A Neural Architecture Dataset for Adversarial Robustness

Authors: Bowen Zheng, Ran Cheng, Shihua Huang, Zhichao Lu, Vishnu Boddeti
Primary area: datasets and benchmarks
Keywords: Adversarial robustness, neural architecture design

Abstract:
Robustness to adversarial attacks is critical for practical deployments of deep neural networks. However, pursuing adversarial robustness from the network architecture perspective demands tremendous computational resources, thereby hampering progress in understanding and designing robust architectures. In this work, we aim to lower this barrier-to-entry for researchers without access to large-scale computation by introducing the first comprehensive neural architecture dataset under adversarial training, dubbed NARes, for adversarial robustness. NARes comprises 15,625 WRN-style unique architectures adversarially trained and evaluated against four adversarial attacks (including AutoAttack). With NARes, researchers can query the adversarial robustness of various models immediately, along with more detailed information, such as fine-grained training statistics, empirical Lipschitz constant, stable accuracy, etc. In addition, four checkpoints are provided for each architecture to facilitate further fine-tuning or analysis. For the first time, the dataset provides a high-resolution architecture landscape for adversarial robustness, enabling quick verifications of theoretical or empirical ideas. Through NARes, we offered some new insight and identified some contradictions in statements of prior studies. We believe NARes can serve as a valuable resource for the community to advance the understanding and design of robust neural architectures.

Decision: reject
Reviewer scores: 6, 5, 6, 5

Reviews and discussion:
<thread>
creation date:
1729926659401

thread_type:
official_review

<thread_object>
creator: reviewer_gkqb

<content>
summary:
The paper presents NARes, a novel dataset of 15,625 unique neural network architectures based on Wide Residual Networks (WRNs), designed to assess adversarial robustness. The dataset includes detailed adversarial training statistics and evaluations against four adversarial attacks, including AutoAttack. The authors claim that NARes offers new insights into adversarial robustness and identifies contradictions in previous studies.

strengths:
1. The initiative to create a comprehensive dataset for adversarial robustness is laudable.
2. The dataset's focus on a wide range of architectures is a valuable contribution to the field.

weaknesses:
1. The paper lacks clarity in explaining key terms and abbreviations, which is detrimental to the readability and accessibility of the research, such as MACs, PGD^20, and PGD-CW^40.
2. The absence of the code and dataset at the time of submission limits the ability of the community to engage with and validate the work.
3. There is a lack of detailed experimental procedures, which is essential for the reproducibility of the findings.
4. The paper would benefit from a clearer structure to better guide the reader through the research and its implications.
5. The establishment of a leaderboard for benchmarking could significantly enhance the utility of the dataset, which is currently missing.

questions:
See weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730229376406

thread_type:
official_review

<thread_object>
creator: reviewer_vzb3

<content>
summary:
The authors propose a new benchmark for architecture search of adversarially robust networks. They evaluate various depth and width settings in WideResNet. They also benchmark various architecture search algorithms on their benchmark.

strengths:
-- This is a well-motivated paper as far as I can tell. Robustness to adversarial attacks is clearly an important problem, to which architecture search is an important component. 

-- I find the paper to be sound in terms of discussions of related work. Throughout the paper there is clear references both to the adversarial defense literature and the NAS literature. They also provide clear arguments for the distinctiveness of their method compared to prior NAS benchmarks.

-- The experimental setup appears to be sound and the benchmarking extensive. I find the experiments on the empirical Lipschitz constant to be interesting and against the convention that increasing depth would increase the Lipschitz constant. I believe the authors should consider discussing this connection more, especially in relation to the learning theory literature (for example, the Lipschitz constant can be related to the Frobenius norm of the weight matrices, and in turn related to generalization).

-- The connections between adversarial robustness and the Lipschitz constant are not surprising, but is an important empirical finding especially since the paper studies it systematically for the given architecture family in terms of depth, width. Similarly their findings on depth-width ratio are informative and will be of interest to the NAS community.

weaknesses:
-- The focus on WRN-style architectures, while it makes sense practically, may limit the generalizability of findings to other architectures. For example, aspects like width and depth and their relationship to adversarial robustness may differ across architectures. Vision transformers are a very popular architecture, for example, and one could imagine that they may behave differently. 

-- Similarly, the empirical evaluation is only on CIFAR-10. While I understand ImageNet can be expensive (especially for adversarial training), there are several other datasets that are of similar training time e.g. CIFAR-100, TinyImageNet. For this reason and the one above I'm not sure if the benchmark would "catch on".

questions:
-- How do you plan to keep the benchmark relevant as new architectures emerge?

-- What is the roadmap towards new architectures and datasets? Will it be open to the community or do you expect to run them yourselves? Why would someone from the community contribute to it? For example, in typical benchmarks you expect researchers with competing methods to be incentivized to contribute. Who would be incentivized to contribute these kind of extensive NAS comparisons?

Basically I want to know why you expect this benchmark will catch on.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730356642141

thread_type:
official_review

<thread_object>
creator: reviewer_jlna

<content>
summary:
This paper focuses on a valuable topic, namely, the robustness of the models. The main contribution of this paper lies on the proposed NARes dataset. This dataset is constructed for investigating the relationship between the model robustness and model architectures. NARes comprises 15,625 WRN-style architectures adversarially trained and evaluated against various adversarial attacks, such as AutoAttack. The authors provide extensive experimental results and meaningful observations.

strengths:
1. The focused topic is valuable. Model robustness is of great significance in practical deep learning.
2. The scale of the proposed method is quite satisfactory. This paper constructs a large scale dataset that consists of 15,625 different model architectures and 62500 checkpoints in total.
3. The statement is clear and accurate. The organization and the writing of this paper is satisfactory that make the reader easily understand the core idea and meaningful conclusions.

weaknesses:
My biggest concern to this work is its novelty. As far as I know, the RobustArt has not only investigated the relationship between the model architecture and robustness, but also investigated the features among model architectures, the training techniques, the adversarial noise robustness, the natural noise robustness, and the system noise robustness, which in fact takes the first step in this area. Compared with the RobustArt, the strengths of this study could only appear in the dataset scale and fine-grained factors, e.g., the width, depth. #MACs, and LIP of WRNs. I believe this study is meaningful and valuable, but it seems this study is more likely to be a star project in the open-source area. By the way, the statement about the RobustArt in section 2.3 appears to be misleading.

questions:
(1) Plz carefully clarify the differences between this study and the RobustArt in the perspective of novelty.
(2) It could be more acceptable to provide some overall information, such like a leaderboard.
(3) This is quite a good work, but the open-source link is not provided.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731183202247

thread_type:
official_review

<thread_object>
creator: reviewer_hpsi

<content>
summary:
This paper spend tons of GPU resources to construct a huge benchmark on the relation between WRN architecture design and adversarial robustness. Specifically, the authors varied the depths and widths of WRN and used PGD-based adversarial training on CIFAR-10 dataset to get the adversarial robustness of the model architecture. 

Several interesting observations are found based on the benchmark results, which may benefit further research. I have concerns on whether those findings generalize to other model architectures beyond WRNs and CIFAR-10. 

The benchmark should be very welcomed by the NAS community, as a new benchmark for searching robust model architectures. I'm not sure how the benchmark could help wider communities, since the WRN + CIAFR-10 image classification + PGD adversarial training is only a very narrow scope in terms of robust machine learning. More advanced model architectures, larger-scale datasets, and tasks with better practical applications are missing in the current benchmark design.

strengths:
1. Tons of GPU resources are generously spent to build the new benchmark. 

2. The observations from the benchmark results are all very interesting and may inspire future works. 

3. The benchmark should be very beneficial to the NAS community to design better search algorithms for robust model architectures.

weaknesses:
My main concern is that the benchmark only covers a tiny scope in the field of robust machine learning. 
Specifically, the authors adopted the setting of WRN + CIAFR-10 image classification + PGD adversarial training, without very convincing justification. 
I'm aware that many previous adversarial training papers used similar settings. However, as a benchmark paper, it requires more attention, much more than papers proposing new algorithms, when it comes to designing the experiment settings, on which tons of resources will be spent. 
In my point of view, the WRN is not the best choice for image classification tasks, or as the backbone of detection and segmentation tasks, in year 2024. For applications running on cloud servers or where computation resources are not a constraint, large transformer-based models are dominant in terms of both clean accuracy and robustness under distributional shifts. For edge-device or other resource constrained devices, efficient vision transformers are dominant (e.g., [1]). Although these models are actually pure CNN models replacing the expensive multi-head self-attention with cheap token mixers like depth-wise convolution, their design of global architectures are very different with WRNs. They use the alternate token-mixer and channel-mixer design inspired by transformers. It is concerning if the conclusions from the benchmark do not generalize to these more advanced architectures. 
These transformer and efficient transformer models have also dominated applications such as object detection and segmentation, which have better practical applications than image classification, which leads to my second concern on the choice of the task in the benchmark. I'm fully aware that adversarial training papers typically adopt image classification as the primary benchmark task. But when it comes to real-world applications that requires high-level security, such as autonomous driving and security surveillance, detection and segmentation are more heavily used. As a benchmark paper, it would be good to focus not only on one single task, but on more tasks, especially those with more practical applications. My third concern is that the benchmark only adopts PGD-adversarial training (PGD-AT) as the defense method. It is not clear if the conclusions from PGD-AT generalizes to other defense methods (e.g. TRADE).

[1] FastViT: A Fast Hybrid Vision Transformer using Structural Reparameterization.

questions:
Please see above.
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper presents NARes, a large-scale dataset comprising 15,625 WideResNet (WRN)-style architectures designed to explore the relationship between neural architecture and adversarial robustness. While the work addresses an important topic and showcases significant computational effort, it ultimately falls short of acceptance due to limitations in scope, novelty, and practical impact.

The primary contribution of this work lies in the creation of NARes, which includes adversarially trained architectures evaluated against various attacks, such as AutoAttack, and provides detailed statistics like Lipschitz constants and stable accuracy metrics. The dataset aims to facilitate research on adversarial robustness by offering a comprehensive and fine-grained resource. The authors claim that NARes can help researchers derive new insights and verify existing theories in this domain.

The strengths of the paper include its focus on an important topic, adversarial robustness, which is critical for real-world machine learning applications. The extensive computational effort behind training and evaluating a large number of architectures is commendable and demonstrates a commitment to thorough empirical evaluation. Furthermore, the fine-grained dataset and the rich diagnostic information provided for each architecture could inspire further studies and theoretical advancements in the field. The paper is also well-structured, making it easy for readers to follow its main contributions and conclusions.

However, the paper has notable weaknesses that undermine its overall impact. First, the scope of NARes is narrow, as it focuses exclusively on WRN architectures trained on CIFAR-10 using PGD-based adversarial training. This limited focus raises questions about the generalizability of its findings to other architectures, datasets, and tasks. For example, modern architectures like vision transformers (ViTs) dominate many applications and may exhibit significantly different robustness characteristics. Additionally, CIFAR-10, while computationally convenient, is insufficient for assessing real-world applicability, and alternative datasets such as CIFAR-100 or TinyImageNet could have provided more diversity. Second, the paper’s novelty is limited compared to existing works like RobustArt, which explores similar topics but with broader architectural and methodological scope. While NARes provides finer-grained data and a larger scale, it does not introduce fundamentally new ideas or methodologies that significantly advance the field.

The practical utility of the dataset also remains uncertain. The absence of a leaderboard or clear benchmarks reduces its immediate appeal to the community, and the dataset’s availability only after acceptance limits engagement and validation opportunities. Furthermore, the authors do not convincingly justify why WRN-style architectures and the specific adversarial training method used were chosen, other than their simplicity. This choice could limit the dataset’s applicability to a broader range of research contexts, such as real-world tasks like object detection or segmentation, where robustness is crucial. The authors' response that NARes serves as a foundational dataset rather than a direct benchmark does not fully address these concerns, as it still restricts its relevance and adoption in practical scenarios.

In summary, while the paper demonstrates commendable effort in dataset construction and provides a potentially useful resource for certain niche applications, it fails to meet the standards of generality, novelty, and utility required for acceptance at a top-tier venue. The dataset’s narrow focus, limited generalizability, and incremental contributions relative to existing works do not justify its inclusion. To address these issues, the authors would need to extend the scope of their analysis to include more diverse architectures, datasets, and tasks, as well as provide more compelling evidence of NARes’s broader impact. Thus, the recommendation for this submission is rejection.