Evaluating the Adversarial Robustness of Deep Model by Decision Boundaries

With the successful applications of DNNs in various real-world tasks, concerns have been raised regarding the robustness of these models. Evaluating the robustness of deep models typically involves generating adversarial samples, a time-consuming process that relies on specific attacks and model structures. To address this issue, we propose a new attack-independent robustness measurement. Instead of relying on prior knowledge of adversarial samples, our method utilizes inter-class and intra-class statistics to analyze the model’s feature distribution in the latent space. A stronger and more robust model will exhibit larger distances between classes and smaller distances within the same class. We conducted comprehensive experiments on ten state-of-the-art deep models and different datasets to validate the effectiveness and efficiency of our method. Compared to other evaluation metrics, our method better aligns with the robustness golden standard attack success rate (ASR) while requiring significantly less computation. As far as we know, our method is the first lightweight attack-independent robustness evaluation metric that can be applied to a wide range of deep models.