Zero-cost Proxy for Adversarial Robustness Evaluation

Authors: Yuqi Feng, Yuwei Ou, Jiahao Fan, Yanan Sun
Primary area: other topics in machine learning (i.e., none of the above)
Keywords: Neural Architecture Search, Adversarial Robustness, Zero-cost Proxy

Abstract:
Deep neural networks (DNNs) easily cause security issues due to the lack of adversarial robustness. An emerging research topic for this problem is to design adversarially robust architectures via neural architecture search (NAS), i.e., robust NAS. However, robust NAS needs to train numerous DNNs for robustness estimation, making the search process prohibitively expensive. In this paper, we propose a zero-cost proxy to evaluate the adversarial robustness without training. Specifically, the proposed zero-cost proxy formulates the upper bound of adversarial loss, which can directly reflect the adversarial robustness. The formulation involves only the initialized weights of DNNs, thus the training process is no longer needed. Moreover, we theoretically justify the validity of the proposed proxy based on the theory of neural tangent kernel and input loss landscape. Experimental results show that the proposed zero-cost proxy can bring more than $20\times$ speedup compared with the state-of-the-art robust NAS methods, while the searched architecture has superior robustness and transferability under white-box and black-box attacks. Furthermore, compared with the state-of-the-art zero-cost proxies, the calculation of the proposed method has the strongest correlation with adversarial robustness. Our source code is available at https://github.com/fyqsama/Robust_ZCP.

Decision: accept (poster)
Reviewer scores: 6, 6, 6

Reviews and discussion:
<thread>
creation date:
1730475849220

thread_type:
official_review

<thread_object>
creator: reviewer_kdep

<content>
summary:
This paper introduces a zero-shot proxy applied directly to the initial weights of a deep neural network (DNN), serving as an upper bound for adversarial loss. This approach enhances the adversarial robustness of the network without requiring adversarial examples. Theoretical justification for the zero-shot proxy is provided based on the Neural Tangent Kernel (NTK) and the input loss landscape. Experimental results demonstrate a 20x speedup over state-of-the-art robust neural architecture search (NAS) methods, with no loss in performance against black-box and white-box attacks.

strengths:
+ The preliminaries on the Neural Tangent Kernel (NTK) and input loss landscape are clearly presented, making the methodology easy to understand. All symbols and equations are well-defined. 

+ A robust theoretical justification for the proposed zero-shot proxy is provided by establishing the corresponding loss as an upper bound for adversarial loss.

+ The efficiency of the search process using their technique is clearly demonstrated in the experimental section.

+ The authors introduce a novel dataset called Tiny-RobustBench, which may prove valuable to the research community.

weaknesses:
- In the theoretical analysis section,  $\lambda_{\min}(\hat{\Theta_{\theta_o}})$ is approximated based on empirical observations to $-\lambda_{\min}(\Theta_{\theta_o})$, which weakens the theoretical foundation of the work. I wonder if the authors could establish the relationship between the two NTKs in strict mathematical terms, such as showing that the approximation holds true within a specific margin of error with a certain probability. Currently, the analysis relies on an empirically driven approximation, which undermines its theoretical robustness.
- The performance of the black-box and white-box attacks is demonstrated using a single dataset (CIFAR-10) in Tables 1 and 2. The authors should consider providing performance comparisons across multiple datasets for the chosen baselines in both tables. Additionally, Table 2 should clearly present a comparison of search efficiency.
- I am curious about the rationale for selecting only specific models (ResNet-18 and PDARTS) for comparison in Table 3. Would it be possible to include models from Table 1 to evaluate their transferability in Table 3?
- There is inadequate justification for why their approach exhibits better transferability in Table 3. It would be beneficial to provide justification grounded in their theoretical contributions, particularly highlighting the unique advantages that their proposed techniques offer to enhance transferability.
- The authors should discuss the assumptions made in their analysis and their validity within the context of the study. For instance, when transforming from Equation 1 to Equation 3, it would be helpful to clarify the assumptions involved and how they apply in their setting. Specifically, I am uncertain whether the assumption of infinite-width DNN parameters is valid; if it is not, what implications does that have for this paper? I encourage the authors to include these details, even if they are standard, as doing so would enhance the paper's readability and facilitate the assessment process.

questions:
Please refer to Weaknesses Section
</content>
</thread_object>

</thread>
<thread>
creation date:
1730704571087

thread_type:
official_review

<thread_object>
creator: reviewer_jcgn

<content>
summary:
This paper proposes a zero-shot proxy that requires no training and depends only on the initial neural network weights to find the robust architecture. Using this zero-shot proxy reduces the neural architecture search speed drastically. Experiments are performed on multiple datasets with varying resolution and number of classes.

strengths:
- The reduction in the search cost is very significant. 
- The paper is well-written with typos.  
- From Table 3, the transferability results are good. 
- A novel dataset will be released by the authors, which will help advance research in the robust NAS direction.   
- Comparison with the latest state-of-the-art methods.

weaknesses:
- While the search cost is reduced significantly, the increase in the adversarial robustness is minimal (less than 1% in most cases for Table 1). A similar observation can be derived from the results in Table 4.    
- Minor typos: "8/2550" instead of "8/255" on line 301, "We" instead of "we" on line 63.

questions:
While the contribution in terms of speed reduction is significant for the proposed method, my concern is the increase in adversarial robustness as compared to the baselines is very minimal in the majority of the cases.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730704660053

thread_type:
official_review

<thread_object>
creator: reviewer_rbjp

<content>
summary:
This paper targets a lightweight proxy to assess the adversarial robustness of Neural Architecture Search (NAS) networks. The proposed proxy is represented as the product of two terms (Eq. 4). The first term, based on the intuition that adversarial and natural accuracy are reversely correlated, is introduced to consider adversarial accuracy and is experimentally validated. The second term is proposed through a theoretical approximation using the Neural Tangent Kernel. The proposed proxy is experimentally validated.

strengths:
- The paper is easy to read through, well presented.
- The paper proposes relatively strong method for the proxy of searching adversarially robust architectures.
- The paper includes numerous validations including performance under white-box, black-box attacks, datasets, numerous datasets, and ablation studies.

weaknesses:
1.  To read through, I felt that the paper has to focus on two points : 
- Is the proposed method superior in terms of cost-efficiency? (zero-cost)
- Is the proposed method superior in terms of robust accuracy?
- For now, RQ1 and RQ2 looks a bit similar(line 255-256), before looking at the experimental results.

2. I feel the cost-efficiency related explanation is slightly short. The authors could include detailed explanations for (line 183-185.) such as , the reason the authors chose to iterate samples over generating adversarial samples itself and why is it efficient.

questions:
- In the preliminatries, 3.1., the formulation is bit awkward; if the function $f_{\theta_t}$ is a function $\mathbb{R}^d \rightarrow \mathbb{R}$, then the output will be a single scalar, but in the equations the l2-norm calculation is applied … I also checked the reference paper (Xu et al., (2021)), but it is slightly different. 

- The overall experiments on Kendall’s tau seems to be not high (Fig.2,Fig.4). (Relatively high, but not significant in absolute terms). Can the authors explain this in further details?

- The cost analysis is done with the GPU search day metric. How is the cost calculated? Under which GPU?

[Post-Rebuttal] I have reviewed the author's rebuttal and the feedback from other reviewers. Most of my concerns have been addressed, and given the paper's contributions, I would like to maintain my current rating.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732312933865

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response

comment:
We wholeheartedly thank all reviewers for the great effort and the meticulous review. The comments and suggestions are truly impressive and helpful to enhance our paper. In response to the comments and suggestions, we have made the following updates in this revision:

+ The typo in line 63 has been fixed. [jcgN]

+ The description **in the preliminaries 3.1** is updated, in order to avoid the confusion in terms of the $L_2$-norm calculation. [rBjP]

+ More detailed explanations and discussions in terms of the cost-efficiency are added to **lines 182-190 in Section 3.1**, in order to further explain why the proposed zero-cost proxy enjoys decent efficiency. [rBjP]

+ The contents of RQ1 and RQ2 are revised to further distinguish the core points of both research questions. [rBjP]

+ The details in terms of the calculation of the GPU days metric are added to **lines 283-284 in Section 4.1.1**. [rBjP]

+ The discussion about the assumption applied to the proposed zero-cost proxy is added to **Section A.1 of Appendix**, in order to enhance the paper's readability. [kdEp]

+ The theoretical justification in terms of the validity of approximating $-\lambda_{min} (\hat{\Theta_{\theta_{0}}})$ with $\lambda_{min}(\Theta_{\theta_{0}})$ is added to **Section A.2 of Appendix** to enhance the theoretical robustness of the proposed zero-cost proxy. [kdEp]

+ Additional experimental results across various datasets under both white-box and black-box attacks are presented in **Sections B.1 and B.3 of Appendix**, respectively, to make the comparisons more comprehensive. [kdEp]

+ The results of more baseline models in terms of the transferability are added to **Section B.4 of Appendix**, along with the justification for the transferability grounded in the theoretical contributions of this paper. [kdEp]

Please note that the revised contents are highlighted in red in this version for the reviewers' convenience.
</content>
</thread_object>

</thread>


Metareview:
metareview:
All reviewers agree that the paper is (marginally) above the acceptance threshold. They highlight the proposed zero-cost proxy as a novel approach for searching adversarially robust architectures, with experimental results effectively demonstrating its efficacy. Additionally, the introduced dataset is considered a valuable contribution to the research community.
Initially, reviewers raised concerns regarding certain experimental settings, results, and methodological details. After the authors' rebuttal, all reviewers acknowledged that most concerns were adequately addressed. The recommendation is to accept the paper.