Update index.html

index.html

@@ -211,6 +211,131 @@
 <!-- Overview -->
 
 
+
+
+<!-- Robustness Certificate Definition -->
+<section class="section">
+
+  <div class="container is-max-desktop">
+    <h2 class="title is-3">Robustness Certificate Definition</h2>
+
+    <div class="columns is-centered">
+      <div class="column container formula">
+        <p>
+          GREAT Score is designed to evaluate the global robustness of classifiers against adversarial attacks. It uses generative models to estimate a certified lower bound on true global robustness. For a K-way classifier f, we define a local robustness score g(G(z)) for a generated sample G(z), where G is a generator and z is sampled from a standard Gaussian distribution. This score measures the confidence gap between the correct class prediction and the most likely incorrect class. The GREAT Score, defined as the expectation of g(G(z)) over z, provides a certified lower bound on the true global robustness with respect to the data distribution learned by the generative model. This approach allows us to estimate global robustness without knowing the exact data distribution or minimal perturbations for each sample.
+        </p>
+      </div>
+    </div>
+
+    <div class="columns is-centered">
+      <div class="column container-centered">
+        <div id="adaptive-loss-formula" class="container">
+          <div id="adaptive-loss-formula-list" class="row align-items-center formula-list">
+            <a href=".true-global-robustness" class="selected">True Global Robustness</a>
+            <a href=".global-robustness-estimate">Global Robustness Estimate</a>
+            <a href=".local-robustness-score">Local Robustness Score</a>
+            <div style="clear: both"></div>
+          </div>
+          <div class="row align-items-center adaptive-loss-formula-content">
+            <span class="formula true-global-robustness formula-content">
+              $$
+              \displaystyle 
+              \Omega(f) = \mathbb{E}_{x\sim P}[\Delta_{min}(x)]= \int_{x \sim P} \Delta_{\min}(x) p(x)dx
+              $$
+            </span>
+            <span class="formula global-robustness-estimate formula-content" style="display: none;">
+              $$
+              \displaystyle
+              \widehat{\Omega}(f) = \mathbb{E}_{x\sim P}[g(x)]= \int_{x \sim P} g(x) p(x)dx
+              $$
+            </span>
+            <span class="formula local-robustness-score formula-content" style="display: none;">
+              $$
+              \displaystyle
+              g\left(G(z)\right) = \sqrt{\cfrac{\pi}{2}}  \cdot \max\{  f_c(G(z)) - \max_{k \in \{1,\ldots,K\},k\neq c} f_k(G(z)),0 \}
+              $$
+            </span>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <div class="columns is-centered">
+      <div class="column container adaptive-loss-formula-content">
+        <p class="formula true-global-robustness formula-content">
+          where f is a classifier, P is a data distribution, and Δ<sub>min</sub>(x) is the minimal perturbation for a sample x.
+        </p>
+        <p class="formula global-robustness-estimate formula-content" style="display: none">
+          where g(x) is a local robustness statistic, and this estimate is used when the exact probability density function of P and local minimal perturbations are unknown.
+        </p>
+        <p class="formula local-robustness-score formula-content" style="display: none;">
+          where G(z) is a generated data sample, f<sub>c</sub> is the confidence score for the correct class c, and f<sub>k</sub> are the confidence scores for other classes.
+        </p>
+      </div>
+    </div>
+
+    <div class="columns is-centered">
+      <div class="column is-full-width">
+        <h3 class="title is-4">Model Ranking Comparison</h3>
+        <div class="content has-text-justified">
+          <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
+            <caption><strong>Table 2.</strong> Spearman's rank correlation coefficient on CIFAR-10 using GREAT Score, RobustBench (with test set), and Auto-Attack (with generated samples).</caption>
+            <thead>
+              <tr>
+                <th></th>
+                <th>Uncalibrated</th>
+                <th>Calibrated</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <td>GREAT Score vs. RobustBench Correlation</td>
+                <td>0.6618</td>
+                <td>0.8971</td>
+              </tr>
+              <tr>
+                <td>GREAT Score vs. AutoAttack Correlation</td>
+                <td>0.3690</td>
+                <td>0.6941</td>
+              </tr>
+              <tr>
+                <td>RobustBench vs. AutoAttack Correlation</td>
+                <td>0.7296</td>
+                <td>0.7296</td>
+              </tr>
+            </tbody>
+          </table>
+          
+          <p>
+            We compare the model ranking on CIFAR-10 using GREAT Score (evaluated with generated samples), RobustBench (evaluated with Auto-Attack on the test set), and Auto-Attack (evaluated with Auto-Attack on generated samples). 
+            Table 2 presents their mutual rank correlation (higher value means more aligned ranking) with calibrated and uncalibrated versions.
+            We note that there is an innate discrepancy between Spearman's rank correlation coefficient (way below 1) of RobustBench vs. Auto-Attack, which means Auto-Attack will give inconsistent model rankings when evaluated on different data samples. In addition, GREAT Score measures <em>classification margin</em>, while AutoAttack measures <em>accuracy</em> under a fixed perturbation budget ε. AutoAttack's ranking will change if we use different ε values. E.g., comparing the ranking of ε=0.3 and ε=0.7 on 10000 CIFAR-10 test images for AutoAttack, the Spearman's correlation is only 0.9485. Therefore, we argue that GREAT Score and AutoAttack are <em>complementary</em> evaluation metrics and they don't need to match perfectly.
+            Despite their discrepancy, before calibration, the correlation between GREAT Score and RobustBench yields a similar value. With calibration, there is a significant improvement in rank correlation between GREAT Score to Robustbench and Auto-Attack, respectively.
+          </p>
+        </div>
+      </div>
+    </div>
+
+    <div class="columns is-centered">
+      <div class="column container-centered">
+        <div>
+          <img src="./static/images/new_figure_2_2.png"
+               class="method_overview"
+               alt="Comparison of local GREAT Score and CW attack"/>
+          <p>
+            <strong>Figure 2.</strong> Comparison of local GREAT Score and CW attack in L<sub>2</sub> perturbation on CIFAR-10 with Rebuffi_extra model. 
+            The x-axis is the image id. The result shows the local GREAT Score is indeed a lower bound of the perturbation level found by CW attack.
+          </p>
+        </div>
+      </div>
+    </div>
+  </div>
+
+
+</section>
+
+
+
 <!-- Results -->
 <section class="section">
   <div class="container is-max-desktop">
@@ -376,120 +501,8 @@
 
 
 
-<!-- Robustness Certificate Definition -->
-<section class="section">
-
-  <div class="container is-max-desktop">
-    <h2 class="title is-3">Robustness Certificate Definition</h2>
 
-    <div class="columns is-centered">
-      <div class="column container formula">
-        <p>
-          GREAT Score is designed to evaluate the global robustness of classifiers against adversarial attacks. It uses generative models to estimate a certified lower bound on true global robustness. For a K-way classifier f, we define a local robustness score g(G(z)) for a generated sample G(z), where G is a generator and z is sampled from a standard Gaussian distribution. This score measures the confidence gap between the correct class prediction and the most likely incorrect class. The GREAT Score, defined as the expectation of g(G(z)) over z, provides a certified lower bound on the true global robustness with respect to the data distribution learned by the generative model. This approach allows us to estimate global robustness without knowing the exact data distribution or minimal perturbations for each sample.
-        </p>
-      </div>
-    </div>
 
-    <div class="columns is-centered">
-      <div class="column container-centered">
-        <div id="adaptive-loss-formula" class="container">
-          <div id="adaptive-loss-formula-list" class="row align-items-center formula-list">
-            <a href=".true-global-robustness" class="selected">True Global Robustness</a>
-            <a href=".global-robustness-estimate">Global Robustness Estimate</a>
-            <a href=".local-robustness-score">Local Robustness Score</a>
-            <div style="clear: both"></div>
-          </div>
-          <div class="row align-items-center adaptive-loss-formula-content">
-            <span class="formula true-global-robustness formula-content">
-              $$
-              \displaystyle 
-              \Omega(f) = \mathbb{E}_{x\sim P}[\Delta_{min}(x)]= \int_{x \sim P} \Delta_{\min}(x) p(x)dx
-              $$
-            </span>
-            <span class="formula global-robustness-estimate formula-content" style="display: none;">
-              $$
-              \displaystyle
-              \widehat{\Omega}(f) = \mathbb{E}_{x\sim P}[g(x)]= \int_{x \sim P} g(x) p(x)dx
-              $$
-            </span>
-            <span class="formula local-robustness-score formula-content" style="display: none;">
-              $$
-              \displaystyle
-              g\left(G(z)\right) = \sqrt{\cfrac{\pi}{2}}  \cdot \max\{  f_c(G(z)) - \max_{k \in \{1,\ldots,K\},k\neq c} f_k(G(z)),0 \}
-              $$
-            </span>
-          </div>
-        </div>
-      </div>
-    </div>
-
-    <div class="columns is-centered">
-      <div class="column container adaptive-loss-formula-content">
-        <p class="formula true-global-robustness formula-content">
-          where f is a classifier, P is a data distribution, and Δ<sub>min</sub>(x) is the minimal perturbation for a sample x.
-        </p>
-        <p class="formula global-robustness-estimate formula-content" style="display: none">
-          where g(x) is a local robustness statistic, and this estimate is used when the exact probability density function of P and local minimal perturbations are unknown.
-        </p>
-        <p class="formula local-robustness-score formula-content" style="display: none;">
-          where G(z) is a generated data sample, f<sub>c</sub> is the confidence score for the correct class c, and f<sub>k</sub> are the confidence scores for other classes.
-        </p>
-      </div>
-    </div>
-
-    <div class="columns is-centered">
-      <div class="column is-full-width">
-        <h3 class="title is-4">Performance of BEYOND against Adaptive Attacks</h3>
-        <div class="content has-text-justified">
-          <p>
-            We evaluate the detection performance of BEYOND against adaptive attacks on different datasets and show the ROC curves under different perturbation budgets as follows:
-          </p>
-        </div>
-
-        <div class="columns is-vcentered interpolation-panel">
-
-            <div id="adaptive-dataset" class="column is-3 align-items-center" style="width: 30%;">
-              <a href="#c10" class="selected">CIFAR-10</a>
-              <!-- <a href="#c100" class="selected">CIFAR-100</a> -->
-              <a href="#imgnet" >ImageNet</a>
-              <div style="clear: both"></div>
-            </div>
-            <div id="c10" class="column interpolation-video-column" style="width: 70%;">
-              <div id="c10-image-wrapper" >
-                Loading...
-              </div>
-              <input name="c10" class="slider is-full-width is-large is-info interpolation-slider"
-                step="1" min="0" max="6" value="0" type="range">
-              <label for="interpolation-slider"><strong>Perturbation Budget &Epsilon;</strong> from 2/255 to 128/255</label>
-            </div>
-            <!-- <div id="c100" class="column interpolation-video-column" style="width: 70%; display: none;">
-              <div id="c100-image-wrapper" >
-                Loading...
-              </div>
-              <input name="c100" class="slider is-full-width is-large is-info interpolation-slider"
-                step="1" min="0" max="6" value="0" type="range">
-              <label for="interpolation-slider"><strong>Perturbation Budget &Epsilon;</strong> from 2/255 to 128/255</label>
-            </div> -->
-            <div id="imgnet" class="column interpolation-video-column" style="width: 70%; display: none;">
-              <div id="imgnet-image-wrapper" >
-                Loading...
-              </div>
-              <input name="imgnet" class="slider is-full-width is-large is-info interpolation-slider"
-                step="1" min="0" max="6" value="0" type="range">
-              <label for="interpolation-slider"><strong>Perturbation Budget &epsilon;</strong> from 2/255 to 128/255</label>
-
-            </div>
-
-        </div>
-        <br/>
-
-      
-    </div>
-  </div>
-
-
-</section>
-<!-- Adaptive Attack -->
 
 <!-- Empirical Validation Section -->
 <section class="section">