accuracy for different state of the art methods CIFAR- 10 in the JAS-Bench-200 (Dong & Yang 2020) search space (mean over 100 runs). Results are the mean accuracies of the best architectures found different adversarial attacks and the mean accuracy over all corruptions and severity levels in CIFAR-10-C.
Test Accuracy (E 1.0)
Method
Clean
FGSM
PDG
APGD
Squares
Clean
CIFAR-10
CF-10-C
Optimum
94.68
69.24
58.85
54.02
73.61
58.55
BANANAS White el al. 202
94.21
64.25
41.10
18.62
68.69
55.52
Clean
Local Search
White al. 16
94.65
63.95
41.17
18.74
69.59
56.90
Random Search
&T& larwal 2019
94.22
63.38
40.09
17.84
68.40
55.60
Regularized Evolution Real
2019
94.53
63.30
40.23
18.11
68.92
56.21
BANANAS WWite et al. 2021a
93.52
66.35
45.59
20.72
68.01
54.88
FGSM
Local Search WWhite ot al. 202
98.88 86.86
69.10
48
23. 18
69.47
56.57
Random Search Li& & latwalkar
2019
93.57
67.25
46.15
20.93
68.45
55.10
Regularized Evolution RReal el al.
2019
93.77
68.82
47.99
22.59
69.20
56.11
4.2 NAS ON ROBUSTNESS
In this section, we perform different state-of-the-an NAS algorithms on the clean accuracy and the FGSM (e = 1) robust accuracy in the evaluate the best found architectures all provided introduced adversarial attacks. We apply random search (Li & Talwalkar, 2019), local search (White et al.) 2021b), regularized evolution (Real et al., 2019) and BANANAS (White et al., (021a)) with a maximal query amount of 300. The results shown in Table I Although clean accuracy is reduced, the overall robustness to all adversarial attacks improves when the search is performed on FGSM
(Dong & Yang 2020) search space, and
1.0) accuracy. Local Search achieves the best performance, which indicates that localized changes to an architecture design seem to be able to improve network robustness.
4.3 ANALYZING THE EFFECT OF ARCHITECTURE DESIGN ON ROBUSTNESS
In Figure 7 we show the top-20 performing architectures (color-coded, operation for each edge) with exactly 2 times x convolutions and no 1 x 1 convolutions (hence, the same parameter count), according to the mean adversarial accuracy over all attacks described in subsection 3.2 on
8

---

Published as a conference paper at ICLR 2023
0.400
F11693
Advensaraal Accurayy
49193
F448
4950
0.390
#14222
49587
14911
4325
111286
skip
conn 3X1
300
skip
comn Jul
comn 3x3
2ug
24r020
skip
conv 3x0
aeg
zerolze
come 1xt
1oo0 323
2000
Co0
conv
conv
2000
200
Operation
Figure 7: Top-20 architectures (out of 408) with exactly times 3 x convolutions and no x convolutions according to mean adversarial accuracy on CIFAR-IO. The operation number (1-6) corresponds to the edge in the cell, see Figure I for cell connectivity and operations. Stacking convolutions seems be an important part of robust architectural design.
CIFAR-10. 10. It is interesting that there convolutions edges 2 and 4, and additionally dropping (operation zeroize) or skipping (operation skip-connest of edge In the case edge 4, seems that single convolutional layer connecting input and output of the cell increases sensitivity of the network. Hence, most of the top-20 robust architectures stack convolutions (via edge 1, followed by either edge 3 5). from which hypothesize that stacking convolution operations might improve robustness when designing architectures. At the same time, skipping input to output via edge 4 seems not affect robustness negatively, long the input feature map is combined with stacked convolutions. Further analyses can be found in Appendix B We find that optimizing architecture design can have substantial impact on the robustness of network. In this setting, where networks have the same purameter count, we can showing the potential of doubling the robustness of a network by carefully crafting its topology. Important note here is that this is first observation, which can be made by using our provided dataset. This observation functions as a motivation for how this dataset can be used to analyze robustness in combination with architecture design.
large range of mean adversarial accuracies (0.21, 0.4]
5 CONCLUSION
We introduce dataset for neural architecture design and robustness provide the research community with more resources for analyzing what constitutes robust networks. We have evaluated all 6 466 unique architectures from the commonly used NAS-Bench-201 benchmark against several adversarial attacks and image dataset corruptions. With this full evaluation at hand, we presented three use cases for this dataset: First, the correlation between the robustness of the architectures and two differentiable architecture measurements. We showed that these measurements are good first approach for the architecture' robustness, but have to be taken with caution when the perturbation increases. Second, neural architecture search directly on the robust accuracies, which indeed finds more robust architectures for different adversarial attacks. And last, an initial analysis architectural design, where showed that it is possible to improve robustness of networks with the same number of parameters by carefully designing their topology.
Limitations and Broader Impact We show that carefully crafting the architectural design can lead to substantial impact on the architecture's robustness. This paper aims to promote and streamline research how the architecture design affects model robustness. It does by evaluating pretrained architectures and is thus complementary to any work focusing on the analysis different, potentially adversarial, training protocols.

---

Published as a conference paper at ICLR 2023
REPRODUCIBILITY
In order to ensure reproducibility, we build our dataset on architectures from a common NAS- Benchmark, which is described the main paper susuusecction 3.1 In addition, all hyperparameters for reproducing the robustness results are given in sussseccttoon 3.2) Lastly, complete description of the dataset itself is provided the appendix. [Appendix pppendix,/ppendixx
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In European Conference Computer Vision, pp. 484-501. Springer, 2020.
Gabriel Bender, Pieter-Jan Kindermans, Barret Zoph, Vijay Vasudevan, and Quoe V. Le. Understand- ing and simplifying one-shot architecture search. In ICML, 2018.
James Bergstra and Yoshua Bengio. Random search for hyper-parameter optimization. Journal of Machine Learning Research, 13(10))281-335 2012.
Han Cai, Ligeng Zhu, and Song Han. Proxylessnas: Direct neural architecture search on target task and hardware. In ICLR, 2019.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian J. Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. CoRR, abs/1902.06705, 2019. URLp:tt:://axxi http:////axxi..ooraa//////////
06705
Avraam Chatzimichailidis, Janis Keuper, Franz-Josef Pfreundt, and Nicolas R. Gauger. Gradvis: Visualization and second order analysis of optimization surfaces during the training of deep neural networks. In Workshop on Machine Learning in High Performance Computing Environments, MLHPC@ SC, 2019.
Patryk Chrabaszez, Ilya Loshchilov, and Frank Hutter. A downsampled variant of imagenet as an alternative to the CIFAR datasets. CoRR, abs/1707. Abs//707.08819/ 19, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-222 2216. PMLR, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robusthench: standardized adversarial robustness benchmark. In Joaquin Vanschoren and Sii-Kit Yeung (eds.), NeurIPS Datasets and Benchmarks, 2021.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In CVPR, 2009.
Chaitanya Devaguptapu, Devansh Agarwal, Gaurav Mittal, Pulkit Gopalani, and Vineeth N. Bala- subramanian. On adversarial robustness: A neural architecture search perspective. In ICCVW, 2021.
Samuel F. Dodge and Lina J. Karam. study and comparison of human and deep learning recognition performance under visual distortions. CoRR, abs/1705.02499) 2017. URL httpp://axiiv
brg/abs/In /105. 02498
Minjing Dong, Yanxi Li, Yunhe Wang, and Chang Xu. Adversarially robust neural architectures. CoRR, has/2009.00902. 2020a.
Xuanyi Dong and Yi Yang. Searching for robust neural architecture in four GPU hours. In CVPR. 2019.
Xuanyi Dong and Yi Yang. Nas-bench- 2011 Extending the scope reproducible neural architecture search. In ICLR, 2020.
10

---

Published as a conference paper at ICLR 2023
Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang. Hang Su, Zihao Xiao, and Jun Zhu. Benchmark- ing adversarial robustness on image classification. In 2020 IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pp. 318-328, 2020b. doi: 10.1109/CVPR44200002000 00000.
Yawen Duan, Xin Chen, Hang Xu, Zewei Chen, Xiaodan Liang, Tong Zhang, and Zhenguo Li. Transnas-bench- 101: Improving transferability and generalizability of cooss-task neural architec- ture search. In CVPR, 2021.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. http:t/t://axtit org otg/ abs 1412.4122212 6572
Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When NAS meets robustness: In search of robust architectures against adversarial attacks. In CVPR, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. 2015 IEEE International Conference on Computer Vision (ICCV), pp. 1026-1034, 2015. doi: 10. 109//CCV.2015.123...
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corrup- tions and perturbations. Proceedings of the International Conference on Learning Representations, 2019.
Judy Hoffman, Daniel A. Roberts, and Sho Yaida. Robust learning with jacobian regularization. CoRR, hts/1998.027299, 2019.
Ramtin Hosseini, Xingyi Yang, and Pengtao Xie. DSRNA: differentiable search of robust neural architectures. In CVPR, 2021.
Kirthevasan Kandasamy, Willie Neiswanger, Jeff Schneider, Barnabás Póczos, and Eric P. Xing. Neural architecture search with bayesian optimisation and optimal transport. NIPS, 2018.
Alex Krizhevsky. Learning multiple layers of features from tiny images. In Technical report, 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convolu- tional neural networks. In NIPS, 2012.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale, 2017.
Liam Li and Ameet Talwalkar. Random search and reproducibility for neural architecture search. In UAI, 2019.
Yujia Li, Oriol Vinyals, Chris Dyer, Razvan Pascanu, and Peter W. Battaglia. Learning deep generative models of graphs. CoRR, abs//803 803.03334444 2018.
Xiang Ling, Shouling Ji, Jiaxu Zou, Jiannan Wang, Chunming Wu, Bo Li, and Ting Wang, Deepsec: A uniform platform for security analysis of deep learning model. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 673-690 2019. doi: 10.1109/SP:009900000
Hanxiao Liu, Karen Simonyan, and Yiming Yang. DARTS: differentiable architecture search. In ICLR, 2019.
Jovita Lukasik, David Friede, Arber Zela, Frank Hutter, and Margret Keuper. Smooth variational graph embeddings for efficient neural architecture search. In International Joint Conference on Neural Networks, IJCNN 2021, Shenzhen, China, July 18-22, 2021, pp. 1-8. IEEE, 2021.
Jovita Lukasik, Steffen Jung, and Margret Keuper. Learning where to look generative NAS is surprisingly efficient. Computer Vision ECCV 2022 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XXIII, volume 13683 of Lecture Notes in Computer Science, pp. 257-273. Springer, 2022.
Jisoo Mok, Byunggook Na. Hyeokjun Choe, and Sungroh Yoon. Advrush: Searching for adversarially robust neural architectures. In ICCV, 2021.
11

---

Published as a conference paper at ICLR 2023
Tianyu Pang. Xiao Yang. Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In 9th International Conference on Learning Representations. ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
http://wwwwee..teoeeeeeeeeeee formmo
id=XbBxvrtBBce
Hieu Pham, Melody Y. Guan, Barret Zoph, Quoe V. Le, and Jeff Dean. Efficient neural architecture search via parameter sharing. In ICML. 2018.
Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: python toolbox to benchmark the robustness of machine learning models. In Reliable Machine Learning in the Wild Workshop. 34th International Conference on Machine Learning, 2017. URRhhtt////axxii org/ abs/
1707. 04131
Esteban Real, Sherry Moore, Andrew Selle, Saurabh Saxena, Yutaka Leon Suematsu, Jie Tan, Quoe V. Le, and Alexey Kurakin. Large-scale evolution image classifiers. In ICML, 2017.
Esteban Real, Alok Aggarwal, Yanping Huang, and Quoe V. Le. Regularized evolution for image classifier architecture search. In AAAI, 2019.
Seyed Saeed Changiz Rezaci, Fred X. Han, Di Niu, Mohammad Salameh, Keith G. Mills, Shuo Lian, Wei Lu, and Shangling Jui. Generative adversarial neural architecture search. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI 2021, Viruual Event Montreal, Canada, 19-27 August 1021, pp. 2227-2234 ijeai.org, 2021.
Binxin Ru, Xingchen Wan, Xiaowen Dong, and Michael Osbore.. Interpretable neural architecture search via bayesian optimisation with weisfeiler-lehmen kernels. ICLR, 2021.
Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Yu Chen, and Yupeng Gao. Is robustness the cost of accuracy?- comprehensive study on the robustness of 18 deep image classification models. In ECCV, 2018.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, 2014. Ittp::t:
org/ abs /112. 6199
Shiyu Tang, Ruihao Gong, Yan Wang, Aishan Liu, Jiakai Wang, Xinyun Chen, Fengwei Yu, Xi- anglong Liu, Dawn Xiaodong Song, Alan Loddon Yuille, Philip S. Torr, and Dacheng Tao. Robustart: Benchmarking robustness architecture design and training techniques. ArXiv, abs/2109.05221,, 2021.
Colin White, Willie Neiswanger, and Yash Savani. Bananas: Bayesian optimization with neural architectures for neural architecture search. In AAAI, 2021a.
Colin White, Sam Nolen, and Yash Savani. Exploring the loss landscape in neural architecture search. In UAI, 2021b.
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Loddon Yuille, and Kaiming He. Feature demoising for improving adversarial robustness. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 501-509, 2019a.
Cihang Xie, Mingxing Tan, Boqing Gong. Alan Loddon Yuille, and Quoc V. Le. Smooth adversarial training. ArXiv, abs/2006.14536 2020.
Sirui Xie, Hehui Zheng, Chunxiao Liu, and Liang Lin. SNAS: stochastic neural architecture search. In ICLR, 2019b.
Yuhui Xu, Lingxi Xie, Xiaopeng Zhang, Xin Chen, Guo-Jun Qi. Qi Tian, and Hongkai Xiong. PC-DARTS: partial channel connections for memory-efficient architecture search. In /CLR, 2020.
Chris Ying, Aaron Klein, Eric Christiansen, Esteban Real, Kevin Murphy, and Frank Hutter. Nas- bench-101. Towards reproducible neural architecture search. In ICML, 2019.
Arber Zela, Thomas Elsken, Tonmoy Saikia, Yassine Marakchi, Thomas Brox, and Frank Hutter. Understanding and robustifying differentiable architecture search. In ICI.R, 2020.
12

---

Published as a conference paper at ICLR 2023
Pu Zhao, Pin-Yo Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR, 2020.
Barret Zoph and Quoc V. Le. Neural architecture search with reinforcement learning, In ICLR, 2017.
13

---

Published as a conference paper at ICLR 2023
A DATASET
A. NAS-BENCH-201
cell- We base our evaluations on the NAS-Bench-201 (Dong & Yang 2020) search space. based architecture search space. Each cell has in total nodes and 6 edges. The nodes in this search space correspond the architecture's feature maps and the edges represent the architec- tures operation, which are chosen from the operation set O {1 x 1 conv. .3 x 3 conv. 3 x 3 avg. pooling skip zero] (see Figure 1). This search space contains in total 5 = 625 archi- tectures, from which only 466 unique, since the operations skip and zero cause isomorphic cells (see (see|Figura Figure 8), where the latter operation zero stands for dropping the edge. Each architecture is trained on three different image datasets for 200 epochs: CIFAR-1 10 (Krizhevsky 2009). CIFAR-100 (Krizhevsky] (2009) and ImageNet16- 6-120 (Chrabaszez et al.) 2017). J) For our evaluations, we consider all unique architectures in the search space and test splits of the corresponding datasets. Hence, evaluate 3 6 66466 19 398 pretrained networks in total.
2
2006
OU
Icl
Figure 8: Example of two isomorphic graphs in NAS-Bench-201. Due to the skip connection from node in node 1, both computational graphs are equivalent, but their identification in the search space is different. For this dataset, evaluated all non-isomorphic graphs (# (#991 was evaluated and #3365 was not).
A.2 DATASET GATHERING
We collect evaluations for our dataset for different corruptions and adversarial attacks (as discussed
in subsecctioon 3.2 and subsecctoon 3.3) following algorithm This process is also depicted in Figure 9
Hyperparameter settings for adversarial attacks listed in Table Due to the heavy load of running
all these evaluations, they are performed on several clusters. These clusters are comprised of either (i) compute nodes with Nvidia A 100 GPUs, 512 GB RAM, and Intel Xeon IceLake-SP processors, (ii) compute nodes with NVIDIA Quadro RTX 8000 GPUs, 1024 GB RAM, and AMD EPYC 7502P processors, (ii) NVIDIA Tesla A100 GPUs, 2048 GB RAM, Intel Xeon Platinum 8360Y processors, and (iv) NVIDIA Tesla A40 GPUs, 2048 GB RAM, Intel Xeon Platinum 8360Y processors.
Table 2:
Hyperparameter settings of adversarial attacks evaluated.
Attack
Hyperparameters
FGSM
E [-1, .5, 1, 2, 4, 2,,,,,,,,),, 2555/255
PGD
E [.1,.5. 1, 3, 2,,,,,,5)/2221 225) a = 0.01/0.3 40 attack iterations
APGD
{.1, .5., 1, 4, 255) 100 attack iterations
Square
E {.1, .5. 1, 2, 3, 4, 8, /255 000 search iterations
14

---

Published as a conference paper at ICLR 2023
Algorithm I: Robustness Dataset Gathering
Input: (i) Architecture space A (AAS-Bench-201)
Input: (ii) Test datasets D (CIFAR-IM) 10, CIFAR-100, ImageNer16- 621))..
Input: (iii) Set of attacks and/or corruptions C.
Input: (iv) Robustness Dataset R.
for a E do
b Load pretrained weights for a.load_weed weightts)))( for d E D do for c( do b Corrupt dataset d.
de + ( > Evaluate architecture a with de. Accuracy, Confidence, ConfusionMatrix &- eval(a, de)
D Extend robustness dataset with evaluations.
R[d]c]] ""accuracy"]aa" + Accuracy
Rid c "cconfidenc""la" [a]] < Confidence
R|d] ["cm"][a] <- ConfusionMatrix
end
11
end
12 end
NAS-Bench-201
CIFAR-10
Archiloctura (untrained)
CIFAR-100
Load Parameters
ImageNet16-122
Archilecture (trainad)
Dataset Comupptin
Common Corruptions
Corrupted Data
Atlacke
Adversarial Attacks
Evaluation
Accuracy
Confidence
Confusion Matrix
Robustness
Dataset
Figure 9: Diagram showing the gathering process for our robustness dataset. (i) An non-isomorphic architecture contained in NAS-Bench-200 is created and its parameters loaded from provided checkpoint, dependent on the dataset evaluated. (ii) Given the evaluation dataset, an attack or corruption, and the trained network, the evaluation dataset is corrupted and (ii) the resulting corrupted data is used to evaluate the network. (iv) The evaluation results are stored in our robustness dataset.
15

---

Published as a conference paper at ICLR 2023
A.3 DATASET STRUCTURE, DISTRIBUTION, AND LICENSE
Files are provided in json format to ensure plafforn-inddeeendence and to reduce the dependency on external libraries (e.g. Python has built-in json-support).
We will publish code that accompanies our dataset on GitHub. The dataset itself will be linked from GitHub and is hosted on an institutional cloud service. This ensures longtime availability and the possibility to version the dataset. Dataset and code will be published at the notification date under GNU GPLv3.
A.4 STRUCTURE
The dataset consists of 3 folders, one for each dataset evaluated (cifar10, cifar100, 1mageNet16-122 Each folder contains one json file for each combination of key and measure- ment. Keys refer to the sort of attack corruption used (Table lists all keys). Measurements refer to the collected evaluation type (acouracy, conf dence, cm). Clean and adversarial evaluations performed all datasets, while common corruptions evaluated on ci farl 0 and c farl 00. Additionally, the dataset contains one metadata file (meta. json).
Table 3:
Keys for attacks and conuuttion evaluated.
Clean clean
Adversarial
Common Corruptions
aa_apgd-ce aa_square
brightness
contrast
fgsm
defocus blur
pgd
clastic transform fog
frost
gaussian_ _oise
glass_blus
impulse_noise jpeg_ compression
motion blur pixelate shot_noise snow
zoom blur
The meta. json file contains information about each architecture in NAS-Bench-201. This includes, for each architecture identifier, the corresponding string defining the network design (as per (Dong & Yang 2020)) as well as the identifier of the corresponding non-isomorphic architecture from (Dong Yang 2020) that we evaluated. The file also contains all values that evaluated for each adversarial attack. An excerpt of this file is shown in Figure I0
Metadata
Files All files are named according to " "[key)) jsso"" Hence, the path to json". An excerpt of this file shown in Figure 11 Each file contains nested dictionaries stating the dataset, evaluation key and measurement type. For evaluations with multiple measurements, e.g. in the case of adversarial attacks for multiple e values, the results are concatenated into a list. Files and their possible contents described in Table 4]
all clean accuracies ci farl is //ciffaall/eelaaacccrraaaaa
16

---

Published as a conference paper at ICLR 2023
"ids":
121":
"ab201-string""
"Isomorph" " '21"
1.
11832":
ab201 sstring". ": "laor_conv_ix] -irri-iirrrreee__taa -l -wwlaor__covy_lllttto -osppp -laenee--,
"isomorph 1309"
eppaions":
aa apgd-ee": [0.1,
8.01
aquare"""" 10.1.
1.0
2.0.
3.0.
8.01
"fgsm" 10.1, 0.5, 1.0.
2.0
3.0.
4.0.
5.0. 6.0.
7.0.
8.0. 255.01,
ped": [0.1, 0.5, 1.0, 2.0.
3.0.
4.0, 8.0]
Figure 10: Excerpt of meta json showing meta information architectures #21 and #1 #1832, well as values for each attack. Architecture #21 is non-isomorphic and points to itself, while architecture #18 32 an isomorphic instance of #309.
eifarl0" clean aacuurayy"
eifarl1"
"pdd"
necurney"
"0": 0.856,
"0": [0.812, 0.582, 0.295, 0.034, 0.002, 0.0, 0.0].
Figure 11: Excerpt (left) clean _acurraccccccccccc json and (right) pgd_ accuracy. ison for dataset cifarl0 for the architecture #0. Numbers are rounded to improve readability.
Table 4: Files and their possible content.
File
Description
clean_ dlannaccuracy clean_confidence
accuracy value for each evaluated network one confidence matrix for each evaluated network and collection scheme
clean_cm
one confusion matrix for each evaluated network
[attack]_accurac
list of accuracies, where each element corresponds the respective value
|attack]_confidence
list of confidence matrices, where each element corresponds to the respective e value list of confusion matrices, where each element responds to the respective c value
[attack)_em
Laccurrc [corruption accuracy
list of accuracies, where each element corresponds to the respective corruption severity list of confidence matrices, where each element corresponds to the respective corruption severity list of confusion matrices, where each element cor- responds to the respective corruption severity
[corruption)_come -ooffidececcfeeeeeeeeeeeeeeeeeee
[corruption]
We showed some analysis and possible use-cases on accuracies in the main paper. In the following, elaborate and show conf dencce and confusion matrix (cm) measurements.
17

---

Published as a conference paper at ICLR 2023
A.5 CONFIDENCE
We collect the mean confidence after softmax for each network over the whole (attacked) test dataset evaluated. We used schemes collect confidences (see Figure 13). First, confidences for each class are given by true labels (called label). 1). In case of cifarl O, this results in 10 10 confidence matrix, for eifar100 100 100 confidence matrix, and ImageNet 6-120 a 120 X 120 confidence matrix. Second, confidences for each class are given by the class predicted by the network (called a argmax). This again results in matrices of sizes as mentioned. Third, confidences for correctly classified images as well as confidences for incorrectly classified images (called predict io). For image datasets, this results a vector with dimensions. Each result saved as list (or list of list), see Figure 12
Figure 14 shows a progression of label confidence values for class label on ci farl0 from clean to fgam with increasing values of e. Figure shows how prediction ion confidences of correctly and incorrectly classified images correlate with increasing values of e when attacked with fgsm.
"eifarl0";
clean ":
confidenne":
00":
"label"; II...II.
argmax': [I..II.
prediction" " [c.]
Excerpt of cleenn_oofiieeeeeeeeoceoeec json for cifar10. Numbers shown improve readability.
Figure 12:
18

---

Published as a conference paper at ICLR 2023
True Class
0.89
0.01
0.02
0.01
0.01
0.00
0.01
0.01
0.03
0.01
0.8
0.03
0.00
0.84
0.03
0.02
0.00
0.02
0.01
0.00
0.00
0.01
0.00
0.00
0.77
0.03
0.09
0.03
0.02
0.00
0.00
Prodicted
0.00
0.00
0.00
0.10
0.02
0.88
0.01
0.03
0.00
0.00
0.00
0.00
0.00
0.03
0.02
0.00
0.91
0.00
0.00
0.00
0.03
0.01
0.000
0.01
0.00
0.00
0.00
0.00
0.93
0.01
Argmax
0.00
0.97
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.01
0.02
0.00
0.93
0.02
0.01
0.02
0.01
0.00
0.00
0.00
0.00
0.00
0.01
0.01
0.94
0.00
0.01
0.01
0.00
0.00
Prodicted
0.00
0.00
0.02
0.04
0.01
0.93
0.00
0.02
0.00
0.00
0.00
0.00
0.00
0.01
0.01
0.01
0.00
0.96
0.00
0.00
0.00
0.00
Classification Result
Corrent
Incorrect
0.97
0.79
0.4
0.2
0.0
Figure 13: Mean confidence scores on clean CIFAR-10 images for all non-isomorphic networks in NAS-Bench-201. (top: label) For each true class label. (middle: argmax) For each predicted class label. (bottom: prediction For correct and incorrect classifications.
19

---

Published as a conference paper at ICLR 2023
Class Label O: Confidence Progression
0.1
0.5
1
2
3
Epsilon
4
5
8
255
0
1
2
5
6
7
8
9
Class
Figure 14: Mean label confidence scores on FGSM-attacked CIFAR-10 images for different for all non-isomorphic networks in NAS-Bench-201. Only confidence scores for class label ( are shown. Networks lose prediction confidence for the true label when increases.
20

---

Published as a conference paper at ICLR 2023
0.90
Incorrect Classification Confidence
0.88
0.5
0.86
0.84
255
0.82
0.80
0.84
0.86
0.88
0.90
0.92
0.94
0.96
Correct Classification Confidence
Mean prediction confidence scores on FGSM-attacked CIFAR-10 images for different (on top of points) for all non-isomorphic networks in NAS-Bench-201. Networks become less confident their prediction if their prediction correct when increases. Networks become more confident in their prediction if their prediction is incorrect, however, only up to certain value. When further increases, confidence drops again.
Figure 15:
A.6 CONFUSION MATRIX
For each evaluated network, collect the confusion matrix (key: cm) for the corresponding (attacked) test dataset. The result is 10 10 matrix in case of cifar10, a 100 x 100 matrix in of ci siffrlll 100, and 120 x 120 matrix in case of ImageNet 1 6-100. See/Figure 16 an example, where we summed up confusion matrices for all networks on e far10.
True Class
4
1e6
2e45
4e+4
4e+3
2e+4
6e+-
7e+3
9e+3
4e+3
Se44
2e+5
2-
le+5
6e+3
6e+6
2e+5
le+5
le+5
le45
6e44
3e44
les4
3
6e44
le+4
2e45
Se+6
1e+5
5et5
2e45
le45
3e44
2e+4
9e+3
6e+5
7e*3
5e+3
2e+4
9c+-3
Ze+5
2e+5
1e+5
Set4
66+6
10+4
16+4
1ce4
2
7-
3e+4
7e+3
Set4
9et4
1e+5
1e+5
20+4
6e+6
8e+3
1ee4
8-
2e45
4e44
4644
1e44
1844
7044
60.4
Figure 16: Aggregated confusion matrices on clean CIFAR-1O images for all non-isomorphic networks in NAS-Bench-20
21

---

Published as a conference paper at ICLR 2023
A.7 CORRELATIONS BETWEEN IMAGE DATASETS
In Figure 17 we show the correlation between all clean and adversarial accuracies over all datasets collected. This plot shows positive correlation between the image datasets for the one-step FGSM attack, whereas for all other multi-step attacks, the correlation becomes close to zero or even negative.
-075
Trapmn
Figure 17: Kendall rank correlation coefficient between all clean and adversarial accuracies that are evaluated in our dataset.
22

---

Published as a conference paper at ICLR 2023
A.8 EXAMPLE IMAGE OF CORRUPTIONS CIFAR-10-C
elastic transform
jpeg. wompprssiiooonnn
gaussian noose
impulse _oonolsse
defocus blur
mation blur
shot noise
glass blur
zoom blur
brightness
contrast
pixelate
snow
frost
fog
2
Severity
3
5
An example image of CIFAR-10-C (Hendryeks & Dietterich 2019) with different corruption types at different severity levels. CIFAR- 100-C (Hendrycks & Dietterich, 2019) consists of images with the corruption types and severity levels.
Figure 18:
A.9 MAIN PAPER FIGURES FOR OTHER IMAGE DATASETS
A.9.1 CIFAR-100 ADVERSARIAL ATTACK ACCURACIES
FIGURE 2b
cifar100 FGSM accuracies
cifar100 PGD accuracies
0.6
0.6
0.4
0.4
0.1
0.1
0.1 0.5
255
0.1
0.5
epsiloo
epsilon
cifar100 APGD-CE accuracies
cifar100 SQUARE accuracies
0.7
0.5
0.5
0.4
0.3
0.3
0.2
0.0
0.0
0.2
epoilon
Figure 19: Accuracy boxplots over all unique architectures in sarial attacks (FGSM (Goodfellow et al. 2015), PGD (Kurakin et al.) 2017). APGD (Croce & Hein 2020), Square (Andriushchenko et al. 2020)) and perturbation magnitude values c, evaluated on CIFAR- 100. Red line corresponds to guessing.
for different adver-
23

---

Published as a conference paper at ICLR 2023
A.9.2
IMAGENETI6-122 ADVERSARIAL ATTACK ACCURACIES
FIGUUE
ImageNet16- 6-12 FGSM accuracies
ImageNet16-122 PGD accuracies
0.4
0.3
0.3
accuracy
accuracy
0.2
0.2
0.1
0.1
8
0.0
epsiion
epsilon
ImageNet16-120 AA_APGD-CE accuracies
ImageNet16-122 AA_SQUARE accuracies
0.4
0.4
accurac
accuracy
0.3
0.2
0.2
0.0
0.0
0.1
0.5
1
2
opsilon
epsilon
Figure 20: Accuracy boxplots over all unique architectures in MAS-Bench-200 for different adver- sarial attacks (FGSM (Goodfellow et al.) (2155), PGD (Kurakin et al. 2017). APGD (Croce & Hein 2020), Square (Andriushchenko et al.] 2020)) and perturbation magnitude values evaluated ImageNet16-120. Red line corresponds to guessing.
24

---

Published as a conference paper at ICLR 2023
A.9.3 CIFAR- 10-C COMMON CORRUPTION ACCURACIES (IIUURE
Far10 bighinss scurray
dfar0 contrust scorscy
cfact defocu. Her acarsey
clari0 custi barsfor accrrey.
48
02
dfart0
chrr00 frot
diar16
dtar10 glass
0.4
3.4
0.2
02-
S1ar10 Impuss EcCurBSy
ctar10 jag compremioon acoracy
mation blat accuracy
plesien accurayy
serofo
Sewerty
Severty
dtr13 noke acousey
cFo snow sccuracy
cPa zoom blar accuracy
Figure 21: Accuracy boxplots over all unique architectures in BAS-Bench-2201 for different corruption types at different severity levels, evaluated on CIFAR-10-C. Red line corresponds to guessing.
25

---

Published as a conference paper at ICLR 2023
A.9.4 CIFAR-100 100-C COMMON CORRUPTION ACCURACIES (FIGURE 4
<for102 Hightess accuracy
dRar100 Contrust aCCoPaCy
dRar100 delocss blur accurscy
<far100 dieste transfmm accursy
cot/100
citr3002
Ofe
cfarrt
32
31
cta:000 mouss relen accuuaTy
pag compresioon acCuraCy
char300 accuracy
prantate acCurwOy
serofo
Ieeerty
leverty
cfu/100 shot.ress 2comacy
do 100 snow accuracy
da/100 zomm biu accuracy
Figure 22: Accuracy boxplots over unique architectures in NAS-Bench-201 for different corrup- tion types at different severity levels, evaluated on CIFAR-100-C. Red line corresponds to guessing.
26

---

Published as a conference paper at ICLR 2023
A.9.5 CIFAR-100 ADVERSARIAL ATTACK CORRELATIONS
(FIGURE 3
aa 20g0 e 05
aa ae33pp de DE
aa pooddce 9 cs e=8
e-0.
aa square e-0.5
aa squssn e=1
aa square e-3 aa square e-d
aa e=8
dean e
Igsi ==0.
Agn e-0.
Ig esl
1gsm e=2
195m a-t
f e-5
1gsm. e-5
fgsmu e=7
fgsm. e=255
pgd e-0.1
pgd. c=1
pgd c=2
pgd. e=4
aa 0000000
aa apes
aa 30 ce.
aa square,
aa apea
1gam.
pgd
pgd.
clean, 6-0
e-0.1
fgsm,
fgsm, e-1
fgsm, 2
0.75
Igam,
fgsm, e=
fgsm, ==
fgsm, e
0.50
fgsm, ==
fgsm,
fgsm, e-255
pgd. e-0.1
0.25
pgd,
pgd. e=1
agd. e-3
0.00
pgd, e=4
aa ce, c=0.1
ap_aapddceeeee em0.5
aa re, an, apgd-ce, e-2
e=3
aa apgd-ce, e-4
-0.50
ce, e
square,
aB aa_square, 6=5.
e=1 aa_square,
-0.75
aa_square, e-3
an sq_square,
-1.00
Figure 23: Kendall rank correlation coefficient between clean accuracies and robust accuracies on dif- ferent attacks and magnitude values e on CIFAR-100 for unique architectures NAS-Bench-201.
27

---

Published as a conference paper at ICLR 2023
A.9.6 IMAGENETI6-120 ADVERSARIAL ATTACK CORRELATIONS
FIGURE
aa 20g0 e 05
aa a cs e=8
e-0.1
aa square e-0.5
e=1
aa square aa squara e-3 aa square e-d
aa square, e=8
dean e
fgsm ==0.1
igan e-0.5
Ig ==l
1gsm e=2
195m e-t
f e-5
1gsm. e-6
fgsmu e=7
fgsm. e=255
pgd e-0.1
pgd. c=1
pgd c=2
pgd. e=4
aa apo0
aa apop
aa a033p de
aa apea
aa 20 ce.
aa squasn
1gam.
pgd
.gd.
clean, 6-0
fgsm, e-0.1
fgsm,
fgsm, e=1
fgsm, 2
0.75
Igam,
fgsm, e=
fgsm, 5=
fgsm, e
0.50
fgsm, ==
fgsm,
fgsm, e-255
pgd. e-0.1
0.25
pgd,
pgd. e=1
agd. e-3
0.00
pgd, e=4
aa ce, c=0.1
ap_aapddceeeee em0.5
aa re, an, apgd-ce, e=2
e=3
aa apgd-ce, e-4
-0.50
ce, e
square,
aB aa_square, 0.5.
e=1 aa_square,
-0.55
aa_square, e-3
an squaee
-1.00
Figure 24: Kendall rank correlation coefficient between clean accuracies and robust accuracies on different attacks and magnitude values on ImageNet16-120 for all unique architectures in NAS- HAS-Bench-201.
28

---

Published as a conference paper at ICLR 2023
A.9.7 CIFAR- 100-C COMMON CORRUPTION CORRELATIONS (FIGURE
defocus blur, elastic transform. s=3
jpeg compression, 5=3
gaussian, raise, s=3
impuise, s=3
brightness 5-3
glass blur s=3
motion, blut, 5-3
shot noise, s=3
snow, z0om, sbr, s-3
contract, s=3
pixelate, 5
frost s=3
clean
Tog,
1.00
clean
brightness,
0.75
contrast, 5m3
defocus, blur,
pastic_transfomm, s=3
0.50
5=3
frost, s=3
gaussian noise, 5-3
glass blur, s=3
Impulse noise, 5-3
0.25
jpeg_ compression, 5=3
motion blurr s=3
-0.50
pixelate,
shot_noise, 5-3
0.75
zoam_blu blur, s=3
-1.00
Figure 25:
Kendall rank correlation coefficient between clean accuracies and accuracies different corruptions at severity level on CIFAR-100-C for all unique architectures in NAS-Bench-201.
29

---

Published as a conference paper at ICLR 2023
B ANALYSIS
In this section, we first depict the best architectures in NAS-Bench-20) (Dong & Yang 2020 in subsection B.I then show the effect of parameter count on robustness and the magnitude of potential gains in robustness in limited parameter count setting in subsection B.2] and lastly show the effect of single changes to the best performing architecture according clean accuracy in subsection B.3
B.1 BEST ARCHITECTURES
visualizes the best architectures in the NAS-Bench-201 (Dong & Yang 2020) search space in terms of clean accuracy, mean adversarial accuracy, and mean common corruption accuracy on CIFAR-10 and their respective edit distances. The edit distance is defined by the number of changes, either node or edge, to change the graph to the target graph. In the case of NAS-Bencht architectures, an edit distance of means that exactly one operation differs between two architectures. So in order to modify the best performing architecture in terms of clean accuracy (# 13714) into the best performing architecture according to mean corruption accuracy (#3456), we need to exchange two (out of six) operations: (i) exchange operation from 3 x 3 convolution to zcro and (ii) exchange operation 5 from convolution to 3 x convolution.
Figure 26
dstance 2
1.1374
616118
B 3,556
3x3
3x3
3x3
distance
Figure 26: Best architectures in adversarial accuracy (over all attacks and values described in subsection 3.2p, and (right) mean common corruption accuracy (over all corruptions and severities) on CIFAR- 10. See Figure for cell connectivity and operations.
according to (left) clean accuracy, (middle) mean
0.45
0.60
Meen Aoversaral Rosutrees
Corapioon Rolsssteess
0.35
pnfammttors
0.35
0.25
0.30
0.20
0.25
0.5
0.6
0.7
0.8
0.9
0.5
0.6
0.7
0.8
0.9
Clean
Cleam
Figure 27: (left) Mean adversarial robustness accuracies and (right) mean corruption robustness accuracies vs. clean accuracies on CIFAR-10 for all unique architectures in NAS-Bench-201. Scatter points are colored based on the number of kernel parameters of single cell (1 for each 1 x 1 convolution, 9 for each
convolution).
B.2 CELL KERNEL PARAMETER COUNT
Figure 27 displays the mean adversarial robustness accuracies (left) and the mean corruption bustness accuracies (right) against the clean accuracy, color-coded by the number of cell kernel parameters. We count for each convolution and for each 3 3 convolution contained in
30

---

Published as a conference paper at ICLR 2023
the cell, hence, their number ranges in [4]. Since these multipliers for the parameter count of the whole network, we coin these cell kernel parameters. Overall, we can see that the cell kernel parameter count matters in terms of robustness, hence, that networks with large parameter counts more robust in general. We can also see that the number of cell kernel parameters are more essential for robustness against common corruptions, where the correlation between clean and corruption accuracy is more linear. Also in terms of adversarial robustness, there seems to be large magnitude of possible improvements that can be gained by optimizing architecture design.
Limited Cell Parameter Count To further investigate the magnitude of possible improvements via architectural design optimization, we look into the scenario of limited cell parameter count.
0.40
Moan Adversania Accuracy
0.35
0.15
0.10
Parameters
Figure 28: Mean robust accuracy over all attacks as described in subsection 3.2 on CIFAR-10 by kernel parameters E [0, 54] for all unique architectures in NAS-Bench-201. Orange scatter points depict all architectures with kernel parameter count 18, hence, architectures with exactly times 3 x convolutions. Although having exactly the same parameter count, the mean adversarial robustness of these networks ranges in [0.21,0. 0.40].
In Figure 28
we depict all unique architectures NAS-Bench-201 by their mean adversarial robustness and cell kernel parameter count. Networks with parameter count 18 (408 instances in total) are highlighted in orange. As we can see, there is large range of mean adversarial accuracies [0.21, 0.4] for the parameter count 18 showing the potential of doubling the robustness of network with the same parameter count by carefully crafting its topology. In Figure 29 we show the top- 20 performing architectures (color-coded, one operation for each edge) in the mentioned scenario of a parameter count of 18, according to (top) mean adversarial and (bottom) mean corruption accuracy. is interesting to see that in both cases, there are (almost) no convolutions on edges 2 and and additionally dropping or skipping of edge 1. In the case of edge 4, it seems that a single convolution layer connecting input and output of the cell increases sensitivity of the network. Hence, most of the top-20 robust architectures stack convolutions (via edge followed by either edge 3 or 5), from which we hypothesize that stacking convolutions operations might improve robustness when designing architectures. At the same time, skipping input to output via edge 4 seems not affect robustness negatively, as long as the input feature map is combined with stacked convolutions. Important note here is that this is first observation, which be made by using our provided dataset. This observation functions as a motivation for how this dataset can be used to analyze robustness in combination with architecture design.
31

---

Published as a conference paper at ICLR 2023
0.400
#11693
#6187
#2947
#6555
#16
0.390
#14272
#11226
#:58
#12295
0.385
#1912
#9587
#4911
#325
0.380
#11286
zarob
Skip
conv. 3x3
avg
skip
conv 1xl
conv 3x3
avg
zerolze
skip
conv. 3x3
avg
zeroize
skip
conv 1xl
3x3
avg
zeroice oz
skip
conv. 3x3
avg
zeroize
skip
conv 1xt
3x5
avg
conv
conv
Operation
#12295
#11226
0.560
112617
#258
#1617
0.555
#2528
#42
Meal Comupption
#6678
à #6483
0.550
#14416
#5334
0.545
#9772
#10399
0000
#546
0.540
#4128
#15365
5kip
conv. 3x.3
avg
skip
conv 1x1
conv 3033
awg
zeroize
5líp
conv. 3x3
zeroizz
skip
conv 1x1
303
avg
zero
skíp
conv. 3x3
avg
zeroize
skip
conV 1x1
avg
conv
conv.
conv
Operation
Figure 29: Top-20 architectures with cell kernel parameter count 18 (hence, architectures with
exactly 2 times 3 x convolutions) according to (top) mean adversarial accuracy and (bottom) mean corruption accuracy on CIFAR-10. See Figure for cell connectivity and operations (1-6).
32

---

Published as a conference paper at ICLR 2023
B.3 GAINS AND LOSSES BY SINGLE CHANGES
The fact that our dataset contains evaluations for all unique architectures in NAS-Bench-201 enables analyze the effect of small architectural changes. In Figure 30) we depict again all unique architectures by their clean and robust accuracies on CIFAR-TO C 2009). The red data point both plots shows the best performing architecture in terms of clean accuracy (# (#1714 see Figure 26), while the orange points are its neighboring architectures with edit distance 1. The operation changed for each point is shown in the legend. As we can see in the case of adversarial attacks, we can trade-off more robust accuracy for less clean accuracy by changing only one operation. While some changes seem obvious (adding more parameters as with 13 and 14), interesting to that exchanging the 3 X 3 convolution on edge 3 with average pooling (and hence, reducing the amount of parameters) also improves adversarial robustness. In terms robustness towards common comuptiins, each architectural change leads to worse clean and robust accuracy in this case. Changing more than one operation is necessary to improve common corruption accuracy this network (as we have seen in Figure 26
360-3
0.45
0.42
51 FOL.O0 rec.eny bi-6
20
pereec-
0.40
rere-)
Mean Advervatel
0.35
10
91 [1] only Sxde rec_ee,,
18
343-) -300-
0.30
36
mw0.0-00000-- sw.ove Jah-5
0.36
2r1-3
20 sar_0me 201-1
sane-3
0.20
0.34
na.
301-2
343-2
0.15
24
26.
(0) kx www. 1ehr -aannny
0.935
Cleen
3: ect 3x33 rec 1d
20
3x5- rere-)
0.5
0.50
8100 FOL.0m
rece-)
Kein Commutite
0.45
33
0.40
0.55
79
72
0.54
36
24
18
19 xx. ww..m 161-1 -230goo 3va-)
0.25
3e3-2
6.20
25 2e3.3..333111 2og.t.t nggooo33d12
0.935
Figure 30: (top) Scatter plot clean accuracy mean adversarial accuracy (over all attacks and values as described in subsection 3.2) on CIFAR-10. (bottom) Scatter plot clean accuracy vs. mean common corruption accuracy (over all corruptions and severities) on CIFAR-10 10. The red data point shows the best performing architecture according to clean accuracy on CIFAR-10. The orange data points are neighboring architectures, where exactly one operation differs. The change of operation is depicted in the legend. The number in brackets refers to the edge where the operation was changed. See Figure for cell connectivity and operations (1-6).
33


Reviews:
[{"review_id": "vct0nQ7nZDw", "reviewer": "Reviewer_HhBB", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work extends the NAS-Bench-201 dataset to evaluate the neural architecture design and robustness. Moreover, an analysis of how the architectural design affects robustness is conducted.", "summary_of_the_review": "A borderline paper with few technical novel contents but solid evaluation and results.", "strength_and_weaknesses": "Strengths:\n1. The tackled problem is relevant to the ICLR community.\n2. Several experiments have been conducted, and comprehensive results are provided. \n\nWeaknesses:\n1. From the technical perspective, no new concepts have been introduced.\n2. It would be useful to describe the main methodology through algorithms and schemes.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "a8GBQ0-5FU", "reviewer": "Reviewer_VzZD", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper evaluates NASBench-201 (NAS benchmark) on four adversarial attacks. First, they show that the architecture influences the robustness of the model, then they evaluate all of the NAS search space for various adversarial models. They show how this database can be used for various purposes, including training-free estimates of robustness and robustness-aware neural architecture search. \n", "summary_of_the_review": "Well-motivated problem and a nice empirical analyses of an existing benchmark for a new set of metrics. This can be useful in furthering our understanding of network architecture design and robustness.", "strength_and_weaknesses": "-= S1 =- The paper extends the NAS benchmark by adding the important dimension of robustness to it. This empirical study is well-motivated, the experiments are presented in a nice and descriptive manner, and this dataset can help other researchers and designers to design more robust models. \n\n-= S2 =- The paper is very well-written and provide a nice background on various adversarial attacks that can be leveled against a model. Additionally, the results are presented in an easy to understand manner. \n\n-= S3 =- The three use cases presented for this dataset are also well-motivated and evaluated. \n\n-= S4 =- Toward the end of the paper, the authors provide a set of empirical analyses on what aspects of the network are highly influential on robustness. These observations can help future researchers and designers of network. \n\n-= W1 =- The paper can benefit from providing more descriptive captions to the figures. It will be nice if the figures can be read in a standalone manner i.e., they explain what the results are. \n\n-= W2 =- The paper can benefit from discussing the results a little bit more. For instance, it is not clear what we observe in Figure 5 leads to high diversity of sensitivity to different kinds of corruptions. \n\n-= W3 =- The paper can benefit from explaining the experimental setup more explicitly, how many times do they repeat their experiments? What machines do they use? What are the hyperparmeters? etc. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "SzeEY1pb2X", "reviewer": "Reviewer_WniR", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "* This paper evaluates the adversarial robustness of 6466 non-isomorphic network designs from NAS-Bench-201. \n* This paper benchmarks robustness measurements based on Jacobian and Hessian matrices for their robustness predictability.\n* Neural architecture search on robust accuracies is performed to find the relationship between architecture and robustness under the same model size. ", "summary_of_the_review": "The conclusions reached by this paper are not well supported by quantitative results. Please correct me if I missed anything. ", "strength_and_weaknesses": "### Strength \n\n* This paper presents a large-scale and systematic study of the relationship between robustness and architecture. \n* The predictability of Jacobian and Hessian matrices is an important question. The results of this paper show their usefulness and limitation.\n\n### Weaknesses\n\n* The authors mentioned that \"carefully crafting the topology of a network can have a substantial impact on its robustness, where networks with the same parameter count range in mean adversarial robust accuracy from 0.20% − 0.41%.\" I am not sure whether we can treat 0.2% - 0.41% adversarial accuracy as significant. In addition, what if we use a substantially different architect (but the same number of parameters) like Transformer?  ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster