用费舍尔信息谱范数衡量模型鲁棒性，无需攻击即可评估脆弱性。
Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms
- 基于费舍尔信息矩阵谱范数构建无攻击依赖的鲁棒性度量
- 在CIFAR、ImageNet等数据集上与对抗脆弱性高度相关
- 支持白盒黑盒设置，可指导模型架构优化
深度神经网络的鲁棒性对安全关键部署至关重要，但现有评估方法多依赖特定攻击且缺乏可解释性。本文提出一种基于费舍尔信息矩阵（FIM）谱范数的理论驱动型鲁棒性度量，量化模型输出分布对输入扰动的最坏敏感度。理论上，我们证明FIM等于输入雅可比矩阵的方差，并推导出VGG、ResNet、DenseNet和Transformer等常见架构的闭式谱界，首次实现理论鲁棒性排序。为实现可扩展评估，开发了幂迭代和Hutchinson估计等高效算法，支持白盒与黑盒场景。在多个数据集（包括CIFAR、ImageNet和医学图像）及多种架构上的大量实验表明，该度量与对抗脆弱性存在强相关性。本框架可作为可解释的诊断工具，补充攻击式评估，揭示架构敏感性并指导更鲁棒模型的设计。代码已开源：https://github.com/franz-chang/SRP/
原文摘要 · Abstract (English)
The robustness of deep neural networks is crucial for safety-critical deployments, yet existing evaluation methods are often attack-dependent and lack interpretability. We propose a principled, attack-agnostic robustness metric based on the spectral norm of the Fisher Information Matrix (FIM), which quantifies the worst-case sensitivity of the model's output distribution to input perturbations. Theoretically, we establish that the FIM equals the variance of the input Jacobian and derive closed-form spectral bounds for common architectures, including VGG, ResNet, DenseNet, and Transformer, providing the first theoretical robustness ranking. To enable scalable evaluation, we develop efficient algorithms, including power iteration and Hutchinson-based estimation, that support both white-box and black-box settings. Extensive experiments across multiple datasets, including CIFAR, ImageNet, and medical images, and across multiple architectures show a strong correlation between our metric and adversarial vulnerability. Our framework serves as an interpretable diagnostic tool that complements attack-based evaluations, offering insights into architectural sensitivity and guiding the design of more robust models. Code is available at: https://github.com/franz-chang/SRP/.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。