GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models
Authors: ZAITANG LI
Pin-Yu Chen
Tsung-Yi Ho
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Robustness
Primary area: safety_in_machine_learning

Abstract: Current studies on adversarial robustness mainly focus on aggregating \textit{local} robustness results from a set of data samples to evaluate and rank different models. However, the local statistics may not well represent the true \textit{global} robustness of the underlying unknown data distribution. To address this challenge, this paper makes the first attempt to present a new framework, called \textit{GREAT Score}, for global robustness evaluation of adversarial perturbation using generative models. Formally, GREAT Score carries the physical meaning of a global statistic capturing a mean certified attack-proof perturbation level over all samples drawn from a generative model. For finite-sample evaluation, we also derive a probabilistic guarantee on the sample complexity and the difference between the sample mean and the true mean. GREAT Score has several advantages: (1) Robustness evaluations using GREAT Score are efficient and scalable to large models, by sparing the need of running adversarial attacks. In particular, we show high correlation and significantly reduced computation cost of GREAT Score when compared to the attack-based model ranking on RobustBench \cite{croce2021robustbench}. (2) The use of generative models facilitates the approximation of the unknown data distribution. In our ablation study with different generative adversarial networks (GANs), we observe consistency between global robustness evaluation and the quality of GANs. (3) GREAT Score can be used for remote auditing of privacy-sensitive black-box models, as demonstrated by our robustness evaluation on several online facial recognition services.

GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models
ZAITANG LI
Pin-Yu Yu Chen
The Chinese University of Hong Kong Sha Tin, Hong Kong
IBM Research New York, USA
ztli@cse. fefesse.cck... cuhk edu.hk hk
pin binnya. chen 1mm com
Tsung- Yi Ho
The Chinese University of Hong Kong
Sha Tin, Hong Kong
tyholcse.c www..uckkceeoo....
Abstract
Current studies adversarial robustness mainly focus on aggregating local ro- bustness results from a set data samples to evaluate and rank different models. However, the local statistics may not well represent the true global robustness of the underlying unknown data distribution. To address this challenge, this paper makes the first attempt to present new framework, called GREAT Score, for global ro- bustness evaluation of adversarial perturbation using generative models. Formally, GREAT Score carries the physical meaning of global statistic capturing certified attack-proof perturbation level over all samples drawn from a generative model. For finite-sample evaluation, also derive probabilistic guarantee the sample complexity and the difference between the sample mean and the true mean. GREAT Score has several advantages: (1) Robustness evaluations using GREAT Score are efficient and scalable to large models, by sparing the need of run- ning adversarial attacks. In particular, we show high correlation and significantly reduced computation cost of GREAT Score when compared to the uttack-basee model ranking on RobustBench [12]. (2) The use of generative models facilitates the approximation of the unknown data distribution. In our ablation study with different generative adversarial networks (GANs), we observe consistency between global robustness evaluation and the quality of GANs. (3) GREAT Score can be used for remote auditing of privacy-sense sensitive black-box models, as demonstrated by our robustness evaluation on several online facial recognition services.
Project Demo and Code Page:
Score
Introduction
Adversarial robustness the study of model performance in the worst-case scenario, which is key element in trustworthy machine learning. Adversarial robustness evaluation refers to the process of assessing a model's resilience against adversarial attacks, which are inputs intentionally designed to deceive the model. Without further remediation, state-of-the-an machine learning models, especially neural networks, are known be overly sensitive to small human- -mmerreippree perturbations to data
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

inputs [19]. Such property of over-sensitivity could be exploited by bad actors to craft adversarial perturbations leading to peediction-evasivy adversarial examples.
Given a threat model specifying the knowledge of the target machine learning model (e.g., white-box or black-box model access) and the setting of plausible adversarial interventions (e.g., norm-bounded input perturbations), the methodology for adversarial robustness evaluation can be divided into two categories: attack-deenddent and indeeedenndeeneeen. Attack-dependen approaches aim to devise the strongest possible attack and use it for performance assessment. A typical example is Auto-Attack [10], a state-of-the-an attack based on an ensemble of advanced white-box and black-box adversarial perturbation methods. On the other hand, attack- indeeenendn approaches aim to develop a certified or estimated score for adversarial robustness, reflecting quantifiable level of attack -rooff certificate. Typical examples include neural network verification techniques [60, 66]. certified defenses such as randomized smoothing [9], and local Lipschitz constant estimation [59].
Despite a plethora of adversarial robustness evaluation methods, current studies primarily focus on aggregating local robustness results from a set of data samples. However, the sampling process of these test samples could be biased and unrepresentative of the true global robustness of the underlying data distribution, resulting in the risk of incorrect or biased robustness benchmarks. For instance, we find that when assessing the ranking of Imagenet models through Robustbench [11], using AutoAttack [10] with 10,000 randomly selected samples (the default choice) with 100 independent trials results in an unstable ranking coefficient of 0.907 when compared to that of the entire 50,000 test samples. This outcome affirms that AutoAttack's 's model ranking has notable variations with an undersampled or underrepresented test dataset.
An ideal situation is when the data distribution is transparent and can draw an unlimited number of samples from the true distribution for reliable robustness evaluation. But in reality, the data distribution is unknown and difficult characterize. In addition to lacking rigorous global robustness evaluation, many aatac--independent methods are limited to the white-box setting, requiring detailed knowledge about the target model (e.g., model parameters and architecture) such as input gradients and internal data representations for robustness evaluation. Moreover, of-te-of-the-art attack dependent and attack -ineeeddeenn methods often face the issue of scalability to large models and data volumes due to excessive complexity, such as the computational costs in iterative gradient computation and layer-wise interval bound propagation and relaxation [20, 31].
To address the aforementioned challenges including (i) lack of proper global adversarial robustness evaluation, (ii) limitation to white-box settings, and (iii) computational inefficiency, in this paper we present a novel attack-independent evaluation framework called GREAT Score, which is short for global robustness evaluation of adversarial perturbation using generative models. We tackle challenge (i) by using generative model such as a generative adversarial network (GAN) [17, 18] or a diffusion model [27] as a proxy of the true unknown data distribution. Formally, GREAT Score is defined as the mean of a certified lower bound on minimal ad adversarial perturbation over the data sampling distribution of generative model, which represents the global distribution-wee wise adversarial robustness with respect to the generative model in use. It entails global statistic capturing the mean certified tttack-proof perturbation level over all samples from a generative model. For Enite-sample evaluation, we also derive probabilistic guarantee quantifying the sample complexity and the difference between the sample mean and true mean.
For challenge (ii), our derivation of GREAT Score leads to a neat closed-form solution that only requires data forward-passing and accessing the model outputs, which applies to any black-box classifiers giving class prediction confidence scores as model output. Moreover, as a byproduct of using generative models, our adversarial robustness evaluation procedure is executed with only synthetically generated data instead of real data, which is particularly appealing to privacy-aware robustness assessment schemes, e.g., remote robustness evaluation or auditing by a third party with restricted access to data and model. We will present how GREAT Score can be used to assess the robustness of online black-box facial recognition models. Finally, for challenge (iii), GREAT Score is applicable to any off-the-self generative models so that we do not take the training cost of generative models into consideration. Furthermore, the computation of GREAT Score is lightweight because it scales linearly with the number of data samples used for evaluation, and each data sample only requires one forward pass through the model to obtain the final predictions.
We highlight our main contributions as follows:
2

---

We present GREAT Score as novel framework for deriving global statistic representative of the distribution-we robustness to adversarial perturbation, based on an off off-the-shelf generative model for approximating the data generation process.
Theoretically, we show that GREAT Score corresponds to a mean certified attack- prrccf level of C2-norm bounded input perturbation over the sampling distribution of generative model (Theorem 1). We further develop a formal probabilistic guarantee on the quality of using the sample mean as GREAT Score with finite number of samples from generative models (Theorem 2).
We evaluate the effectiveness of GREAT Score on all neural network models on RobustBench [11] (the largest adversarial robustness benchmark), with a total of 17 models CIFAR-10 and 5 models on ImageNet. We show that the model ranking of GREAT Score is highly aligned with that of the original ranking on RobustBench using Attack [10], while GREAT Score significantly reduces the computation time. Specifically, on CIFAR-10 10 the computation complexity can be reduced by up to 2,000 times. The results suggest that GREAT Score competitive and approach complementary to sttack-based robustness evaluations.
computationally-efiio.
As a demonstration of GREAT Score's 's capability for remote robustness evaluation of access- lecess-limited systems, we show how GREAT Score can audit several online black-box facial recognition APIs.
2 Background and Related Works
Adversarial Attack and Defense. Adversarial attacks aim to generate examples that evade classifier predictions in classification tasks. In principle, adversarial examples can be crafted by small perturbations to native data sample, where the level of perturbation is measured by different Cp norms [7, 8, 58]. The procedure of finding adversarial perturbation within a perturbation level is often formulated as a constrained optimization problem, which can be solved by algorithms such as projected gradient descent (PGD) [38]. The state-of-the-an adversarial attack is the Auto-Attack [10], which uses an ensemble of white-box and black-box attacks. There are many methods (defenses) to improve adversarial robustness. A popular approach is adversarial training [38], which generates adversarial perturbation during model training for improved robustness. One common evaluation metric for adversarial robustness is robust accuracy, which is defined as the accuracy of correct classification under adversarial attacks, evaluated on set of data samples. RobustBench [10] the largest-scale standardized benchmark that ranks the models using robust accuracy against Auto-Attack on test sets from image classification datasets such as CIFAR-10. In addition discussed works, several studies evaluate model robustness differently. [43] introduce adversarial sparsity, quantifying the difficulty of finding perturbations, providing insights beyond adversarial accuracy. [48] propose probabilistic robustness, balancing average and worst-case performance by enforcing robustness to most perturbations, better addressing trade-offs. [22] introduce the adversarial hypervolume metric, a comprehensive measure of robustness across varying perturbation intensities.
Generative Models. Statistically speaking, let X denote the observable variable and let Y denote the corresponding label, the learning objective for a generative model is to model the conditional probability distribution P(X Y). Among all the generative models, GANs have gained lot of attention in recent years due to their capability to generate realistic high-quality images [18]. The principle of training GANs is based on the formulation of two-player zero-sum min-max game to learn the high-diman digh-dimension data distribution. Eventually, these two players reach the Nash equilibrium that D is unable to further discriminate real data versus generated samples. This adversarial learning methodology aids in obtaining high-quality generative models. In practice, the generator G(-) takes random vector = (i.e., a latent code) as input, which is generated from zero-mean isotropic Gaussian distribution denoted as (O, 7), where / means an identity matrix. Conditional GANs refer to the conditional generator G given a class label Y. In addition to GAN, diffusion models (DMs) also gaining popularity. DMs consist of two stages: the forward diffusion process and the reverse diffusion process. In the forward process, the input data is gradually perturbed by Gaussian Noises and becomes an isotropic Gaussian distribution eventually. In the reverse process, DMs reverse the forward process and implement a sampling process from Gaussian noises to reconstruct the true samples by solving a stochastic differential equation. In our proposed framework, we use off -fe-lf (conditional) GANs and DMs (e.g., DDPM (27]) that are publicly available as our generative models.
Formal Local Robustness Guarantee and Estimation. Given data sample Jr, formal local robustness guarantee refers to a certified range on its perturbation level such that within which the top- I class prediction of a model will remain unchanged [26]. In Cp -o-norm (p 2 1) bounded perturbations
3

---

centered at 2, such a guarantee is often called a certified radius r such that any perturbation ó to within this radius (i.e.. ||ő pp I r) will have the same top-1 class prediction as z. Therefore, the model is said to be provably locally robust (i.e., attack-proof) to any perturbations within the certified radius r. By definition, the certified radius of x is also a lower bound on the minimal perturbation required to flip the model prediction.
Among all the related works on attack-independent local robustness evaluations, the CLEVER framework proposed in [59] is the closest to our study. The authors in [59] derived a closed-form of certified local radius involving the maximum local Lipschitz constant of the model output with respect to the data input around neighborhood of a data sample z. They then proposed to use extreme value theory estimate such constant and use it to obtain local robustness score. which is not a certified local radius. Our proposed GREAT Score has major differences from [59] in that our focus is on global robustness evaluation, and our GREAT Score is the mean of certified radius over the sampling distribution of a generative model. In addition, for every generated sample, our local estimate gives a certified radius.
Notations. All the main notations used in the paper are summarized in Appendix A.
3 GREAT Score: Methodology and Algorithms
3.1 True Global Robustness and Certified Estimate
Let f = [f...... fk] Fd + RK denote a fixed K K-way classifier with flattened data input of dimension d. (z. denote pair of data sample x and its corresponding groundtruth label E f....., K}. P denote the true data distribution which in practice is unknown, and Amia (x) denote the minimal perturbation of sample-label pair (z. y) ~ causing the change of the top-1 class prediction such that arg max (1..., f& (z + Ami((2)) o arg (
fa( Note that if the model f makes an incorrect prediction on I, i.c., y ş arg (a..,e fir (z), then we define Amin (1) = O. This means the model is originally subject to prediction evasion on x even without any perturbation. A higher min (I) means better local robustness of on
The following statement defines the true global robustness of a classifier f based on the probability density function p(-) of the underlying data distribution P.
Definition 1 (True global robustness w.r.t. P). The true global robustness of a classifier f with respect data distribution P is defined as:
{()) Ex- | Amin(x))) [ Amiu (z)p(x))
(1)
Unless the probability density function of P and every local minimal perturbation are known, the exact value of the true global robustness cannot be computed. An alternative is to estimate such a quantity. Extending Definition 1. let g(x) be a local robustness statistic. Then the corresponding global robustness estimate is defined as
i(f) EE-plg(Z)]
j ((x)p(x)dr
(2)
Furthermore, if one can prove that g(x) is a valid lower bound on Amin(a) (x) such that g(x) Amsn(x). Ya, then the estimate [(f) is said to be a certified lower bound on the true global robustness with respect to P, and larger î(f) will imply better true global robustness. In what follows, we will formally introduce our proposed GREAT Score and show that it is certified estimate of the lower bound on the true robustness with respect to the data- mata-generating distribution learned by generative model.
<
3.2 Using GMs to Evaluate Global Robustness
Recall that a generative model (GM) takes a random vector 2 ~ (O0 sampled from a zero isotropic Gaussian distribution as input generate a data sample G(z). In what follows, we present our first main theorem that establishes a certified lower bound (2()) on the true global robustness of classifier if measured by the data distribution given by G(.).

---

Without loss of generality, we assume that all data inputs are confined in the scaled data range [0., 1]", where d is the size of any flattened data input. The K-way classifier f [0, 1] + RR takes a data sample x as input and outputs K K--dimnnioonal vector f f() (z), ..... fx (3)] indicating the likelihood of its prediction on I over K classes, where the top-1 1 class prediction is defined as 9 arg (1..k( (x). We further denote as the groundtruth class of x. Therefore,
# then the classifier is said to make a wrong top-1 prediction. When considering the adversarial robustness on wrongly classified sample x, we define the minimal perturbation for altering model prediction as Amin (z) O. The intuition is that an attacker does not need to take any action to make the sample z evade the correct prediction by f. and therefore the required minimal adversarial perturbation level is 0 (i.e., zero robustness).
Given generated data sample G(z), we now formally define a local robustness score function as
9 (G(z)) V / max(ff(G(z)) - (2 ((2......)].ppp higle
max fx fx(()))) 0O
The scalar / is a constant associated with the sampling Gaussian distribution of G. which will be apparent in later analysis. We further offer several insights into understanding the phys- ical meaning of the considered local robustness score in (3): (i) The inner term fc(G(=)) maxke (1.....))..ftt fü (G())) represents the gap in the likelihood of model prediction between the correct class and the most likely class other than c. A positive and larger value of this gap reflects higher confidence of the correct prediction and thus better robustness. (ii) Following (i), a negative gap means the model is making an incorrect prediction, and thus the outer term [gap. 0} 0. which corresponds to zero robustness.
Next, we use the local robustness score g defined in (3) to formally state our theorem on establishing a certified lower bound on the true global robustness and the proof sketch.
Theorem 1 (certified global robustness estimate). Let [0, 1]d + [0, be a K-way clas- sifier and let fa(-)) be the predicted likelihood of class with e denoting the groundtruth class. Given a generator G such that it generates sample G(z) with 1). Define T - - (1.., fx (G(()))) 0}. Then the global robustness es- timate of f evaluated with Cn-norm bounded perturbations, defined as fi(s) = =E.-wioonn(o(((()) a certified lower bound of the true global robustness S2(f) with respect to G.
g (
The complete proof is given in Appendix C.
3.3 Probabilistic Guarantee on Sample Mean
As defined in Theorem 1, the global robustness estimate Ø(f)= Eg-W (og (G()) the mean of the local robustness score function introduced in (3) evaluated through generator G and its sampling distribution. In practice, one can use a finite number of samples [G(z.lv)) generated from a conditional generator G(- (B) to estimate l(f). where denotes a class label and it is also an input parameter to the conditional generator. The simplest estimator of ((() is the sample mean, defined as
1 Σ ((G(zl))))
is(
In what follows, we present our second main theorem to deliver probabilistic guarantee on the sample complexity to achieve difference between the sample mean (ss(f) and the true mean (())) Theorem (probabilistic guarantee on sample mean). Let f be a K K-way classifier with its outputs bounded by [0, 1|K and let e denote the natural base. For any c, > 0, the sample size Z 82e-1og(2/61 then with probability at least 1 1- 8, the sample mean (s( is e-close to the true mean ((f). That is, (f) - ②(f)s S.
The complete proof is given Appendix D. The proof is built on a concentration inequality in [40]. It is worth noting that the bounded output assumption of the classifier ʃ in Theorem 2 can be easily satisfied by applying normalization layer at the final model output, such as the softmax function or the clement- wise sigmoid function.
5

---

3,4 Algorithm and Computational Complexity
Algorithm 1 summarizes the procedure of computing GREAT Score using the sample mean estimator. It can be seen that the computation complexity of GREAT Score is linear in the number of generated samples Ng. and for each sample. the computation of the statistic g defined in (3) only requires drawing a sample from the generator G' and taking a forward pass to the classifier f to obtain the model predictions on each class. As a byproduct, GREAT Score applies to the setting when the classifier f is a black-box model, meaning only the model outputs are observable by an evaluator.
Algorithm 1: GREAT Score Computation
Input: K-way classifier f()), conditional generator G(+), local score function g(-) defined in (3), number of generated samples Ng
Output: GREAT Score (f)
for 1 Ns do
Randomly select a class label y E (1,2...., K}
Sample ~ (0, I) from Gaussian distribution and generate a sample G(2ly) with
class y/
Pass G(zly) into the model f and get the prediction for each class (f<(G(=ly)))
Record the statistic
g gl - max(()(G(Zlw)) - maxxe kuy Ju (G(=))))
end
ss(s) Compute the sample mean of (0)0
Ne
3.5 Calibrated GREAT Score
In cases when one has additional knowledge of adversarial examples on of images from a generative model, e.g., successful adversarial perturbations (an upper bound on the minimal perturbation of each sample) returned by any norm- comm-minimizztion adversarial attack method such as the CW attack [7], the CW attack employs two loss terms, classification loss and distance metric, to generate adversarial examples. See Appendix for details. We can further "calibrate" the GREAT Score with respect to the available perturbations. Moreover, since Theorem 1 informs some design choices on the model output layer, as long as the model output is a non-negative K -ddimensional vector f E [0, 1jK reflecting the prediction confidence over K classes, we will incorporate such flexibility in the calibration process.
) for evaluation, and each model (indexed by j) has set of known perturbations (o()) J common set of N image-label pairs {z,, y1 y from the same generative model. We further consider four different model output layer designs (that are attached to the model logits): (i) sigmoid( (Ti): sigmoid with temperature Ti, (ii) softmax(- (TT)): softmax with temperature T2. (iii) (oottmaa T2 1))T;): sigmoid with temperature after softmax, and (iv) softmax(Sigmoidd
Specifically,
calibration in the model ranking setup where there are M models {
= 1))T²): softmax
with temperature after sigmoid. Finally, let (fs(f()) } denote the GREAT Score computed based on {æ;, Vi H for each model. We calibrate GREAT Score by optimizing some rank statistics (e.g., the Spearman's 's rank correlation coefficient) over the temperature parameter by comparing the ranking consistency between (f(() j= and { In our experiments, we find that setting (iv) gives the best result and use it as the default setup for calibration, as detailed in Appendix F.
fe=1
Experimental Results
4.1 Experiment Setup
Datasets and Models. We conduct our experiment on several datasets including CIFAR-I0 [32], ImageNet-1K [13] and CelebA-HQ [29]/CelebA [36]. For neural network models, we use the available models on RobustBench [11] (see more details in the next paragraph), which includes 17/5 models CIFAR- 1IFAR-10/maache 10tmageNet, correspondingly. We also use several off-the-shelf GANs and

---

Perurtatinn
Figure| 1: Comparison of local GREAT Score and CW attack L2 perturbation on CIFAR-I0 with Rebuffi _ettra model [46]. The x-axis is the image id. The result shows the local GREAT
Figure 2: Cumulative robust accuracy (RA) with varying La perturbation level using 500 samples. Note that GREAT Score gives a certified RA for attack -rroff robustness, whereas auto-Attack an empirical robustness evaluation.
Score is indeed a lower bound of the perturbation level found by CW attack.
diffusion models (DMs) trained on CIFAR-10 and ImageNet for computing GREAT Score in ablation study (we defer the model details to later paragraphs).
Summary of Classifiers on RobustBench. The RobustBench [49] is to-date the largest benchmark for robustness evaluation with publicly accessible neural network models submitted by contributors. RobustBench uses the default test dataset from several standard image classification tasks, such as CIFAR-10 and ImageNet-IKe to run Auto-Attack [10] and report the resulting accuracy with C2-norm and -nom perturbations (i.e., the robust accuracy RAA) robustness. Even under one perturbation type, it is not easy to make a direct and fair comparison among all submitted models RobustBench because they often differ by the training scheme, network architecture, as well as the usage of additional real and/or synthetic data. To make a meaningful comparison with GREAT Score, select all non- non-trivial models (having non-zero RA) submitted to the CIFAR-10 and ImageNet- IK benchmarks and evaluated with L2-norm perturbation with fixed perturbation level of 0.5 using Auto-Attack. We list the model names in Table 1 and provide their descriptions in Appendix G.
metric for adversarial
GANs and DMs. We used off-the-shelf GAN models provided by StudioGAN [41], library containing released GAN models. StudioGAN also reports the Inception Score (IS) to rank the model quality. We use the GAN model with the highest IS value our default GAN for GREAT Score, which are StyleGAN2 [30/ BigGAN [6] for CIFAR-10 /ImageNet with IS = 10.477 00.47799.77 700. respectively. For the ablation study of using different generative models in GREAT Score (Section 4.4), we also use the following GAN/DM models: LSGAN [39], GGAN [35], SAGAN [65], SNGAN [42], DDPM [27] and StyleGAN2 [30].
GREAT Score implementation. sigmoid/softmax function on the logits of the CIFAR-100/maaer classifier to ensure the model output of each dimension is within [0, 1], as implied by Theorem 1. As ImageNet- IK has 1000 classes, applying sigmoid will make the robustness score function in (3) degenerate. We use softmax instead. 500 samples drawn from a generative model were used for computing GREAT Score.
The implementation follows Algorithm Appendix ?? with a
Comparative methods. We compare the effectiveness of GREAT Score in two objectives: robustness ranking (global robustness) and per-sample perturbation. For the former, we compare the RA reported in RobustBench on the test dataset (named RobustBench Accuracy) as well the RA of Auto-Attack on the generated data samples (named AutoAttack Accuracy). For the latter, we report the RA of Auto-Attack in L2-norm with a fixed perturbation level of 0.5.
Evaluation metrics. For robustness ranking. we report Spearman's rank correlation coefficient between two sets of model rankings (e.g., GREAT Score v.s. RobustBench Accuracy). A value closer means higher consistency. Robust accuracy refers to the fraction of correctly classified samples against adversarial perturbations.
We run C2-norm CW attack [7] (with learning rate 0.005 and 200 iterations) on each generated data sample to find the minimal adversarial perturbation. Then, we use grid search in the range [0.2] with interval of 0.00001 to find temperature value maximizing the Spearmans' rank correlation coefficient between GREAT Score and CW attack distortion.
Calibration Method.
Compute Resources. All our experiments
a GTX 2080 Ti GPU with 12GB RAM.
7

---

Table 1: Comparison of (Calibrated) GREAT Score v.s. minimal distortion found by CW attack [7] on CIFAR-10. The results are averaged over 500 samples from StyleGAN2.
Table 2: Spearman's rank cor- relation coefficient on CIFAR- 10 using GREAT Score, Ro- bustBench (with test set), and Auto-Attack (with generated
Model Name
Rohas
AutoArtack
GREAT
Calibrated GREAT Score
CW
(ccuracy((5)
Ascuracy(S)
Score
Distortion
Rebuffi_exca [[6]
82.32
0.507
1,216
L,59
GowalLestra [21]
0.534
1.324
samples).
Rebull: 4kpm [46]
Rebutt_770. dd.a [46]
M0142
78.50
90.00
0.451
0.44
1.14
1.208
1,943
1,796
Uncalibrated Calibrated
Augustin WeNNee [P]
78.79
$6.20
0.525
1.206
1,40
GREAT Score vs. RobustBench
Schwag [54]
71.24
89.20
0.227
1.143
1,392
Augusin WRN []]
76.25
$6.40
0.383
1.266
1,332
Correlation
0.6618
0.8971
Rade [:5]
76.15
36,60
0.413
1,200
1,466
Rebult R18[46]
75.86
87.
0.369
1.210
1,433
GREAT Seore vs.
Gowal [2]]
74.50
$6.10
0.124
1.116
1,253
AutoAttack
Selwag_ R18 [54]
74.41
0.236
1.343
Correlation
0.3690
0.6941
Wu2222/Advessrtall [62]
73.06
34.60
0.128
1.110
1,309
RobustBench vs.
Auggevic2120Aateesaraall [3]
72.01
0.569
1199
1,285
AutoAtack
Engatom20 SRobustnes [15]
69.24
$2.20
0.160
1,020
1,084
Correlation
0.7296
0.7296
Ble22020veriiiing [47]
67.68
$1.80
0.152
1.040
1,50
Rony 201 DDecompinng [50]
66.44
79.20
0.275
1100
1.165
2MMMA [14]
06.09
77.60
0.112
0,909
1,095
4.2
Local and Global Robustness Analysis
Recall from Theorem 1 that the local robustness score proposed in (3) gives a certified perturbation level for generated samples from a generative model. To verify this claim, we randomly select 20 generated images on CIFAR-10 and compare their local certified perturbation level to the perturbation found by the CW attack [7] using the Rebuffi_extte extra model [46]. Figure shows the perturbation level of local GREAT Score in (3) and that of the corresponding CW attack per sample. We can see that the local GREAT Score is lower bound of CW attack, the CW attack finds successful adversarial perturbation that is no smaller than the minimal perturbation Ain (i.e., an over-estimation). The true Amin value lies between these lower and upper bounds.
In Figure 2, we compare the cumulative robust accuracy (RA) of GREAT Score and Auto-Attack over 500 samples by sweeping the L2 perturbation level from 0 to with a 0.05 increment for Auto-Attack. The cumulative RA of GREAT Score at a perturbation level r represents the fraction of samples with local GREAT Scores greater than r. providing an attack-proof guarantee that no attacks can achieve a lower RA at the same perturbation level. For Auto-Attack, the RA at each perturbation level is calculated as the fraction of correctly classified samples under that specific perturbation. The blue curve in the figure represents the RA from empirical Auto-Attack, while the orange curve shows the RA derived from GREAT Score, offering certified robustness guarantee. We observe that the trend of attack- -ineeeddndee certified robustness (GREAT Score) closely mirrors that of empirical attacks (Auto-Attack), suggesting that GREAT Score effectively reflects empirical robustness. It is important to note that the gap between our certified curve and the empirical curve of Auto does not necessarily indicate inferiority of GREAT Score. Instead, this discrepancy could point to the existence of undiscovered adversarial examples at higher perturbation radii. This gap illustrates the fundamental difference between certified and empirical robustness measures, highlighting the potential for GREAT Score to provide a more conservative, yet guaranteed, estimate of model robustness.
Table 1 compares the global robustness statistics of the 17 grouped CIFAR- models on RobustBench for uncalibrated and calibrated versions respectively, in terms of the GREAT Score and the average distortion of CW attack, which again verifies GREAT Score is a certified lower bound on the true global robustness (see its definition in Section 3.1), while any attack with 100% attack success rate only gives an upper bound the true global robustness. We also observe that calibration can indeed enlarge the GREAT Score and tighten its gap to the distortion of CW attack.
4.3 Model Ranking on CIFAR-10 and ImageNet
Following the experiment setup in Section 1. we compare the model ranking on CIFAR-10 10 using GREAT Score (evaluated with generated samples), RobustBench (evaluated with Auto-Attack on the test set), and Auto-Attack (evaluated with Auto-Attack on generated samples). Table 2 presents their mutual rank correlation (higher value means more aligned ranking) with calibrated and uncalibrated versions. We note that there an innate discrepancy between Spearman's rank correlation coefficient (way below 1) of RobustBench v.s. Auto Atto-Attack, which means Atto-Attack will give inconsistent model rankings when evaluated on different data samples. In addition, GREAT Score measures classification margin, while AutoAttack measures accuracy under fixed perturbation budget e.
8

---

AutoAttack's ranking will change if we use different e values. E.g., comparing the ranking of e = 0.3 and e 0.7 on 10000 CIFAR-10 10 test images for AutoAttack, the Spearman's correlation only 0.9485. Therefore, we argue that GREAT Score and AutoAttack are complementary evaluation metrics and they don't need to match perfectly. Despite their discrepancy, before calibration, the correlation between GREAT Score and RobustBench yields similar value. With calibration, there is a significant improvement in rank correlation between GREAT Score to Robustbench and Auto-Attack, respectively.
Table 3 presents the global robustness statistics of these three methods on ImageNet. We observe almost perfect ranking alignment between GREAT Score and RobustBench, with their Spearman's s rank correlation coefficient being 0.8, which higher than that of Auto-Attack and RobustBench (0.6). These results suggest that GREAT Score is a useful metric for margin- -aageed robustness evaluation.
4.4 Ablation Study and Run-time Analysis
Ablation study on GANs and DMs. Evaluating on CIFAR-I0, Figure 3 compares the inception score (IS) and the Spearman's 's rank correlation coefficient between GREAT Score and RobustBench on five GANs and DDPM. One can observe that models with higher IS attain better ranking consistency.
Limitations and Further Analysis for generation models. While our experiments demonstrate the effectiveness of GREAT Score, it's important to acknowledge certain limitations and provide further analysis. The performance of GREAT Score relies on the generative model's ability to produce valid samples belonging to the conditioned class. Recent studies [34, 53] have shown GANs' convergence to true data distributions under specific conditions, and our experiments further demonstrate high- quality instances produced by the generative models, as evidenced by the inception score and the strong Spearman's rank correlation between GREAT Score and RobustBench. We recognize that in some cases, class ambiguity may exist. However, given our focus on evaluating classifier robustness, we typically deal with well-defined and distinctive labels, considering the issue of label ambiguity is beyond the scope of our method. Furthermore, the assumption that the generative model provides a good approximation of the true data- gata-generating distribution is crucial. Recent work [34, 53] has also demonstrated the convergence rate of approaching the true data distribution for family of GANs under certain conditions. These considerations highlight areas for potential future work and underscore the importance of careful generative model selection when applying GREAT Score.
Run-time analysis. Figure 4 compares the run-time efficiency of GREAT Score over Auto-Attack on the same 500 generated CIFAR- 10 images. We show the ratio of their average per-sample run-time (wall clock time of GREAT Score/Auto-Attan is reported in Appendix I) and observe around 800- 2000 times improvement, validating the computational efficiency of GREAT Score. Furthermore, our framework demonstrates excellent scalability with increasing dataset sizes and model complexity, as detailed in Appendix N, showing linear scaling behavior that makes it suitable for large-scale applications.
Sample Complexity and GREAT Score. In Appendix J, we report the mean and variance of GREAT Score with varying number of generated data samples. The results show that the statistics of GREAT Score are quite stable even with a small number of data samples (i.e., 2500).
Table 3: Robustness evaluation on Im- ageNet using GREAT Score, Robust- Bench (with test set), and Auto Attack (with generated samples). The Spear- man's 's rank correlation coefficient for GREAT Score v.s. RobustBench and Auto-Attack v.s. RobustBench is 0.9 and 0.872, respectively.
Make
Comparison Figure 4: Run-time improve- of Inception Score and ment (GREAT Score over Spearman's rank correla- Auto-Attack) on 500 gener- tion to RobustBench using ated CIFAR- 10 images.
Figure 3:
Model
RobustRench
AutoAttick
GREAT
Name
Accuracy (%)
Accamcy (%)
Score
Trans [52]
38.14
30.4
0.504
31,96
25.8
0.113
LIBRARY [1]]
29.23
30.6
0.499
Fast [6]]
26.24
192
0,273
GREAT Score with differ-
25.32
19.6
0.275
ent GANs.

---

Table 4: Group-wiig and overall robustness eval- uation for online gender classification APIs over
Table 5: GREAT Score v.s. robust accuracy under square attack [1].
500 generated samples (per group).
Online API Name
Old
Young
Hyaglasses
Without Eyeglasses
Total
DEEPPACE
Old
Young
With Pyeplasses
Fyeglasses
Without
BesaFace
0.900
0,662
0.317
0.73
0.78
Square Altack
84.00%
72.60%
65.8
89.00%
Interdo
0.580
GREAT Score
0.999
0.774
0.763
0.969
ARSA Technology
L003
0.255
0.739
1082
0.953
DELPPACE
0.799
0.774
0.763
0,99
0.822
Baidu
1.997
1,099
0.931
1.134
1.048
Luxand
1.091
0.912
0.673
1010
0.44
4.5 Evaluation on Online Facial Recognition APIs
To demonstrate GREAT Score enables robustness evaluation of black-box models that only provide model inference outcomes based on date inputs, we use synthetically generated face images with hidden attributes evaluate six online face recognition APIs for gender classification. It is worth noting that GREAT Score is suited for privacy-sensitive assessment because it only uses synthetic face images for evaluation and does not require using real face images.
We use an off-the-shelf face image generator InterFaceGAN [56] trained on CelebA-HQ dataset [29], which can generate controllable high-quality face images with the choice of attributions such as eyeglasses, age, and expression. We generate four different groups (attributes) of face images for evaluation: Old, Young, With Eyeglasses, and Without Eyeglasses. For annotating the ground truth gender labels of the generated images, we use the gender predictions from the FAN classifier [25]. In total, 500 gender-labeled face images are generated for each group. Appendix shows some examples of the generated images for each group.
We evaluate the GREAT Score on six online APIS for gender classification: BetaFacc [5], Inferdo [28], Arsa-Technology [2]. DeepFace [55], Baidu [4] and Luxand [37]. These APIs are "black-box" models end users or an external model auditor because the model details not revealed and only the model inference results returned by APIs (prediction probabilities on Male/Female) are provided.
Finally, we upload these images to the aforementioned online APIs and calculate the GREAT Score using the returned prediction results. Table 4 displays the group-level and overall GREAT Score results. Our evaluation reveals interesting observations. For instance, APIs such BetaFace, Inferno, and DEEPFACE exhibit a large discrepancy for Old v.s. Young, while other APIs have comparable scores. For all APIs, the score of With Eyeglasses is consistently and significantly lower than that of Without Eyeglasses, which suggests that eyeglasses could be common spurious feature that affects the group-level robustness in gender classification. The analysis demonstrates how GREAT Score can be used to study the group-level robustness of an access-limited model in a privacy-enhanced manner.
To verify our evaluation, in Table 5 we compare GREAT Score to the black-box square attack [1] with e = 2 and # queries= 100 on DEEPFACE. For both Age and Eyeglasses groups (Old v.s. Young and W/ v.s. W/O eyeglasses), better robust accuracy (%, first row) against square attack.
consistently that higher GREAT Score (second row) indicates
Conclusion
In this paper, we presented GREAT Score, a novel and computation-efficeen indeeeenn metric for global robustness evaluation against adversarial perturbations. GREAT Score uses an off-the-shelf generative model such as GANs for evaluation and enjoys theoretical guarantees on its estimation of the true global robustness. Its computation is lightweight and scalable because it only requires accessing the model predictions on the generated data samples. Our extensive experimental results CIFAR-10 10 and ImageNet also verified high consistency between GREAT Score and the attack-based model ranking on RobustBench, demonstrating that GREAT Score can be used as an efficient measure complementary to existing robustness benchmarks. We also demonstrated the novel use of GREAT Score for the robustness evaluation of online facial recognition APIs.
I Limitations. One limitation could be that our framework of global adversarial robustness evaluation using generative models is centered on L2-norm based perturbations. This limitation could be addressed if the Stein's 's Lemma can be extended for other L, norms.
10

---

Acknowledgments and Disclosure of Funding
This work was supported by the JC STEM Lab Intelligent Design Automation funded by The Hong Kong Jockey Club Charities Trust for Zaitang Li and Tsung-Yi Ho. Also, this material is based upon work supported by the Chief Digital and Artificial Intelligence Office under Contract No. W519TC-23-9-2037 for Pin-Y Yu Chen.
References
[1] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square tack: query-efficient black- box adversarial attack via random search. In European Conference on Computer Vision, pages 484-501. Springer, 2020. 10
[2] A Technology.
https://rapidapii.com arra--echcllogy--a--tttooeeeee htt.://ww.o.coooooaaaaaaaaaaeeee o.
Arsa API.
10
[3] Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness on in-and out-distribution improves explainability. In European Conference on Computer Vision, pages 228-245. Springer, 2020. 8, 20, 21,
[4] Baidu. Baidu API. https://ccosslee wwt./oooocllccccccoooooooccccocc bce...eee..........o...... www.beee....b........ wtw.b.aadd.....o.......o 10
[5] BetaFace.
BetaFace API.
https://rapidag:: rapi com/betafaccs/apl
face reteerreconitiiin 10
[6] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2019, URL nttps://openrevie
net / forum? borum??ddBBxsqjii
[7] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017. 3, 7,
[8] Pin- Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich. EAD: elastic-net attacks to deep neural networks via adversarial examples. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 10- 10-17, 2018.
[9] Jeremy M Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference Machine Learning, 2019. 2
[10] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference machine learning. pages 2206-2216. PMLR, 2020. 2, 3.7
[11] Francesco Croce, Maksym Andriushchenko. Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020. 2, 3,
[12] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateck Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2). 2021. URL bttps::/ net / Eorum? di SSKZP JCt
[13] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pages 248-255. leee, 2009. 6
[14] Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma train- ing: Direct input space margin maximization through adversarial training. arXiv preprint arXiv:1812.02637, 2018. 8, 20, 24

---

[15] Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robust- ness (python library). 2019. URL https:://// httttps://ithuaee cow httpe/yy/aaoooouuteessse.ee
9, ,1,2, 24
[16] Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Manfred Morari, and George Pappas. Efficient and accurate estimation of lipschitz constants for deep neural networks, Advances in Neural Information Processing Systems, 32, 2019. 15
[17] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
[18] Ian Goodfellow, Jean Pouget-Abadia Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(1 1):139-11110 144, 2020. 2, 3
[19] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6577 2014.
[20] Sven Gowal, Krishnamurthy Dj Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovie, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. In Proceedings of the IEEE International Conference on Computer Vision, pages
2019. [21] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against bounddounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020. 8, 20, 21.
[22] Ping Guo, Cheng Gong, Xi Lin, Zhiyuan Yang, and Qingfu Zhang. Exploring the adversarial frontier: Quantifying robustness via adversarial hypervolume. arXiv preprint Att::2403.001000, 2024.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pultern recognition, pages 770-778, 2016. 20
[24] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. European conference on computer vision, pages 630-645. Springer, 2016. 20
[25] Keke He, Yanwei Fu, Wuhao Zhang, Chengjie Wang. Yu-Gang Jiang, Feiyue Huang, and Xi- angyang Xue. Harnessing synthesized abstraction images to improve facial attribute recognition. 10
[26] Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. arXiv preprint arXiv: 704555 2017.
[27] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:68-00-851,, 2020 3,
[28] Inferdo. Inferdo API. https:://aappdaatt http:/aap....oma//eeee/ee//ee//a http://ffcceeeeteeieeeee http:////aeeerre/a///a/aeeeeetta
10
[29] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. In International Conference on Learning Representations, 2018. 6, 10
[30] Tero Karras, Samuli Laine, Miik Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 81 110-8119, 2020. 7
[31] Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. International Conference on Computer Aided Verification, pages 97-117. Springer, 2017.
12

---

[32] Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009.
[33] Klas Leino, Zifan Wang. and Matt Fredrikson. Globally-robus neural networks, In International Conference Muchine Learning, pages 6212-6222 PMLR, 2021. 15
[34] Tengyuan Liang. How well generative adversarial networks learn distributions. The Journal of Machine Learning Research, 22(1):1036-10400) 2021. 9, 15
[35] Jae Hyun Lim and Jong Chul Ye. Geometric gan. arXiv preprint arXiv: 0289, 2017. 7
[36] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
6
[37] Luxand. Luxand API. https: htwp//aashbbardoooooooeaaaaaaaa. Luxand. cloud/. 10
[38] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
[39] Xudong Mao, Qing Li, Haoran Xie, Raymond YK Lau, Zhen Wang, and Stephen Paul Smolley, Least squares generative adversarial networks. In Proceedings of the IEEE international conference on computer vision, pages 2794-2802, 2017. 7
[40] Andreas Maurer and Massimillino Pontil. Some hoeffding and bernstein-type concentration inequalities. arXiv preprint arXiv:2102.006304 2021. 5, 17
[41] Minsu Cho Minguk Kang, Woohyeon Shim and Jaesik Park. Rebooting ACGAN: Auxiliary Classifier GANs with Stable Training. 2021. 7
[42] Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. arXiv preprint arXiv: (002.0/800.095.7.. 2018. 7
[43] Raphael Olivier and Bhiksha Raj. How many perturbations break this model? evaluating robustness beyond adversarial accuracy. In International Conference on Machine Learning, pages 36583-26599 PMLR, 2023.
[44] Remigijus Paulavičius and Julius Žilinskas. Analysis of different norms and corresponding lipschitz constants for global optimization. Technological and Economic Development of Economy, 12(4):301-306, 2006. 16
[45] Rahul Rade and Seyed- Moheen Dezfovi- Helper-based adversarial training: Reducing excessive margin to achieve a better accuracy vs. robustness trade-off. In ICML 2021 Workshop on Adversarial Machine Learning, 2021. 8, 20, 21, 24
[46] Sylvestre-AIvin Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021. 7, 8, 20, 21, 24
[47] Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pages 8093-8104. PMLR, 2020. 8, 20, 21, 24
[48] Alexander Robey, Luiz Chamon, George Pappas, and Hamed Hassani. Probabilistically robust learning: Balancing average and worst-case performance. In International Conference on Machine Learning, pages 18667-18686. PMLR. 2022. 3
[49] RobustBench. Robustbench. https::/ www.rroouuutttre github. 1o/.
[50] Jérôme Rony, Luiz Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based 12 adversarial attacks and defenses. Proceedings of the IEEE/CV Conference on Computer Vision and Pattern Recognition, pages 4322-4330, 2019. 8, 20, 21, 24
13

---

[51] Wenjie Ruan, Min Wu, Youcheng Sun, Xiaowei Huang, Daniel Kroening, and Marta Kwiatkowska. Global robustness evaluation of deep neural networks with provable guarantees for the 1_0 norm. arXiv preprint arXiv: 05805, 2018. 15
[52] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do ad- versarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533- -3453,3555,-- 2020. 9, 20
[53] Nicolas Schreuder, ficto-EEmmante Brunel, and Arak Dalalyan. Statistical guarantees for generative models without domination. In Algorithmic Learning Theory, pages 1051-1071. PMLR, 2021. 9, 15
[54] Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? arXiv preprint arXiv:2104.09425, 2021. 20, 21, 24
[55] Sefik Iikin Serengil and Alper Ozpinar. Hyperextended lightface: A facial attribute analysis framework. In 2021 International Conference Engineering and Emerging Technologies (ICEET), pages 1-4, IEEE, 2021. doi: 10. 1091009ET5T333442222222 2221994992..21999969977 URL https: 0ww00///ICEE5/00 3442. 2021 9659697. 10
//doi.org/10
[56] Yujun Shen, Jinjin Gu, Xiaoou Tang, and Bolei Zhou. Interpreting the latent space of gans for semantic face editing. In CVPR, 2020. 10
[57] Charles M Stein. Estimation of the mean of a multivariate normal distribution. The annals of Statistics, pages 1135-1151, 1981. 16
[58] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, 2014.
[59] Tsui-Wei Weng, Huan Zhang, Pin-Y Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. arXiv preprint
2018. 2, 4, 15, 16
[60] Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pages 5286-5295, 2018. 2
[61] Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.0399 2020. 9, 20
[62] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958-225 2969, 2020. 8, 20, 21,20 24
[63] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choc, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6023-6032,
2019. 20
[64] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016. 20
[65] Han Zhang, Ian Goodfellow, Dimitris Metaxas, and Augustus Odena. Self-attention generative adversarial networks. In International conference on machine learning, pages 7354-7363.
PMLR, 2019. 7
[66] Huan Zhang, Tsui-Wei Weng, Pin-Yu Yu Chen, Cho-Jui Hsich, and Luca Daniel. Efficient neural network robustness certification with general activation functions. In Advances in Neural Information Processing Systems, pages 4944 4953, 2018.
14

---

A
Notations
Table Main notations used in this paper
Notation
Deseription
dimensionality of the input vector number of output classes neural network classifier data sample groundtruth class label input perturbation Cy norm of perturhation, minimum adversarial perturbation (conditional) generative model
K
f :R + R
a E R
y
R
161p
Amtn
G
((
latent vector sampled from Gaussian distribution
robustness score function defined in (3)
truefestimated global robustness defined in Section 3.1
B More Motivations on using Generative Models for Robustness Evaluation
We emphasize the necessity of generative models using the points below.
1. Global robustmess assessment requires a GM. The major focus and novelty of our study are to evaluate the global robustness with respect to the underlying true data distribution, and we propose to use a GM as proxy. We argue that such a proxy is necessary to evaluate global robustness unless the true data distribution is known.
2. GAN can provably match data distribution. Recent works such as [53] and [34] have proved the convergence rate of approaching the true data distribution for family of GANs under certain conditions. This will benefit global robustness evaluation (see Figure for ablations on GAN variants).
3. Privacy-sensilive remote model auditing. As shown in See 4.5, synthetic data from generative models can facilitate the robustness evaluation of privacy-sensitive models.
B.1 Related Works for Global Robustness Evaluation for Deep Neural Networks.
There are some works studying "global robustness", while their contexts and scopes are different than ours. In [51], the global robustness is defined the expectation of the maximal certified radius of Co-morm over a test dataset. Ours is not limited to a test set, and we take the novel perspective of the entire data distribution and use a generative model to define and evaluate global robustness. The other line of works considers deriving and computing the global Lipschitz constant of the classifier global certificate robustness guarantee, it quantifies the maximal change of the classifier with respect to the entire input space [33]. The computation can be converted as semidefinite program (SDP) [16]. However, the computation of SDP expensive and hard scale larger neural networks. Our method does not require computing the global Lipschitz constant, and our computation as simple data forward pass for model inference.
C Proof of Theorem 1
In this section, we will give detailed proof for the certified global robustness estimate in Theorem 1. The proof contains three parts: (i) derive the local robustness certificate; (ii) derive the closed-form global Lipschitz constant; and (iii) prove the proposed global robustness estimate is a lower bound on the true global robustness.
We provide proof sketch below:
We use the local robustness certificate developed in [59], which shows an expression of certified (attack-proof) Lo-norm bounded perturbation for any 2 1. The certificate is function of the gap between the best and second-best class predictions, as well as a local Lipschitz constant associated with the gap function.
15

---

2. We use Stein's Lemma [57] which states that the mean of measurable function integrated over a zero-mean isotropic Gaussian distribution has closed-form global Lipschitz constant in the -n-norm. This result helps avoid the computation of the local Lipschitz constant in Step I for global robustness evaluation using generative models.
3. We use the results from Steps I and to prove that the proposed global robustness estimate Ô)()) lower bound on the true global robustness R(f) with respect G.
C.1 Local robustness certificate
In this part, we use the local robustness certificate in [59] to show an expression for local robustness certificate consisting of gap function in model output and local Lipschitz constant. The first lemma formally defines Lipschitz continuity and the second lemme introduces the the local robustness certificate in [59].
Lemma (Lipschitz continuity in Gradient Form ([44))). Let S Rd be a convex bound closed set and let : - R be continuously differentiable function open set containing S. Then f is Lipschitz continuous function if the following inequality holds for any v, y E S.:
(fxx) - [(v)) s Ly | wllp
(5)
where Tig maxxes [V(())] is the corresponding Lipschitz constant, and Vf(())
01 af TT is the gradient of the function f(x), and 1/4 1/p = L, 100
de. ... Oza
We say is continuous in Cp norm if (5) satisfied.
Lemma 2 (Formal guarantee on lower bound for untargeted attack Theorem 3.2 in [59]). Let To E Rd and f Rd - RK be a multi-class classifier, and Sa be the i-th output of f. For untargeted attack, to ensure that the adversarial examples can not be found for each class, for all e R the lower bound of minumum distortion can be expressed by:
fm (zo) f((z))
|| S min 17m
(6)
L
where m arg (ax.. K) fx(xo), 1/9 1/p = 2 1.9 S x., and Ti is the Lipschitz constant for the function fm - f((z) in Ly norm.
C.2 Proof of closed-form global Lipschitz constant the Ly-norm over Gaussian distribution
In this part, we present two lemmas towards developing the global Lipschitz constant of a function smoothed by Gaussian distribution.
Lemma 3 (Stein's lemma [57]). Given a soft classifier R² + P, where is the space of probability distributions over classes. The associated smooth classifier with parameter 2 is defined as:
F: (F -B000/o))=0
(7)
Then, F is differentiable, and moreover,
V E6-N10.02116 F(x 5)]
(8)
In lecture note', used Stein's Lemma [57] to prove the following lemma:
Lemma 4 (Proof of global Lipschitz constant). Let 2 0, let h Rd + [0, 1] be measurable, and let Hl (0, Then H is
2
continuous in L2 norm
16

---

C.3 Proof of the proposed global robustness estimate (f)) is lower bound on the true global robustness (f) with respect to
Recall that we assume generative model G(-) generates a sample G(z) with 2 ~ (0, I). Following the form of Lemma 2 (but ignoring the local Lipschitz constant), let
max g' (G(z)) max (fx((((( (E.1...,,..kk
[x(()=)),
denote the gap in the model likelihood of the correct class c and the most likely class other than c of given classifier f, where the gap is defined to be 0 if the model makes incorrect top-1 class prediction on G()). Then, using Lemma with g', we define
E=~Noo.) (G(2)) - (g' o N(0,1)
(10)
2
[ZAITANG: Modified the equations] and thus ( (9/ (G(=)) has Lipschitz constant Le norm. This implies that for any input perturbation 8,
in
π
E E (G(()) + 6)] - Voo (G(()))
(11)
$
|81|
(12)
and therefore
E No +
(13)
2 v2 ||01|
2 E.-ioon (G(:)) ((
(14)
Note that if the right-hand side of (13) greater than zero, this will imply the classifier attains nontrivial positive mean gap with respect to the generative model. This condition holds for any
satisfying |
Eo (G(z))]. Note that by definition any minimum perturbation
G(z) will be no smaller than V E Vo, (G(2)) as it will make g((((2) almost surely.
Therefore, by defining g = V 2
g'. we conclude that the global robustness estimate π(f) (2)
using the proposed local robustness score g defined in (3) a certified lower bound on the true global robustness (f)) with respect to G.
D Proof of Theorem 2
To prove Theorem 2, we first define some notations as follows, with slight abuse of the notation generic function in this part. For vector of independent random variables X (X1... X define X' (X,..., Xx,) to be i.i.d. to X, (Ki, Hr) E X, and the sub-exponential norms |1-lls,, for any random variable as
|
Z 4/2 = sup
(15)
vpP
p21
Let f: X" + We further define the k-th centered conditional version of / as:
X fx(X) f(X) - Xx--1, Xp+1s ..!]
(16)
Lemma 5 (Concentration inequality from Theorem 3.1 in [40]). Let f X + R and X = Xi...., Xn) be vector of independent random variables with values in space X. Then for any we have
Pr(f(X) EIf(X') exp
(17)
32e
Σe (X
17

---

Recall that we aim to derive probabilistic guarantee on the sample mean of the local robustness score in (3) from www classifier with its outputs bounded by [0, 1] K Following the definition of g (for simplicity, ignoring the constant / ス //2,, the sample mean f can be expressed as:
S(X)
E
(18)
where X; ~ (O,
Following the definition of (16),
fx(X) = f(X) - [X] ,...., Xx-1, X8t1s..Naa
(19)
( 9(xx)) =
(20)
1
This implies (X) is bounded by - i... [ (lx and also (X) S
Squaring over (X)ll,),, gives
(x))
- n²
(21)
As result,
Σ (X)
S
1
1
(22)
n2
T1
+
Divide both side of (22) and multiply with
gives:
32e
12
12n
(23)
32e
Σx (x)
32c
Take exponential function over both side of (23) gives
- t
exp
(24)
32c
Σ fl (X)
32c
Recall Lemma 5, since this bound holds both sides of the central mean, we rewrite it as:
Pro
t) S exx
(25)
32e
Σx (X)
Hence to ensure that given a statistical tolerance >> 0 with 8 as the maximum outage probability,
i.e. Prob(If(X)) F. [XX']] >
< 8, we have
2
2 exp
< 2xexp
(26)
32e
Ee (X)11
32c
<
(27)
Finally, (26) implies that the sample complexity to reach the (c, 8) condition is n > 32e-1og(2/8)
Figure shows the flow chart of Algorithm 1.
18

---

Vindi
fon
2 200 Vaniiile
Figure 5: The Flow Chart of GREAT Score.
Table 7: Spearman's rank correlation coeffienct on CIFAR-10 10 using GREAT Score, RobustBench (with test set), and Auto-Attack (with generated samples) with different calibration methods.
GREAT Score v.s. GREAT Score v.s. AutoAttack Corcelation
RobustBench
RobustBench Correlation
AutoAttack Correlation
softmax with temperature sigmoid with temperature sigmoid with temperature after softmax softmax with temperature after sigmoid
-0.5024
-0.5334
0.7296
0.7083
0.3641
0.7296
-0,2525
-0.2722
0.7296
0.8971
0.6941
0.7296
E
Comparison between CW Attack and GREAT Score
We provide a detailed comparison of the time complexity between GREAT Score and CW Attack.
The time complexity of the GREAT Score algorithm is determined by the number of iterations (generated samples) in the loop, which is denoted as Ng. Within each iteration, the algorithm performs operations such as random selection, sampling from Gaussian distribution, generating samples, and predicting class labels using the classifier. We assume these operations have constant time complexity I and absorb them in the big O notation. Additionally, the algorithm computes the sample mean of the recorded statistics, which involves summing and dividing the values. As there are Ns values to sum and divide, this step has a time complexity of O(Ns). Therefore, the overall time complexity of the algorithm can be approximated as O
Using our nation, consider a K-way classifier f. Let v be a data sample and y be its top-1 classification label. Denote d the adversarial perturbation. The untargeted CW Attack (L2 norm) solves the following optimization objective:
8 arg min [011 + ff +)
max kE(1.... KJ.kzy
falx + +6)
(28)
where fi(-)) the prediction of the k-th class, and 0 a hyperparameter.
For CW attack, the optimization process iteratively finds the adversarial perturbation. The number of iterations required depends on factors such as the desired level of attack success and the convergence criteria. Each iteration involves computing gradients, updating variables, and evaluating the objective function. It also involves hyperparameteraa search stage to adjust the weighted loss function.
Specifically, let B the complexity of backpropagation, Tg be the number of iterative optimizations, and T₁ be the number of binary search steps for a. The dominant computation complexity of CW attack for Ns samples is in the order of O(Ns T, T. B). Normally, T, is set to 1000, and T3 is set to 9, Therefore, CW attack algorithm is much more time-consuming than GREAT Score.
F Best Calibration Coefficient on different activation methods
Table 7 shows the best ranking coefficient we achieved on each calibration option for CIFAR-10. Among all these four calibration choices, we found that Sigmoid then Temperature Softmax achieves the best result.
19

---

G Detailed descriptions of the Models
We provide the detail description for classifiers on RobustBench what follows. The classfiers for CIFAR-10 are mentioned first and the last paragraph provides descriptions for ImageNet classifiers. Rebuffi et al. [46]: Rebuffi et al. [46] proposed fixing data augmentation method such as using CutMix [63] and GANs to prevent over-fittigg There are 4 models recorded in [46]: Rebuffi extra uses extra data from Tiny ImageNet in training, while Rebuffi 70 ddpm uses synthetic data from DDPM. Rebuffi 70 ddpm/Rebuffi 28 ddpm/Rebuffi R18 varies in the network architecture. They
use WideResNett70-1E [64]/WideResNet-25 10 (6-JfreActResNeet-BB [24].
Gowal el al./21], Gowal et al. [21] studied various training settings such as training losses, model sizes, and model weight averaging. @owal__xtra differs from Gowal in using extra data from Tiny
ImageNet for training.
Augustin et al.[3]: Augustin et al.[3] proposed RATIO, which trains with an Out-tr-distiibution dataset. Augustin ______RN________ extra uses the out-of-distribution data samples for training while Au- gustin WRN does not.
SehWag al. [54]: SehWag al. [54] found that proxy distribution containing extra data
help to improve the robust accuracy. Sehwag/Schwag R18 uses WideResNet-344 [64]/ResNet-18
[23], respectively.
Rade et al. [45]: Rade [45] incorporates wrongly labeled data samples for training.
Wu et al. [62]: AuvozOAdverrarrill [62] regularizes weight loss landscape.
LIBRARY: Engstromm211
2 is package used to train and evaluate the robustness of
neural network.
Rice et al. [47]: Rice20200verfitting [47] uses early stopping in reduce over-fitting during training.
Rony al. [50]: Rony2019Decouphh [50] generates gradient-based attacks for robust training.
Ding et al. [50]: Ding2020MMA [14] enables adaptive selection of perturbation level during
training.
For the ImageNet models, Trans [52] incorporates transfer learning with adversarial training. Its model variants Transi/Trans2/rrans,
WideResNett50-22 [64)/ResNet-50 [23]/ResNet-18 [23]. LIBRARY means using the package mentioned in Group of other models to train on ImageNet. Fast [61] means fast adversarial training. There is no C2-norm benchmark for ImageNet RobustBench, so we use the -norm benchmark.
H Approximation Error and Sample Complexity
Figure presents the sample complexity analyzed in Theorem with varying approximation error (e) and three confidence parameters (8) for quantifying the difference between the sample mean and the mean for global robustness estimation. As expected, smaller ó smaller will lead higher sample complexity.
d=0.05
Samp Complexity
30000
0.100
0.125
0.150
0.175
0.00
0.255
0250
0272
Approximation Error
Figure 6: The relationship hetween the approximation error (e) and sample complexity in Theorem with three different confidence levels: = (5, 15, 25.
Phttps:/ / http:///..tt.ttct/a//aattttt//// www.//aadyyaaa/rrbbsutttaa
20

---

Table Group-wiss wise time efficiency evaluation on CIFAR-I0 using GREAT Score and Auto-Attack (with 500 generated samples).
Model Name
GREAT Score(Per (ample)s)
(utoAttack(Per SampleXs)
Rebuffi Lettr [46]
0.038
60.872
Gowal extra [21]
0.034
59.586
Rebuthi_22 70_ ddmm [46]
0.034
61.3362
Rebuffi 28 38_dpmmmmmm [46]
0.011
10.3828
Augustin_ Baaustin_RR___e Bet_WWNN_eeeeeee [3]
0.013
10.096
Schwag [54]
0.011
10.3662
Augustin_ WRN [3]
0.011
10.1056
Rade [45]
0.007
4.41
Rebuffi_R1810 [18[4]]
0.008
4, 4.4644
Gowal [21]
0.034
60.746
Schwag R18 [54]
0.007
3,8652
Nu2020AAvvessarial [62]
0.012
10.9826
Augustin2020AAdversatalll [3]
0.014
6.9148
Fingstrom201 1rsstromm211Rohuunneess Rohusstnss [15]
0.012
6.6462
Rice202U0veritting [47]
0.007
3,5776
Rony2019Decoupphe [50]
8,5834
Ding2020MMA [14]
3.6194
I Complete Run-time Results
The complete run-time results of Figure 4 are given in Table 8:
J Sample Complexity and GREAT Score
0.8
GREAT Score
0.6
0.5
0.3
0.1
Sample Complexity
Figure 7: The relation of GREAT Score and sample complexity using CIFAR- 10 and Rebuffi extra model over (500-1000 (00010000) range. The data points refer to the mean value for GREAT Score, and the error bars refers to the standard derivation for GREAT Score.
Figure reports the mean and variance of GREAT Score with a varying number of generated data samples using CIFAR-10 and the Rebuffi extra model, ranging from 500 10000 with 500 increment. Figure reports the mean and variance of GREAT Score ranging from 50 to 1000 with 50 increment. The results show that the statisties of GREAT Score quite stable even with small number of data samples.
K GREAT Score Evaluation on the Original Test Samples of CIFAR-10
Besides evaluating the GREAT Score on the generated samples from GAN, we also run the evaluation process 500 test samples of CIFAR-10 10. Table shows the evaluated GREAT Score.
21

---

0.9
GREAT Score
0.5
0.0
0.3
200
4003
820
800
1000
Sample Complexity
Figure 8: The relation of GREAT Score and sample complexity using CIFAR-10 and Rebuffi extra extra model over (50- 1000) range. The data points refer to the mean value for GREAT Score, and the error bars refers to the standard derivation for GREAT Score.
Figure 9; Generated Images for old subgroup.
L Generated Images from Facial GAN Models
show the generated images from four groups in what follows.
M Impact Statements
As this work focuses on quantifying and scoring the global robustness of neural network classifiers, we do not currently foresee any negative impact based work. We envision work to be used in model auditing settings such as model cards.
N Scalability Analysis
To evaluate the scalability of the GREAT Score framework, we conducted experiments using three ResNet variants (ResNet50, ResNet101, and ResNet152) with varying dataset sizes ranging from 500 to 2000 images. The computation times were measured in milliseconds without implementing any attack mechanisms.
Table 10 presents the detailed computational performance across different configurations.
Our experimental results demonstrate linear increase in computation time with respect to both dataset size and model complexity. More sophisticated architectures like ResNet152 required proportionally more processing time compared simpler ones like ResNet50. This linear scalability indicates that
22

---

Figure 10: Generated Images for young subgroup.
Figure 11: Generated Images for with-eyeglasses subgroup.
Figure 12: Generated Images for withouu-eeegllase subgroup.
23

---

the GREAT Score framework efficiently handles larger datasets and more complex models, making suitable for large-scale applications.
Table 9; GREAT Score on CIFAR-10.
The results are averaged over 500 original test samples.
RobustBench Accuracy(53)
AutoAttack Accuracy(%)
GREAT
Test Samples
Model Name
Score
GREAT Score
Rebuffi _eterfieeettaaeeeeee [46]
82.32
87.20
0.507
0.465
Gowal extra [21]
80.53
85.60
0.534
0.481
Rebufti ddpm [46]
80.42
90.60
0.451
0.377
Rebuffi 28 2iiii____ddpmmm_ ddpm [46]
78.80
90.00
0.424
0.344
Augustin WRN extra [3]
78.79
86.20
0.525
0.525
Sehwag [54]
77.24
89,20
0.227
0.227
Augustin WRN [3]
76.25
86.40
0.583
0.489
Rade [45]
76.15
86.60
0.413
0.331
Rebuffi R18[46] Rebuff__R8846)
75.86
87.60
0.369
0.297
Gowal [21]
74,50
86.40
0.124
0.109
Sehwag_R18 [54]
74.41
88.60
0.236
0.176
Wu.2020Adversarial [62]
73.66
84.60
0.128
0.106
Auggsstin2020AAdverssaaaa [3]
72.91
85.20
0.569
0.493
Engstrom22019Rouustness [15]
69.24
82.20
0.160
0.127
Rice20200verritinng [47]
67.68
81.80
0.152
0.120
Rony2019Deccupling [50]
66.44
79.20
0.275
0.221
Ding2020MMA [14]
66.09
77.60
0.112
0.08

---

Table 10: Computation time (ms) for different ResNet models and dataset sizes
Dataset Size
ResNet50
ResNet101
ResNet152
500
3274
625I
9149
1000
6529
12528
18339
1500
9785
18838
27481
2000
12960
24917
36588
25

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Yes, the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
In the abstract and introduction, we introduce the GREAT Score, a novel and computation- efficient attack-independet metric for global robustness evaluation against adversarial perturbations. This claim is supported throughout the paper by detailing the methodology and implementation of the GREAT Score, which utilizes off-the-shelff generative models such as GANs. The paper discusses the theoretical guarantees associated with GREAT Score's estimation of true global robustness, reinforeing the validity of this claim.
The lightweight and scalable nature the GREAT Score is emphasized, noting that only requires model predictions generated data samples. This is thoroughly validated through extensive experimental results on CIFAR-10 10 and ImageNet datasets, where we demonstrate high consistency between GREAT Score and the attack-based model rankings on RobustBench. These results substantiate the claim that GREAT Score can serve as an efficient alternative for robustness benchmarks.
Furthermore, the paper explores the novel application of GREAT Score for evaluating the robustness of online facial recognition APIs. This application is detailed in the results section, providing additional evidence of the metric's 's versatility and practical utility.
Therefore, the main claims in the abstract and introduction are well-supported by the comprehensive experimental results and detailed analysis presented in the paper, ensuring accurate reflection of our contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how be expected to generalize other settings.
much the results
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Yes, please see Limitations in Section 5.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sell-specification asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
26

---

The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: Please see Section 3 for all the Theory Assumptions, we provide the proof for them Appendix C and D.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Yes, please check Section 4.1 and Appendix for experiment details. Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
27

---

reproducible, they While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Please see the attached code in the supplementary material. We also prepare a document alongside the code for instructions to reproduce the experiments.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https:/ /ttpps:////ips.peeeeee cc/
pub icc gui des/ CodeSubmi ssi assionooiioo cy) for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: n ps.pss... cc publi i c/ des GodeSubbi ss i onPol iyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We have provided a experiment setup in Section 4.1. Besides, we give a detail explanation in each subsection of the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
28

---

The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification: We provide probabilistic guarantee Theorem 2, which can be translated to error bars.
GREAT Score evaluation in
Guidelines:
The answer NA means that the paper does include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please check Section 4.1. Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: /ttt:://neuri...m httppp/b..///cccccccc.eeeeeee
Answer: [Yes]
Justification:
We have exactly follow the code of Ethics of NeurIPS.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

---

If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please see Section M.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymeet of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: As our work do not directly release models and data, hence no high risk for misuse of
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
30

---

Answer: [Yes]
Justification: We have cite all the assets we used in the paper. We use all licensed datasets under MIT License.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, papersw rawi thcode. com / da a setss has curated licenses for some datasets. Their licensing guide help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's ss creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and the documentation provided alongside the assets?
Answer: [Yes]
Justification: We have provided our code for evaluation robustness framework. Although our method involved using generative model to generate new data. We actually share the generation process, not the data itself. Therefore, no new data is introduced here.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: No Human Subjects concerned.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
31

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: No Human Subjects concerned.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
32


Reviews:
[{"review_id": "kUFCu2On6U", "reviewer": "Reviewer_gkrf", "summary": "The paper addresses the important and under-explored problem of \"global robustness evaluation\" for neural networks. It proposes GREAT Score, a novel framework for assessing global robustness using generative models (GMs).  Besides, through Monte Carlo sampling from GMs and using Hoeffding's concentration bound, the algorithm can reach an epsilon probabilistic guarantee on the sample mean's closeness to the true mean. The paper then applies their proposed algorithm on various classifiers using GMs to measure global robustness scores.", "questions": "Please respond my questions in the weakness part.", "limitations": "Yes", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1) The paper attempts to tackle a significant gap in global robustness assessment, offering a reasonable and innovative contribution to the field.\n2) The paper is well-organized, clearly written, and easy to follow.\n3) The experimental results show high consistency between GREAT Score and attack-based model rankings on RobustBench, demonstrating its potential as an efficient alternative to existing robustness benchmarks.", "weaknesses": "1) The reliance on GANs as a proxy for the true data distribution raises concerns about the method's accuracy. To the best of my knowledge, current GANs do not generate better coverage than the test set. GANs are a bad estimation of the underlying data distribution with known issues such as bias and model collapsing. Considering model collapse, the fixed test set is likely to have even better distribution coverage than the samples generated from GAN. It would be much more reliable and convincible by involving  the recent class generative models.\n2) I also encourage the authors to include experiments with other local robustness estimators, further strengthening the submission.\nHow does the choice of generative model and local robustness estimator affect the reliability of the global measure computed by the paper?\n3) Theoretically, while the authors provide a probabilistic guarantee on the obtained estimates derived from GMs and true estimate, there's a lack of theoretical bound on gap between the true estimate and models' global robustness arising from the distance of the  generative distribution and underlying data distribution. Otherwise, the significance and utility of the GREAT score is unclear for me, and this omission makes it unclear how the accuracy of the empirical distribution affects the overall error, beyond just sample complexity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We express sincere gratitude for your valuable feedback and constructive comments.\n\n## Question 1: GAN reliability and distribution coverage?\n\nThank you for your feedback on the reliance on GANs as a proxy for the true data distribution. We acknowledge the concerns about the method's accuracy, particularly the issues of bias and model collapse inherent in GANs. We would like to address these concerns and explain our approach in detail.\n\nFirstly, we would like to clarify that we utilized conditional generative models in our framework. Conditional generative models, such as Conditional GANs (cGANs), allow for more controlled generation of samples by conditioning on specific labels or attributes. This helps in generating more representative and varied samples, which can mitigate some of the biases and issues associated with traditional GANs.\n\nRecent works such as [Nicolas, 2021] and [Tengyuan Liang, 2021] have proved theoretically that GANs can learn the true generating distribution under certain conditions. Besides GANs, we have diffusion models in our analysis, and as the reviewer expected, it gives a better robustness analysis, as shown in Fig. 3. Please also see Appendix A.2 for details.\n\n\n\nReferences:\n\nNicolas Schreuder, Victor-Emmanuel Brunel, and Arnak Dalalyan. Statistical guarantees for generative models without domination. In Algorithmic Learning Theory, pages 1051–1071. PMLR, 2021. 14\n\nTengyuan Liang. How well generative adversarial networks learn distributions. The Journal of Machine Learning Research, 22(1):10366–10406, 2021. 14\n\n\n## Question 2: Experiments with other estimators?\n\n\nThank you for the insightful question. Following the reviewer's suggestion, in our experiments below, we included two types of local robustness estimators to evaluate model robustness more comprehensively: **Input Gradient Norm (as a proxy of sensitivity)** and **Entropy of the classifier output (as a proxy of confidence)**. We note that unlike our proposed GREAT Score, these estimators do not provide any certified robustness guarantee. Here's why we chose these estimators and how they affect our global measure:\n\n\n\n1. **Input Gradient Norm**:\n    - **Rationale**: This estimator measures the sensitivity of the model to small perturbations in the input by calculating the norm of the gradient of the loss with respect to the input. A higher gradient norm indicates greater sensitivity to input changes, suggesting lower robustness.\n    - **Reference**: The use of input gradient norm for robustness evaluation is well-documented.  [ Finlay and Oberman, 2021] proposed a method using input gradient regularization to improve adversarial robustness.\n    - **Implementation**: We computed the gradient norm for input samples and took the average to represent the model's sensitivity.\n\n2. **Entropy**:\n    - **Rationale**: Entropy of the classifier's output probabilities reflects the uncertainty of the model's predictions. Higher entropy indicates that the model is less confident in its predictions, which can be a sign of lower robustness.\n    - **Reference**: The relevance of entropy as a measure of model uncertainty and robustness is supported by [Smith and Gal ,2018], who explored various uncertainty measures, including entropy, for detecting adversarial examples .\n    - **Implementation**: We calculated the entropy of the output probabilities for input samples and took the average to represent the model's uncertainty.\n\n\n\nTo validate the reliability of our global measure, we computed the Spearman correlation coefficient between our averaged estimation scores and the rankings from RobustBench. Besides the local robustness estimator, the experiment setup is the same as Table 1.\n\n\n#### Experimental Results\n\n|                                   | Input Gradient Norm | Entropy | GREAT Score Calibrated |\n|-----------------------------------|----------------------------|----------------|------------------------|\n| Correlation  with AutoAttack | -0.0956                     | 0.4500         | 0.6941                 |\n| Correlation  with RobustBench | 0.0343                      | 0.4951         | 0.8971                 |\n\nThis table summarizes the correlation results for the local robustness estimators and the GREAT Score with respect to AutoAttack and RobustBench. These results demonstrate the effectiveness of  GREAT Score in evaluating model robustness and their alignment with established benchmarks.\n\n\n\n\n### References\n\nFinlay, C., & Oberman, A. M. (2021). Scaleable input gradient regularization for adversarial robustness. Machine Learning with Applications, 3, 100017.\nSmith, L., & Gal, Y. (2018). Understanding measures of uncertainty for adversarial example detection. arXiv preprint arXiv:1803.08533.\n\n\n\n\n\n\n## Question 3: Theoretical bound on distribution gap and its effect on  utility?\n\n\nWe separated out the convergence of our edtimate to the true estimate versus the learned data distribution to the true data distribution because the latter has been proved in the literature. Recent works such as [Nicolas, 2021] and [Tengyuan Liang, 2021] have proved theoretically that GANs can learn the true generating distribution under certain conditions. Besides GANs, we have diffusion models in our analysis, and as the reviewer expected, it gives a better robustness analysis, as shown in Fig. 3.\n\nThe reviewer's intuition is correct. In our ablation study of generative models (GMs), we do find that better GMs give higher ranking. In Figure 3, we show that increasing the Inception Score of GMs can significantly increase the Spearman's rank correlation. Intuitively, a higher inception score means better learning of GMs to the underlying data distribution, resulting in improved ranking efficiency in our case. We also had a discussion on the approximation guarantee of some GMs to the true data distribution in Sec. 6.2. In summary, the effectiveness of GREAT Score is positively correlated with the generation capabilities of the GM in use.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VjV69PUpBz", "reviewer": "Reviewer_kqpq", "summary": "The paper introduces a novel framework called GREAT Score (Global Robustness Evaluation of Adversarial Perturbation using Generative Models), aimed at evaluating the global robustness of machine learning models against adversarial perturbations. Unlike traditional methods that aggregate local robustness results from a finite set of data samples, GREAT Score leverages generative models to approximate the underlying data distribution, providing a more comprehensive global robustness assessment.", "questions": "1. Have you considered extending the GREAT Score framework to other norm-based perturbations like L1 or L∞ norms? If so, what are the potential challenges or theoretical adjustments needed?\n2. How does the quality of the generative model affect the GREAT Score evaluation? Have you conducted any experiments using generative models of varying quality to analyze this impact?\n3. Can you provide more detailed information on the scalability of the GREAT Score framework with respect to extremely large datasets and models? How does the computation time scale with increasing data size and model complexity?\n4. How stable and consistent is the calibration process described in Section 3.5 across different models and datasets? Have you explored any advanced optimization techniques for calibration?", "limitations": "Yes", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The GREAT Score framework introduces a novel method for global robustness evaluation using generative models, which is a fresh and innovative approach in the field.\n- The paper provides solid theoretical foundations with formal definitions, probabilistic guarantees, and detailed proofs, enhancing the credibility of the proposed method.\n- The GREAT Score framework offers significant computational savings over traditional methods and can audit privacy-sensitive black-box models without accessing real data, highlighting its practical importance and broad applicability.", "weaknesses": "1. The GREAT Score in the paper primarily focuses on adversarial perturbations under the L2 norm. While this is a common setting in adversarial attack research, it lacks ablation studies for other norms, such as the L∞ norm\n2. The GREAT Score framework relies on generative models (such as GANs or diffusion models) to approximate the true data distribution. If the quality of the generative model is not high, the generated samples may not accurately represent the true data distribution, thus affecting the accuracy of robustness evaluation. Besides, the evaluation results of the GREAT Score also depend on the generated sample set. If the sample set is biased or fails to comprehensively cover the diversity of the data distribution, the evaluation results may be inaccurate or unrepresentative.\n3. The evaluation of online facial recognition APIs using GREAT Score is innovative, but the paper could provide more detailed analysis and discussion on the specific challenges and insights derived from this application. For instance, exploring the variability in robustness scores among different groups (e.g., age, eyeglasses) in greater depth and providing potential reasons for these variations would add depth to the analysis.\n4. The calibration process described in Section 3.5 appears somewhat ad-hoc, relying on grid search for optimizing temperature parameters. This could be perceived as lacking robustness and generalizability. A more systematic approach to calibration, possibly incorporating advanced optimization techniques or sensitivity analysis, would strengthen the framework. Discussing the stability and consistency of the calibration process across different models and datasets would also be beneficial.\n5. Despite claiming computational efficiency, the paper does not provide a detailed analysis of the scalability of the GREAT Score framework, especially in the context of extremely large datasets and models. A thorough examination of how the computation time scales with increasing data size and model complexity would add significant value. This could include empirical results demonstrating the method's performance on larger datasets or theoretical analysis of its computational complexity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your detailed and constructive comments. \n\n\n\n## Weakness 1 & Question 1: Ablation studies for other norms (e.g., L∞)?\n\n\nWe thank for bring the limititions of our theorem. As stated in Section 5, our framework currently focuses on the $\\mathcal{L}_2$ norm due to limitations in extending Stein's Lemma to other $\\mathcal{L}_p$ norms (see Lemma 4 in Appendix A.3). We agree that generalizing beyond $\\mathcal{L}_2$ robustness would be beneficial, but it is challenging without a generalized Stein's Lemma for other $\\mathcal{L}_p$ norms. As of now, we are not aware of any results that support such an extension.\n\n\n\n## Weakness 2 : Generative model quality and sample set bias.\n\n\nThe reviewer's intuition is correct. In our ablation study of generative models (GMs), we do find that better GMs give higher ranking. In Figure 3, we show that increasing the Inception Score of GMs can significantly increase the Spearman's rank correlation. Intuitively, a higher inception score means better learning of GMs to the underlying data distribution, resulting in improved ranking efficiency in our case. Recent works such as [Nicolas, 2021] and [Tengyuan Liang, 2021] have proved theoretically that GANs can learn the true generating distribution under certain conditions.  In summary, the effectiveness of GREAT Score is positively correlated with the generation capabilities of the GM in use. Please refer to Appendix A.2 for details\n\nReferences:\nNicolas Schreuder, Victor-Emmanuel Brunel, and Arnak Dalalyan. Statistical guarantees for generative models without domination. In Algorithmic Learning Theory, pages 1051–1071. PMLR, 2021. 14\n\nTengyuan Liang. How well generative adversarial networks learn distributions. The Journal of Machine Learning Research, 22(1):10366–10406, 2021. 14\n\n\n## Weakness 3: Detailed analysis on group variability.\n\n\n\nWe appreciate your suggestion to provide a more detailed analysis among different demographic groups to add depth to our analysis.\n\nExploring robustness variability among demographic groups is crucial for mitigating biases in facial recognition systems. Studies like [Klare, 2012] and [Deb, 2020] have shown that factors such as age and race can affect recognition accuracy.\n \n\nWe have found an evidence for the facial recognition system has less elder faces in training data.  [Meade, R. 2021] found that the majority of models that perform gender classification are trained on the most popular actors and actresses sourced from Wikipedia and IMDB. As this is a celebrity dataset, most celebrities appear much younger than someone of the same age who is not a celebrity - creating a bias towards classifying older people.\n\n\n\n\n\n\nWe will add this discussion in the revised version.\n\nReferences:\n\n[1] Klare, Brendan F., et al. \"Face recognition performance: Role of demographic information.\" *IEEE Transactions on Information Forensics and Security*. 2012.\n\n[2] Deb, Debayan, et al. \"Face Recognition Performance: Role of Demographic Information on Consumer- to Organizational-Level Applications.\" *IEEE Transactions on Information Forensics and Security*. 2020.\n\n[3] Meade, R., Camilleri, A., Geoghegan, R., Osorio, S., & Zou, Q. (2021). Bias in machine learning: how facial recognition models show signs of racism, sexism and ageism.\n\n\n## Weakness 4 & Question 4: Stability of grid search in calibration ?\n\nThank you for your feedback on the calibration process. While grid search for optimizing temperature parameters might seem ad-hoc, it is widely used and accepted in state-of-the-art research.\n\nSeveral recent studies have used grid search for calibration due to its simplicity and effectiveness. [Guo et al., 2017] optimize temperature scaling for neural network outputs, forming a foundational reference for modern calibration techniques. Similarly, [Kumar et al., 2019] use grid search to optimize calibration parameters, demonstrating its utility for reliable uncertainty estimates.\n\nGrid search is simple and effective under time constraints. Advanced techniques require significant resources and may not yield much better results. A systematic study with these techniques could strengthen our framework for future work.\n\nReferences:\n\n[1] Guo, Chuan, et al. \"On calibration of modern neural networks.\" *International Conference on Machine Learning*. 2017.\n\n[2] Kumar, Ananya, et al. \"Verified uncertainty calibration.\" *Advances in Neural Information Processing Systems*. 2019.\n\n\n\n\n## Weakness 5 & Question 3: Scalability and computational efficiency on large datasets/models?\n\nTo address the question on the scalability of the GREAT Score framework, we conducted experiments using three ResNets, varying dataset sizes from 500 to 2000 images. We recorded the computation times in ms without employing any attack mechanisms.\n\n\n| Dataset Size  | ResNet50  | ResNet101  | ResNet152  |\n|-------------------|---------------|----------------|----------------|\n| 500               | 3274       | 6251       | 9149        |\n| 1000              | 6529       | 12528      | 18339       |\n| 1500              | 9785       | 18838      | 27481       |\n| 2000              | 12960      | 24917      | 36588       |\n\nThe results show a linear increase in computation time with increasing dataset size and model complexity. More complex models like ResNet152 took proportionally more time than simpler ones like ResNet50.\n\nThis linear scalability demonstrates that the GREAT Score  efficiently handles larger datasets and more complex models, making it suitable for large-scale applications. \n\n\n\n## Question 2: Impact of generative model quality ? \n\n\nYes, we thank the reviewer for pointing out this question, actually, we have done an Ablation study on GANs and DMs. Evaluating on CIFAR-10, Figure 3 compares the inception score (IS) and the Spearman’s rank correlation coefficient between GREAT Score and RobustBench on five GANs and DDPM. One can observe that models with higher IS attain better ranking consistency.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JtYfeZJDfF", "reviewer": "Reviewer_D3uH", "summary": "The authors propose the GREAT score that uses conditional generative models to mimic the data generating distribution. Thereafter, the classification margin on a set of generated images can be used to obtain a global robustness score. For this, the authors make the connection between local and global robustness explicit and show that the classification margin yields a lower bound on the robustness w.r.t. L2 perturbations (convolution with Gaussian). The authors empirically validate their GREAT score on various benchmarks and highlight the strong correlation to other common robustness evaluations while reducing the computational cost for the robustness evaluation significantly.", "questions": "1. Figure 2 shows a large gap between empirical attacks (upper bound) and the GREAT score (lower bound). To what extent do the authors expect this gap to be due to the looseness of the respective upper and lower bounds?\n1. How is the class label (input of conditional generative model) distributed in the experiments for calculating the GREAT score?\n1. Would it also be possible to derive guarantees for a subset of the data distribution's support? For example, obtaining class-specific average robustness guarantees?", "limitations": "The authors sufficiently addressed the limitations (except for the weaknesses stated above).", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors propose an efficient procedure to rank the robustness of models using generative models\n1. GREAT can be used with \"off-the-shelf\" generative models and does not require specialized training etc.\n1. GREAT does not require access to the gradient\n1. The paper is well-written and easy to follow", "weaknesses": "1. There are several assumptions on the generative model that are not sufficiently/prominently enough covered. The assumptions are: (a) the model generates an instance actually belonging to the conditioned class, (b) the true class is unambiguous (e.g., conversely, there might be cases where the \"Bayes optimal\" model cannot decide between two or more classes). (c) the generative model is a good approximation of the true data-generating distribution. The authors should highlight such limitations more and their implications for the guarantees/method.\n1. Since the authors emphasize the guarantee on the average robustness of a model, the authors could elaborate more on the practical importance of such a guarantee\n1. The derived Lipschitz constant might be a loose estimate since the Lipschitz constant also includes the generative model and not only the neural network. This is not accurately reflected in, e.g., Eq 10. Here it seems the model was convolved with the Gaussian ($g' * N(0,1))$), but it should actually be $((g' \\circ G) * N(0,1))$.\n\nMinor:\n- The font size in figures and tables is very small", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your detailed and constructive comments, and we are encouraged that you find our work “well written, easy to follow”.\n\n\n## Weakness 1: Generative model limitations: (a) valid class instance, (b) unambiguous class, (c) data approximation. \n\n\nThank you for your feedback regarding the assumptions on the generative model. We would like to specify how to ensure these points:\n\n(a) We acknowledge that the performance of our metric relies on the generative model's capability to produce samples belong to the conditioned class. Recent studies ([Nicolas, 2021] and [Tengyuan Liang, 2021]) have shown GANs' convergence to true data distributions under specific conditions. Moreover, Figure 3 shows high-quality instances produced by the generative models, as evidenced by the inception score and the Spearman's rank correlation between the GREAT Score and RobustBench.\n\n\n(b) We recognize that there may be instances where the true class is ambiguous, potentially impacting the performance. Given that our focus is on evaluating the robustness of classifiers, it is important to note that the labels we use are typically well-defined and distinctive. When two classes exhibit ambiguity, determining their robustness is a separate issue that needs to be addressed before applying our  method. Consequently, we consider the issue of label ambiguity to be outside the scope of our method.\n\n(c) We understand that the assumption of the generative model being a good approximation of the true data-generating distribution is crucial. Recent work has demonstrated the convergence rate of approaching the true data distribution for a family of GANs under certain conditions. Please refer to Appendix A.2 for more details.\n\n\nReferences:\n\nNicolas Schreuder, Victor-Emmanuel Brunel, and Arnak Dalalyan. Statistical guarantees for generative models without domination. In Algorithmic Learning Theory, pages 1051–1071. PMLR, 2021. 14\n\nTengyuan Liang. How well generative adversarial networks learn distributions. The Journal of Machine Learning Research, 22(1):10366–10406, 2021. 14\n\n\n\n## Weakness 2: Importance of robustness guarantee.\n\n\n\nWe appreciate your feedback regarding the importance of our score. Our method is a form of certified robustness, a concept well-utilized by [Tramer, F. 2020] and [Pintor, M. 2022], and recognized as a secure way for validating defenses. Many empirical defenses were soon to be broken by advanced attacks because they were not certified to be robust. Additionally, our score can be used for robustness ranking across different models, as discussed in our paper. This ranking allows for comparison of the resilience of models against adversarial attacks.\n\n\n1. Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020). On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33, 1633-1645.\n\n2. Pintor, M., Demetrio, L., Sotgiu, A., Demontis, A., Carlini, N., Biggio, B., & Roli, F. (2022). Indicators of attack failure: Debugging and improving optimization of adversarial examples. Advances in Neural Information Processing Systems, 35, 23063-23076.\n\n\n## Weakness 3: Equation Clarification.\n\nThank you for your insightful comment. We would like to clarify that, as defined in Equation 9, $g'$ is inherently linked with the Gaussian distribution through the generative model $G(\\cdot)$. Therefore, the formulation $(g' \\circ G) * N(0, I)$ is indeed consistent with our definitions. The inclusion of $g'$ with the Gaussian reflects the model's behavior in the context of our robustness analysis. We believe this captures the relationship and does not undermine the integrity of our Lipschitz constant estimation.\n\n## Weakness 4: Small fonts.\n\nWe appreciate your feedback regarding the small font size. We will increase the font size in the next version to enhance readability.\n\n\n\n\n## Question 1: Gap between empirical attacks and GREAT score?\n\nWe thank the reviewer for bringing up this discussion. We believe your concern can be addressed by comparing empirical versus certified robustness. AutoAttack does not guarantee the absence of undiscovered adversarial examples when it fails, a common limitation of empirical robustness evaluation. In contrast, our score provides a certified robustness guarantee, ensuring no adversarial examples exist within the certified perturbation range. Therefore, the gap between our certified curve and AutoAttack's empirical curve does not imply our method's ineffectiveness; it could indicate undiscovered adversarial examples at higher perturbation radii. Without sound and complete attacks that confirm no adversarial examples exist if they fail, we cannot rule out the possibility of hidden adversarial examples in these high-radii regimes, as highlighted by certified robustness analysis.\n\n\n\n## Question 2: Label distribution?\n\n\nWe appreciate the reviewer's insightful idea. We utilize a conditional generative model to generate samples based on class labels. The class labels are uniformly distributed.\n\n\n\n## Question 3: Class-specific robustness?\n\n\nThank you for the insightful question. We acknowledge that deriving guarantees for subsets of the data distribution is important to explore.\n\nOur current work focuses on evaluating model robustness over the entire data distribution. Given our capability to perform class-specific generation, we can indeed measure class-specific robustness guarantees. By generating samples specific to each class, we can evaluate how robust the model is against adversarial attacks targeting particular classes, thereby evaluating  class-specific robustness .\n\nActually, we have performed a similar analysis to evaluate group-level robustness for facial recognition. This method can be extended to derive class-specific robustness guarantees. Table 4 in our paper displays the group-level GREAT Score results. Our evaluation reveals interesting observations: Most APIs  exhibit a large discrepancy in scores between \"Old\" vs. \"Young\" groups.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EZ5SXm1SaK", "reviewer": "Reviewer_P6PA", "summary": "This paper presents an innovative adversarial robustness measure, which leverages a generative model to produce data samples, record the marginal confidence score as a local statistic and average them over the data distribution. The proposed measure is designed to be efficient, scalable, and potentially applicable to unknown data distributions. Empirical validation is conducted using local models and commercial inference APIs, demonstrating the utility of the robustness evaluation.\n\nThe concept introduced in this study is commendable for its originality, and the metric indeed offers valuable insights into model robustness. Nonetheless, it requires substantial revisions to enhance its clarity, presentation, and justification of claims before it can be accepted.", "questions": "1. The paper omits discussion of several significant works that evaluate model robustness from different perspectives. The authors should consider addressing the following studies in the related works section:    \n   [1] \"How many perturbations break this model? evaluating robustness beyond adversarial accuracy.\" Olivier, Raphael, and Bhiksha Raj. International Conference on Machine Learning. PMLR, 2023.    \n   [2] \"Probabilistically robust learning: Balancing average and worst-case performance.\" Robey, Alexander, et al. International Conference on Machine Learning. PMLR, 2022.    \n   [3] \"Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume.\" Guo, Ping, et al. arXiv preprint arXiv:2403.05100 (2024).\n\n2. While the paper presents test results on the original test samples on CIFAR-10 in Table 9,  it does not provide results for the ImageNet dataset. The authors should explain this choice and consider including ImageNet results for a more comprehensive comparison.", "limitations": "See weakness and questions.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 4, "strengths": "1. The metric introduced is a pioneering approach for assessing model robustness, characterized by its attack-independence, scalability, and potential applicability to unknown data distributions.\n2. A theoretical analysis is provided, establishing that the metric serves as a lower bound for the probabilistic minimum adversarial perturbation.\n3. The practicality of the proposed measure is supported by experimental validation on commercial black-box APIs.\n4. There is a demonstrated strong correlation between the proposed metric and robust accuracy, suggesting the metric's effectiveness.", "weaknesses": "1. Presentation issues that may lead to confusion include:  \n   (1) The second paragraph of introduction lacks a precise definition of adversarial robustness evaluation, which could be problematic for less experienced readers.   \n   (2) Putting the testing algorithm in the appendix hurts the coherence of the paper. It would be better to include it in the main text.     \n   (3) Figure 2 requires additional clarification to elucidate how robust accuracy (RA) and the proposed metric are integrated into the same plot. Current discussion is insufficient. \n\n2. The generative model's training requires at least partial knowledge of the data distribution. So the claim that the proposed metric can scale to unknown data distribution needs justification.\n\n3. The metric's performance is contingent on the generative model's capacity to produce benign samples, yet no guarantee is provided that the generative model's ability to do so.\n\n4. The endeavor to train a generative model to produce benign samples should be considered in making it a cost-effective and scalable solution. Maybe this metric can consider online learning to update the generative model. Hope a discussion can be provided on this.\n\n5. The claim regarding the limitation to white-box settings (Page 2, Line 56) is inaccurate, as adversarial accuracy can also be assessed in black-box scenarios, evidenced by the effectiveness of the Square Attack method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We express sincere gratitude for your constructive and detailed comments.\n\n\n## Weakness 1:  Definition of adversarial robustness； Algorithm in appendix reduces coherence; Clarification on Figure 2.\n\n\n\n（1） We apologize for the lack of  definition. To clarify, adversarial robustness evaluation refers to the process of assessing a model's resilience against adversarial attacks, which are inputs intentionally designed to deceive the model. We will include it  in the next version .\n\n（2） Due to space limitations, we placed the algorithm in the appendix. However, we understand your concern about coherence and will move it to the main text in the next version.\n\n（3）To clarify how RA and the GREAT Score are integrated into Figure 2, we provide the additional details:\n\n1. Auto-Attack RA: RA at each perturbation level is the fraction of correctly classified samples under perturbation. GREAT Score RA: Cumulative RA at each perturbation level is the fraction of samples with GREAT Scores above that level.\n\n2. Blue curve: RA from empirical Auto-Attack. Orange curve: RA from GREAT Score, providing a certified robustness guarantee.\n\n3. Trend similarity suggests GREAT Score reflects empirical robustness. The gap indicates the difference between certified and empirical robustness, not necessarily GREAT Score's inferiority, but possible undetected adversarial examples at higher perturbations.\n\n\n\n\n\n## Weakness 2: Unknown data distribution.\n\n\n\n\nThank you for your insightful comment. By \"unknown\" data distribution, we mean the true data distribution is unknown (e.g., the data distribution of all nature images). In practice, one trains a generative model to learn this unknown function. The aim of the generative model to serve as a proxy for the true data distribution. In the Appendix A.2, we provide an explanation of how the generative model can effectively match the true data distribution. This justification supports our claim that the proposed metric can scale to unknown data distributions, which is also an aim for current state-of-the-art image generative models.\n\n\n\n## Weakness 3: No guarantee on producing benign samples.\n\n\n\nWe acknowledge that the performance of our metric depends on the generative model's ability to produce benign samples. Our approach assumes the use of high-quality GANs. \n\n- **Ablation Study**: As demonstrated in our ablation study, using GANs with better generative quality improves the ranking coefficient, indicating stronger performance of the robustness metric.\n- **Theoretical Support**: In Appendix 2, we discuss how GANs can provably match the data distribution, providing a theoretical foundation for their use in our approach.\n\n\n\n\n\n\n## Weakness 4: Training and online learning for Generative Models.\n\n\nThank you for your valuable suggestion. Our ablation study indicates that improving the quality of the generative model significantly enhances the ranking correlation. Therefore, we definitely need better generative models. Currently, we are using off-the-shelf generative models, but we will consider incorporating online learning techniques to further improve their performance.\n\n\n\n## Weakness 5: Limitation to white-box settings.\n\nThank you for highlighting this important distinction. However, we would like to clarify that our discussion on limitations pertains specifically to the evaluation of attack-independent robustness, which we stated is limited to white-box settings. We acknowledge that adversarial accuracy can indeed be assessed in black-box scenarios, as demonstrated by methods like Square Attack. \n\n\n\n\n## Question 1: Omission of works on robustness evaluation.\n\n\nThank you so much for recommending the related works we need , we will add them in next version. Below is the added content.\n\n\nIn addition to discussed works, several studies evaluate model robustness differently. [Olivier 2023] introduce adversarial sparsity, quantifying the difficulty of finding  perturbations, providing insights beyond adversarial accuracy.  [Robey et al. 2022] propose probabilistic robustness, balancing average and worst-case performance by enforcing robustness to most perturbations, better addressing trade-offs. [Guo et al. 2024] introduce the adversarial hypervolume metric, a comprehensive measure of robustness across varying perturbation intensities.\n\n\n[1] \"How many perturbations break this model? evaluating robustness beyond adversarial accuracy.\" Olivier, Raphael, and Bhiksha Raj. International Conference on Machine Learning. PMLR, 2023.\n[2] \"Probabilistically robust learning: Balancing average and worst-case performance.\" Robey, Alexander, et al. International Conference on Machine Learning. PMLR, 2022.\n[3] \"Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume.\" Guo, Ping, et al. arXiv preprint arXiv:2403.05100 (2024).\n\n\n## Question 2: Results on the original test samples on ImageNet.\n\n\n\nFollowing the reviewer's suggestion, we conducted an additional experiment using 500 test samples from the original ImageNet dataset, with image dimensions of 224x224 pixels, and reported their GREAT Scores in the table below. However, it is important to note that unless these test samples are generated by a generative model, they may not fully represent the data distribution captured by such a model. The correlation between the GREAT Score ranking and the RobustBench ranking remains consistent with the results observed on the generated samples.\n\n\n| Model  | RobustBench Accuracy (%) | AutoAttack Accuracy (%) | GREAT Score |\n|------------|---------------------------|-------------------------|-------------|\n| Trans1 | 38.14                     | 56.0                   | 0.58    |\n| Trans2 | 34.96                     | 50.2                 | 0.48      |\n| LIBRARY | 29.22                    | 50.6                  | 0.49      |\n| Fast   | 26.24                     | 39.4                    | 0.41     |\n| Trans3 | 25.32                     | 39.8                   | 0.32      |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We appreciate the valuable feedback from the reviewers . Below is a high-level summary of our rebuttal, addressing the major concerns raised:

###  Performance and reliability of the generative model




* **Concern:** The reviewers were concerned about the dependency of our metric on the generative model's ability to produce samples that truly belong to the conditioned class, and whether generative models can appoximation to true data distribution. Besides , the reviewers also wonder theoretical bound on distribution gap and its effect on utility
* **Response:** We have provided related liteature proving the convergence rate of GANs in approximating true data distributions. We have also mentioned more details can be found in Appendix A.2.  We have reiterated the positive correlation between generative model quality and GREAT Score effectiveness, supported by our ablation study shown in Figure 3.


### Experimental Validation

* **Concern:** The reviewers requested additional evidence to support the effectiveness of our approach on Imagenet, scalability to large datasets/models, and comparison with other estimators.
* **Response:** We have provided further experimental results and comparisons with local estimators to demonstrate the robustness and reliability of our method. We also conducted an additional experiment on 500 test samples from the original ImageNet dataset and reported their GREAT scores, confirming the consistency of the correlation between the GREAT score ranking and the RobustBench ranking. We also perform experiments on different ResNets and dataset sizes to demonstrate the time efficiency of our method.

###  Practical Applications of Our Score.

* **Concern:** Reviewers highlighted  practical applications of our method and asked comparasion between our method and Auto-Attack.
* **Response:** We  discussed the practical significance of our score as a lower-bound guarantee of robustness to attacks, useful for robustness ranking and informed model selection.

### Methodological Improvements and Future Directions

* **Concern:** Reviewers suggested exploring other norms and discussed the scalability of our approach.
* **Response:** We acknowledged the limitation of our current framework to the L2 norm and highlighted this as a potential future research direction.

### Demographic and Class-Specific Analyses

* **Concern:** The reviewers emphasized the importance of demographic group analysis and class-specific robustness.
* **Response:** We clarified the hidden reason for different robustness among groups in gender classification. We metioned we can be extend our Score to derive class-specific robustness guarantees. We also specified the uniform distribution of class labels used in our experiments to ensure fairness and reliability.

###  Omitted Works

* **Concern:** Reviewers  recommended additional relevant works.
* **Response:**  We thanked the reviewer for recommending relevant works and committed to including them in the revised manuscript.


### Clarity and Presentation

* **Concern:** The clarity and presentation of certain sections were highlighted as areas for improvement.
* **Response:** We have revised the manuscript to enhance clarity and readability. Specific sections have been rewritten for better comprehension, and additional explanations have been included where necessary. We also clarified the definition and inclusion of the Lipschitz constant in our analysis, ensuring consistency with our framework. Feedback on font size has been acknowledged, and we committed to increasing it in the revised manuscript.



We believe that these changes have significantly strengthened our manuscript and addressed the reviewers' concerns. We hope that the paper is now suitable for publication.

Meta-review: This paper is on evaluating adversarial robustness. There are three limitations of current evaluation methods:
- The evaluation is often limited to a fixed test dataset, which does not capture robustness on the global data distribution.
- The evaluation is often limited to white-box settings where input gradients are required.
- The evaluation may require lots of computation.

This paper proposes a “GREAT score” to address these three limitations. First, they use a generative model to approximate the unknown data distribution. Second, their evaluation method only requires forward passes (as shown in Eqn. (3)) and is useful when only black-box access is available. Third, the evaluation can use pretrained generative models, which reduces the computational burden. Furthermore, each data point for evaluation only requires one forward pass.

On the theory side, this paper shows that GREAT score corresponds to a lower bound on the robustness radius to L2 attacks. They also showed a formal probabilistic guarantee on the finite-sample performance of GREAT score. On the empirical side, the paper provides extensive evaluations using RobustBench and shows reductions in computation time, sometimes up to 2000 times.

The paper provides a novel approach to evaluate adversarial robustness effectively. It is fast, has theoretical guarantees, and is aligned with existing robustness evaluations based on the experiments on RobustBench. Several reviewers commented on the clear writing of the paper.

The authors were able to address most reviewers’ concerns. Unfortunately, one of the reviewers did not engage in the discussions. However I can see that most of their concerns are appropriately addressed. The reviewers gave several valuable suggestions to improve the current evaluations, such as ablating more hyperparameter search methods in the calibration process and discussing the quality of generative models and their effect on the evaluation of robustness.
Decision: Accept (poster)