提出新指标RDI，用统计特征评估模型抗攻击能力，快且准。
RDI: An adversarial robustness evaluation metric for deep neural networks based on model statistical features
- 基于模型特征的类内类间距离计算鲁棒性，不依赖具体攻击方法。
- 与攻击成功率相关性更强，计算速度是PGD方法的1/30。
- 适合快速评估复杂模型，尤其适用于安全关键场景的模型筛选。
深度神经网络易受对抗样本影响，威胁其在安全关键任务中的可靠性。现有评估方法分为基于攻击和可认证两类：前者依赖特定攻击算法且耗时长，后者因分析性质难以应用于大型复杂模型。少数研究基于决策边界评估鲁棒性，但准确率较低。为此，本文提出一种新指标——鲁棒性差异指数（RDI），基于模型统计特征构建。RDI受聚类评估启发，通过分析决策边界两侧特征向量的类内与类间距离来量化模型鲁棒性，具备攻击无关性和高计算效率。实验表明，RDI与黄金标准指标攻击成功率（ASR）具有更强相关性，平均计算时间仅为PGD-based方法的1/30。代码已开源：https://github.com/BUPTAIOC/RDI。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) are highly susceptible to adversarial samples, raising concerns about their reliability in safety-critical tasks. Currently, methods of evaluating adversarial robustness are primarily categorized into attack-based and certified robustness evaluation approaches. The former not only relies on specific attack algorithms but also is highly time-consuming, while the latter due to its analytical nature, is typically difficult to implement for large and complex models. A few studies evaluate model robustness based on the model's decision boundary, but they suffer from low evaluation accuracy. To address the aforementioned issues, we propose a novel adversarial robustness evaluation metric, Robustness Difference Index (RDI), which is based on model statistical features. RDI draws inspiration from clustering evaluation by analyzing the intra-class and inter-class distances of feature vectors separated by the decision boundary to quantify model robustness. It is attack-independent and has high computational efficiency. Experiments show that, RDI demonstrates a stronger correlation with the gold-standard adversarial robustness metric of attack success rate (ASR). The average computation time of RDI is only 1/30 of the evaluation method based on the PGD attack. Our open-source code is available at: https://github.com/BUPTAIOC/RDI.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。