Robust Models are less Over-Confident
Anonymous Author(s)
AffiliationAddress email
Abstract
Despite the success of convolutional neural networks (CNNs) in many academicbenchmarks for computer vision tasks, their application in the real-world is stillfacing fundamental challenges.
One of these open problems is the inherent lack ofrobustness, unveiled by the striking effectiveness of adversarial attacks.
Currentattack methods are able to manipulate the network’s prediction by adding specificbut small amounts of noise onto the input.
In turn, adversarial training (AT) aimsto achieve robustness against such attacks and ideally a better model generalizationability by including adversarial samples in the trainingset.
However, an in-depthanalysis of the resulting robust models beyond adversarial robustness is still pending.
In this paper, we empirically analyze a variety of adversarially trained modelsthat achieve high robust accuracies when facing state-of-the-art attacks and weshow that AT has an interesting side-effect: it leads to models that are significantlyless overconfident with their decisions even on clean data than non-robust models.
Further, our analysis of robust models shows that not only AT but also the model’sbuilding blocks (like activation functions and pooling) have a strong influence onthe models’ prediction confidences.
Introduction
Convolutional Neural Networks (CNNs) have been shown to successfully solve problems acrossvarious tasks and domains.
However, distribution shifts in the input data can have a severe impact onthe prediction performance.
In real-world applications, these shifts may be caused by a multitudeof reasons including corruption due to weather conditions, camera settings, noise and maliciouslycrafted perturbations to the input data intended to fool the network (adversarial attacks).
In recentyears, a vast line of research (e.g. [24, 35, 43]) has been devoted to solving robustness issues,highlighting a multitude of causes for the limited generalization ability of networks and potentialsolutions to facilitate the training of better models.
A second, yet equally important issue that hampers the deployment of deep learning based modelsin practical applications is the lack of calibration concerning prediction confidences.
In fact, mostmodels are overly confident in their predictions, even if they are wrong [30, 44, 55].
Specifically,most conventionally trained models are unaware of their own lack of expertise, i.e. they are trained tomake confident predictions in any scenario, even if the test data is sampled from a previously unseendomain.
Adversarial examples seem to leverage this weakness, as they are known to not only foolthe network but also to cause very confident wrong predictions [45].
In turn, adversarial training(AT) is known to improve the prediction accuracy under adversarial attacks [22, 24, 63, 85].
Yet,a systematic synopsis of the two aspects, adversarial robustness and prediction confidence is stillpending.
In this work, we provide an extensive empirical analysis of diverse adversarially robust modelsconcerning their prediction confidences.
Therefore, we evaluate the prediction confidences of morethan 70 adversarially robust models and their conventionally trained counterparts that show low robustness when exposed to adversarial examples.
By measuring their predictive distributions onbenign and adversarial examples for correct and erroneous predictions, we show that adversariallytrained models have benefits beyond adversarial robustness and are less over-confident.
To cope with the lack of calibration in conventionally trained models, Corbière et al.
[13] propose torather use the true class probability than the standard confidence obtained after the Softmax layer,such as to circumvent the overlapping confidence values for wrong and correct predictions.
However,we observe that exactly these overlaps are an indicator for insufficiently calibrated models and canbe mitigated by the improvement of CNNs building blocks, namely downsampling and activationfunctions, that have been proposed in the context of adversarial robustness [17, 27].
Hence, our work analyzes the relationship between robust models and model confidences.
Ourexperiments on the datasets Cifar10 [42], Cifar100 and ImageNet [19] confirm that non-robustmodels are overconfident with their false predictions under adversarial attacks.
This highlights thechallenges for usage in real-world applications.
In contrast, we show that robust models are generallyless confident in their predictions, and, especially CNNs which include improved building blocks(downsampling and activation) turn out to be better calibrated manifesting low confidence in wrongpredictions and high confidence in their correct predictions.
Our contributions can be summarized as follows:
• We provide an extensive analysis of the prediction confidence of 71 adversarially trainedmodels, and their conventionally trained counterparts.
We observe that most non-robustmodels are exceedingly over-confident while robust models exhibit less confidence and
especially are better calibrated.
Thus achieving more reliable networks for real-world
applications.
• We observe that specific layers, that are considered to improve model robustness impact themodels’ confidences.
In detail, improved downsampling layers and activation functions canlead to an even better calibration of the learned model.
Our analysis provides a first synopsis of adversarial robustness and model calibration and aims tofoster research that addresses both challenges jointly
rather than considering them as two separateresearch fields.
To further promote research, we will release all re-trained models upon acceptance.
Related Work
In the following, we first briefly review the related work on model calibration which motivates ourempirical analysis.
Then, we revise the related work on adversarial attacks and model hardening.
Confidence Calibration.
For many models that perform well with respect to standard benchmarks, ithas been argued that the robust or regular model accuracy may be an insufficient metric [2, 13, 18, 77],in particular when real-world applications with potentially open-world scenarios are considered.
Inthese settings, reliability must be established which can be quantified by the prediction confidence[56].
Ideally, a reliable model would provide high confidence predictions on correct classifications,and low confidence predictions on false ones [13, 55].
However, most networks are not able toprovide a sufficient calibration instantly.
Hence, confidence calibration is a vivid field of researchand proposed methods are based on additional loss functions [31, 34, 44, 47, 50], on adaptions of thetraining input by label smoothing [52, 58, 61, 73] or on data augmentation [20, 44, 74, 86].Further,[56] present a benchmark on classification models regarding model accuracy and confidence underdataset shift.
Additionally, different evaluation methods have been provided to distinguish betweencorrect and incorrect predictions [13, 54].
Naeini et al.
[54] defined the networks expected calibrationerror (ECE) for a model f by with 0 ≤
p ≤ ∞
[Equation]
where the model f predicts ˆ y =
y with the confidence
ˆ z .
This can be directly related to theover-confidence o ( f ) and under-confidence u ( f ) of a network as follows [79]:
[Equation]
where [53]
[Equation]
i.e. the over-confidence measures the expectation of ˆ z on wrong prediction, under-confidencemeasured the expectation of 1 − ˆ z on correct predictions and ideally both should be zero.
The
ECE provides an upper bound for the difference between the probability of the prediction beingwrong weighted by the networks over-confidence and the probability of the prediction being correctlyweighted by the networks under-confidence and converges to this value for the parameter p → 0 (ineq. 1]).
We also recur to this metric as an aggregate measure to evaluate model confidence.
Yet, itshould be noted that the ECE metric is based on the assumption that networks make correct as wellas incorrect predictions.
A model that always makes incorrect predictions and is less confident in itsfew correct decisions than it is in its many erroneous decisions can end up with a comparably low
ECE.
Therefore, ECE values for models with an accuracy below 50% are hard to interpret.
Most common CNNs are over-confident [30, 44, 55].
Moreover, the most dominantly used activationin modern CNNs [33, 38, 67, 71] remains the ReLU function, while is has been pointed out by Heinet al.
[34] that ReLUs cause a general increase in the model’s prediction confidences, regardless ofthe prediction validity.
This is also the case for the vast majority of the adversarially trained modelswe consider, except for the model by [17] to which we devote particular attention.
Adversarial Attacks.
Adversarial attacks intentionally add perturbations to the input samples,that are almost imperceptible to the human eye, yet lead to (high-confidence) false predictions
ofthe attacked model [24, 51, 72].
These attacks can be classified into two categories: white-box andblack-box attacks.
In black-box attacks, the adversary has no knowledge of the model intrinsics [4],and can only query its output.
These attacks are often developed on surrogate models [10, 41, 76] toreduce interaction with the attacked model in order to prevent threat detection.
In general, though,these attacks are less powerful due to their limited access to the target networks.
In contrast, inwhite-box attacks, the adversary has access to the full model, namely the architecture, weights,and gradient information [24, 43].
Based on this information the attacker can perform extremelypowerful attacks customized to the model.
One of the earliest approaches, the Fast Gradient Sign
Method (FGSM) by [24] uses the sign of the prediction gradient to perturb input samples into thedirection of the gradient, thereby increasing the loss and causing false predictions.
This methodwas further adapted and improved by Projected Gradient Descent (PGD) [43], DeepFool (DF) [51],
Carlini and Wagner (CW) [5] or Decoupling Direction and Norm (DDN) [63].
While FGSM isa single step attack, meaning that the perturbation is computed in one single gradient ascent steplimited by some ϵ bound, multi-step attacks such as PGD iteratively search for the most effectiveperturbation in the ϵ -bound needed to change the models prediction.
These attacks generally performbetter but come at an increased cost of the attack.
Recently, AutoAttack [14], an ensemble of differentattacks including an adaptive version of PGD, was proposed as a baseline for adversarial robustness.
In particular, it is used in robustness benchmarks such as RobustBench [15].
Adversarial Training and Robustness.
To improve robustness, adversarial training (AT) hasproven to be quite successful on common robustness benchmarks.
Some attacks can be simplydefended by using their adversarial examples in the training set [24, 63] through an additional loss[22, 85].
Furthermore, the addition of more training data, by using external data, or data augmentationtechniques such as generation of synthetic data, has been shown to be promising for more robustmodels [6, 25, 26, 60, 66, 78].
RobustBench [15] provides a leaderboard to study the improvementsmade by the aforementioned approaches on robustness in a comparable manner in terms of theirrobust accuracy.
Madry et al.
[48] observed that the performance of adversarial training dependson the model’s capacity.
High-capacity models are able to fit the (adversarial) training data better,leading to an increased robust accuracy.
Later research investigated the influence on increased modelwidth and depth [25, 83].
Consequently, the best-performing entries on RobustBench [15] are oftenusing Wide-ResNets-70-16 or even larger architectures, which supports these findings.
Yet, onlyvery few but notable prior works such as [44] have investigated adversarial training with respectto model calibration.
Without providing a systematic overview, they show that AT can help tosmooth the predictive distributions of CNN models.
[75] introduce an adversarial calibration loss toreduce the calibration error.
Further, [70] propose confidence calibrated adversarial training to forceadversarial samples to show uniform confidence, while clean samples should be one hot encoded.
Complementary to [15], we provide an analysis of the predictive confidences of adversarially trained,robust models and release conventionally trained counterparts of the models from [15] to facilitatefuture research on the analysis of the impact of training schemes versus architectural choices.
Defense besides adversarial training, can be established by the detection and rejection of maliciousinput.
Most detection methods are based on input sample statistics [23, 29, 32, 36, 46], while others attempt to detect adversarial samples via inference on surrogate models, yet these models themselvesmight be vulnerable to attacks [12, 49].
Analysis
In the following, we first describe our experimental setting in which we then conduct an extensiveanalysis on the two CIFAR datasets with respect to robust and non-robust model confidence onclean and perturbed samples as well as their ECE.
Further, we observe by computing the ROCcurves of these models that robust models are best suited to distinguish between correct and incorrectpredictions based on their confidence.
In addition we point out that the improvement of poolingoperations or activation functions within the network can enhance the models’ calibration further.
Last, we also investigate ImageNet as a high resolution dataset and observe that the model with thehighest capacity and AT can achieve the best performance results and calibration.
3.1 Experimental Setup
We have collected 71 checkpoints of robust models [1, 3, 7–9, 11, 16, 17, 21, 22, 25, 26, 37, 39, 40,57 , 59, 60, 62, 65, 66, 68, 69, 78, 81, 82, 84, 85, 87, 88] listed on the ℓ ∞ - RobustBench leaderboard[15].
Additionally, we compare each appearing architecture to a second model trained without AT orany specific robustness regularization, and without any external data (even if the robust counterpartrelied on it).
Training details can be found in appendix A.
We provide all models and weights atwww.after-accept.com .
Then we collect the predictions alongside their respective confidences of robust and non-robustmodels on clean validation samples, as well as on samples attacked by a white-box attack (PGD),and a black-box attack (Squares).
PGD (and its adaptive variant APGD [14]) is the most widelyused white-box attack and adversarial training schemes explicitly (when using PGD samples fortraining) or implicitly (when using the faster but strongly related FGSM attack samples for training)optimize for PGD robustness.
In contrast, the Squares attack alters the data at random with an allowedbudget until the label flips.
Such samples are rather to be considered out-of-domain samples even foradversarially trained models and provide a proxy for a model’s generalization abitily.
3.2 CIFAR Models
CIFAR10 [42] is a simple ten class dataset consisting of 50,000 training and 10,000 validation imageswith a resolution of 32 × 32 .
Since it is significantly cheaper to train on this dataset in comparison toe.
g. ImageNet, this dataset became a welcome benchmark for robustness allowing to discount theadditional cost of adversarial training.
Thus entries on RobustBench [15] typically aim at improvingmodels robustness on CIFAR10.
Figure 1 shows an overview of all robust and non-robust models trained on CIFAR10 in terms oftheir accuracy as well as their confidence in their correct and incorrect predictions.
The red starin the lower right corner indicates the optimal point where models are highly confident in correctpredictions and have zero confidence in their incorrect predictions.
Along the isolines, the ratiobetween confidence in correct and incorrect predictions is constant.
The gray area indicates scenarios where models are even more confident in their incorrect predictions than in their correctpredictions.
Concentrating on the models’ confidence, we can see that robust models (marked bya diamond) are in general less confident in their predictions, while non-robust models (markedby a circle) exhibit high confidence in all their predictions, both correct and incorrect.
This indicates that non-robust models are not only more susceptible to (adversarial) distribution shifts butare also highly over-confident in their false predictions.
Practically, such behaviour can lead tocatastrophic consequences in safety-related, real-world applications.
Robust models tend to havelower average confidence and a favorable confidence trade-off even on clean data (Figure 1, topleft).
When adversarial samples using PGD are considered (Figure 1, top middle), the non-robustmodels even fall into the gray area of the plot where more confident decisions are likely incorrect.
Asexpected, adversarially trained models not only make fewer mistakes in this case but are also betteradjusted in terms of their confidence.
Black-box attacks (Figure CIFAR [Figure] m e a n m o d e l c o n f i d e n c e i n c o rr e c t c l a ss i f
i c a t i o n
Clean samples [Figure] c [Figure]
i o n
Squares samples
[Figure]
CIFAR
[Figure]
m e a n m o d e l c o n f i d e n c e i n c o rr e c t c l a ss i f
i c a t i o n
[Figure]
[Figure]
[Figure]
[Figure]
over all non-robust model versus all their robust counterparts trained on CIFAR10.
Robust model exhibit a significantly lower ECE on all samples.
Four models stand out in Figure 1 (topleft): two robust and two non-robustmodels which are much less confidentin their true and false predictions thanothers.
These less confident modelsare indeed trained from two differentmodel architectures, with and withoutadversarial training.
[57] uses a hypersphere embedding which normalizesthe features in the intermediate layers and weights in the softmax layer, the other model [11] uses anensemble of three different pretrained models (ResNet-50) to boost robustness.
These architecturalchanges have a significant impact on the absolute model confidence, yet, do not necessarily lead toa better calibration.
These models are under-confident in their correct predictions and tend to becomparably confident in wrong predictions.
1.0 False positive rate 0.
T r u e p
o
s i
t i v e r a t
e
Clean Samples 0.
1.0 False positive rate 0.
T r u e p
o
s i
t i v e r a t
e
PGD Samples 0.
[Figure]
positive rate 0.
T r u e p
o
s i
t i v e r a t
e
Squares Samples
CIFAR 0.
[Figure]
positive rate 0.
T r u e p
o
s i
t i v e r a t
e
Clean Samples 0.
1.0 False positive rate 0.
T r u e p
o
s i
t i v e r a t
e
PGD Samples 0.
1.0 False positive rate 0.
T r u e p
o
s i
t i v e r a t
e
Squares Samples
[Figure]
models confidences can be an indicator for the correctness of the prediction.
However, on PGD samples the non-robust models fail while the robust models can distinguish correct from incorrect predictions based on the prediction confidence.
Table 1 reports the mean ECE over all robust models and their non-robust counterparts.
Robust modelare better calibrated which results in a significantly lower ECE 1 .
Figure 12 further visualizes thesignificant decrease in over-confidence of robust models w.r.t.
their non-robust counterparts.
CIFAR100 , although otherwise similar to CIFAR10, includes 100 classes and can be seen as a morechallenging classification task.
This is reflected in the reduced model accuracy on the clean andadversarial samples (Figure 1 , bottom).
On this data, robust models are again less over-confident.
They are slightly closer to the optimal calibration point in the lower right corner even on clean dataand perform significantly better on PGD samples where the confidences of non-robust models areagain reversed (middle).
The Squares attack again illustrates the stable behavior of robust models’confidences 2 .
We also report the ECE values for CIFAR100 in the Appendix.
Please note that theaccuracy of the CIFAR100 models is not very high (ranging between 56 .
87% and 70 .
25% evenfor clean samples), resulting in an unreliable calibration metric.
Especially under PGD attacks,non-robust networks make mostly incorrect predictions such that the ECE collapses to being theexpected confidence value of incorrect predictions (see eq.
[1]), regardless of the confidences of thefew correct predictions.
In this case, ECE is not meaningful.
Another interesting observation is that non-robust models can achieve higher accuracy on the cleandata and, quite surprisingly, on the applied black-box attacks (Figure 1, right).
This indicates thatmost robust models overfit white-box attacks used during training and are not generalizing very wellto other attacks.
While making more mistakes, robust models still have a favorable distribution ofconfidence over non-robust models in this case.
Model confidences can predict erroneous decisions.
Next, we evaluate the prediction confidencesin terms of their ability to predict whether a network prediction is correct or incorrect.
We visualizethe ROC curves for all models and compare the averages of robust and non-robust models in Figure 3(top row for CIFAR10, bottom row for CIFAR100), which allows us to draw conclusions about theconfidence behavior.
While robust and non-robust models perform on average very similarly on clean
CIFAR
[Figure]
[Figure]
[Figure]
[Figure] [Figure]
T
[Figure]
e p o s i t
i v
[Figure]
a t [Figure]
[Figure]
[Figure] [Figure]
[Figure]
[Figure]
[Figure]
p o s i t i v
[Figure]
Robust model confidences can detect adversarial samples.
Further, we evaluate the adversarialdetection rate of the robust models based on their ROC curves (averaged over all robust models) in
Figure 4, comparing the confidence of correct predictions on clean samples and incorrect predictionscaused by adversarial attacks.
We observe that the confidences of robust models can be used to detectadversarial samples by simple thresholding.
Downsampling techniques.
Most common CNNs apply downsampling to compress featuremapswith the intent to increase spatial invariance and overall higher sparsity.
However, Grabinski et al.[28] showed that aliasing during the downsampling operation highly correlates with the lack ofadversarial robustness, and provided a new kind of downsampling operation, called frequency lowcut pooling [27], which enables improved downsampling of the featuremaps.
Figure 5 comparesthe confidence distribution of three different networks.
The top row shows a PRN-18 baselinewithout adversarial training, the second row the approach by Grabinski et al.
[27] applied to thesame architecture (additional models are evaluated in the appendix D ), and the third row a robustmodel trained by Rebuffi et al.
The baseline model is highly susceptible to adversarial attacks,especially under white-box attacks, while the two robust counter-parts remain low-confident in falsepredictions, and show higher confidence in correct predictions.
However, while the model of Rebuffiet al.
[60] shows a high variance amongst the predicted confidences, the approach by Grabinski et al.[27] significantly improves this by disentangling the confidences.
Their model provides low-varianceand high-confidence on correct predictions and reduced confidence on false predictions across allevaluated samples.
Activation functions.
Next, we analyze the influence of activation functions.
Only one RobustBench model utilizes an activation other than ReLU.
Dai et al.
[17] introduce learnable activationfunctions with the intent to improve robustness.
Figure 6 shows at the top row a WRN-28-10 baselinemodel without AT, the model by Dai et al.
[17] in the middle and a model with the same architectureadversarially trained by Carmon et al.
Although this is an arguably sparse basis for a thorough investigation, we observe that the modelby [17] can retain high confidence in correct predictions for both clean and perturbed samples.
Furthermore, the model is much less confident in its wrong predictions for the clean as well as theadversarial samples.
Similar to the used pooling variation, also the activation function seems toinfluence the model’s calibration.
Summary of low resolution datasets.
On CIFAR10 and CIFAR100 non-robust models canachieve higher standard accuracy and at least match or even exceed the performance of robust modelsunder black-box attacks like Squares .
Only under the white-box attack PGD, the robust models showhigher accuracy.
However non-robust models are highly over-confident in all their predictions and arehence limited in their applicability for real-world tasks.
In contrast, the correctness of a robust models’prediction can be estimated by the prediction confidence.
and is additionally serving as a defenceagainst adversarial attacks.
Further, we observe that the confidence of non-robust models decreases
[Figure]
instead of standard pooling and the third row shows the model by Rebuffi et al.
[60] adversarially trained and with standard pooling.
[Figure]
with increasing task complexity.
In contrast, robust models are less affected by the increased taskcomplexity and exhibit similar confidence characteristics on both datasets.
3.3 ImageNet
As previously introduced, we rely on the models provided by RobustBench [15] for our ImageNetevaluation.
We report the clean and robust accuracy against PGD and Squares in Table 4 in theappendix.
The non-robust model, trained without AT, achieves the highest performance on cleansamples but collapses under white- and black-box attacks.
Further, the models trained with multistepadversaries by Engstrom et al.
[22] and Salman et al.
[64] achieve higher robust and clean accuracythan the model trained by Wong et al.
[81] which is trained with single-step adversaries.
Moreover,the largest model, a WRN-50-2, yields the best robust performance.
Still, the amount of robustnetworks on ImageNet is quite small, thus we can not make any generalized assumptions.
Figure 8 shows the precision-recall curve for our evaluated models.
Under evaluation with cleansamples, the non-robust model without AT performs best.
Under both attacks ( PGD and Squares )the largest model ( a WRN-50-2 by Salman et al.
[64]) performs best and the worst performer is thesmallest model (RN-18).
This may be suggesting that bigger models can not only achieve the bettertrade-off in clean and robust accuracy but also more successfully disentangle confidences betweencorrect and incorrect predictions.
Figure 7 confirms that the over-confidence is decreased in robustmodels and the ECE is lower than in the non-robust models.
Discussion
Our experiments confirm that the prediction confidence of non-robust models is an insufficientindicator for the correctness of the prediction, especially under attacks.
In contrast, robust models arebetter behaved and, thus, allow their prediction confidence to serve as a threshold to detect wronglyclassified samples.
Further, our results indicate that the selection of the activation functions as well asthe downsampling are important factors for the models’ performance and confidence.
The method by
Grabinski et al.
[27], which improves the downsampling, as well as the method by Dai et al.
[17],which improves the activation function, exhibit the best calibration for the networks prediction.
While
[Figure]
1.0 Recall 0.
[Figure]
P r e c
i s i o n f1=0.2 f1=0. f [Figure] f1=0.
f
[Figure]
[Figure]
1.0 Recall 0.
[Figure]
r
[Figure] [Figure] P r e c i s i o n f
[Figure]
[Figure] f1=0.
[Figure]
f
[Figure]
f
[Figure] [Figure]
f
[Figure]
further optimizing deep neural networks’ architectures and training schemes, we should consider thesynopsis of model robustness and calibration instead of optimizing each of these aspects separately.
Limitations. Our evaluation is based on the models provided on RobustBench [15].
Thus the amountof networks on more complex datasets, like ImageNet, is rather small and therefore the evaluationnot universally applicable.
While the number of models for CIFAR10 and CIFAR100 is large, theproposed database can only be understood as a starting point for future research.
This is particularlytrue for the analysis of neural network building blocks - models that are adversarially trained andemploy smooth activation functions might be very promising concerning their calibration but a morein-depth analysis of this setting with new, dedicated datasets is desirable.
Additionally, we rely simplyon the confidence obtained after the Softmax layer, while there are many other metrics for uncertaintymeasurement.
Hence, an analysis of robust models with respect to those measures might be valuableand we encourage such research by releasing our dataset of trained models.
Conclusion
We provide an extensive study on the confidences of robust models and observe an overall trend:robust models tent to be less over-confident than non-robust models.
Thus, while achieving a higherrobust accuracy, adversarial training provides better calibrated models which are more suited forreal-world application.
Further, the prediction confidence of robust models can actually be used toreject wrongly classified samples on clean data and even adversarial examples.
Moreover, we see indications that exchanging simple building blocks like the activation function [17]or the downsampling method [28] alters the properties of robust models with respect to confidencecalibration.
On the examples we investigate, the models’ prediction confidence on their correctpredictions can be increased while the confidence on the erroneous predictions remains low.
Ourfindings should nurture future research on jointly considering model calibration and robustness.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] Section
(c) Did you discuss any potential negative societal impacts of your work?
[No]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes] We provide the
model weights for the standard trained counterparts to the model architectures reported
on RobustBench.
(b) Did you specify all the training details (e g., data splits, hyperparameters,
how they
were chosen)?
[Yes] Section 3.1 and Section A
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] We included mean and standard deviation.
(d) Did you include the total amount of compute and the type of resources used (e
g.,type of GPUs, internal cluster, or cloud provider)?
[No] The training time for each
normal training depends on the network architecture provided and was not tracked.
The calculation of the model confidence can be simply done by collecting the models
output after Softmax and does not require much computational effort or resources.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes] RobustBench [
15] aswell as the papers used on their benchmark (section 3.1)(b)
Did you mention the license of the assets?
[Yes] Appendix section G(
c ) Did you include any new assets either in the supplemental material or as a URL?[Yes]
We provide the model weights for the standard trained counterparts to the modelarchitectures reported on RobustBench.(d)
Did you discuss whether and how consent was obtained from people whose data you’reusing/curating?
N/ A](e
Did you discuss whether the data you are using/curating contains personally identifiableinformation or offensive content?
N /A]5.
If you used crowdsourcing or conducted research with human subjects...(
a) Did you include the full text of instructions given to participants and screenshots, ifapplicable?
[N/A](
b ) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A](
c) Did you include the estimated hourly wage paid to participants and the total amountspent on participant compensation
[N/A