AutoAttack: A Parameter-Free Ensemble for Adversarial Robustness Evaluation
AutoAttack is a framework designed to provide a reliable and standardized method for evaluating the adversarial robustness of machine learning models. Introduced by Francesco Croce and Matthias Hein from the University of Tübingen in 2020, it addresses critical gaps in the evaluation process that often lead to misleading assessments of model robustness. The framework combines four distinct attacks into a single ensemble, eliminating the need for hyperparameter tuning and ensuring consistency across evaluations.
Previous evaluations often suffered from improper hyperparameter tuning, gradient obfuscation, or masking, which artificially inflated reported robustness metrics. AutoAttack mitigates these issues by standardizing the evaluation process, making it a more trustworthy benchmark for comparing defenses.
The ensemble consists of four attacks: APGD-CE, APGD-DLR, FAB, and Square Attack. By fixing all hyperparameters, AutoAttack ensures reproducibility and fairness in robustness evaluations.
AutoAttack was initially proposed in the paper Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-Free Attacks, published at the International Conference on Machine Learning (ICML) in 2020. The paper highlights the framework’s effectiveness by evaluating over 50 models from leading machine learning and computer vision venues. In nearly all cases, AutoAttack achieved lower robust test accuracy than originally reported, often by over 10%, exposing several previously undetected flaws in defenses.
For instance, the August 2020 update introduced targeted versions of APGD-DLR and FAB to improve performance on datasets with many classes, such as CIFAR-100.
How It Works
AutoAttack operates by sequentially applying its four constituent attacks to a target model. The process begins with APGD-CE, which performs an untargeted attack using cross-entropy loss without requiring step-size tuning. This is followed by APGD-DLR, which employs a targeted approach with a DLR loss function to identify vulnerabilities in specific classes. FAB then refines the attack by minimizing perturbation norms, while Square Attack provides a black-box evaluation with a fixed query budget.
One of the key innovations of AutoAttack is its parameter-free design. Unlike traditional adversarial evaluation methods, which require manual tuning of hyperparameters such as step size, learning rate, or the number of iterations, AutoAttack fixes all parameters in advance. The framework also includes automatic checks to identify edge cases where the standard version of AutoAttack might be insufficient, further enhancing its reliability.
The computational efficiency of AutoAttack is another critical advantage. By leveraging targeted and norm-minimizing attacks, the framework reduces the number of queries required for evaluation, making it feasible to test models on large-scale datasets like CIFAR-10 and CIFAR-100.
Use Cases
AutoAttack is primarily used for two purposes: evaluating the robustness of machine learning models and serving as a red-teaming tool for adversarial defenses. Researchers and practitioners rely on it to assess how well a model withstands adversarial perturbations, providing a more accurate measure of real-world performance than clean accuracy alone.
The framework has become the standard evaluation method in RobustBench, a benchmarking platform for adversarially trained models. RobustBench maintains up-to-date leaderboards that rank models based on their performance under AutoAttack, offering a transparent and dynamic way to track progress in adversarial robustness. This integration has made AutoAttack a de facto standard in the field, influencing how new defenses are validated and compared.
Beyond benchmarking, AutoAttack is used in academic research to identify and analyze weaknesses in existing defenses. For example, the paper introducing AutoAttack demonstrated that several high-profile defenses, including those from top conferences, failed under its evaluation.
In industry settings, AutoAttack can be employed to audit machine learning systems for potential adversarial risks.
Key Features and Capabilities
AutoAttack’s design is centered around four core features that distinguish it from other adversarial evaluation frameworks: parameter-free operation, diversity of attack strategies, computational efficiency, and integration with benchmarking platforms.
The parameter-free nature of AutoAttack ensures that evaluations are consistent and reproducible. By eliminating the need for hyperparameter tuning, the framework reduces the risk of overfitting evaluations to specific attack configurations. This consistency is crucial for fair comparisons between models, as it prevents researchers from artificially inflating robustness metrics through suboptimal attack settings.
The diversity of the attack ensemble is another key strength. APGD-CE and APGD-DLR cover untargeted and targeted adversarial threats, respectively, while FAB focuses on minimizing perturbation magnitudes.
Computationally, AutoAttack is optimized for efficiency. The framework’s scalability has made it feasible to include in large-scale benchmarking efforts, such as RobustBench, where performance must be assessed across hundreds of models.
AutoAttack’s integration with RobustBench further enhances its utility. RobustBench serves as a centralized platform for comparing adversarially trained models, with AutoAttack as the default evaluation method. This integration ensures that all models are tested under the same rigorous standards, providing a level playing field for researchers. The platform also maintains a model zoo, where pre-trained models and their AutoAttack evaluations are publicly available, facilitating reproducibility and collaboration.
The framework also includes mechanisms to handle edge cases where the standard AutoAttack might not be sufficient. For example, some models may exhibit unusual behaviors under specific attack configurations, such as gradient obfuscation or adaptive defenses. AutoAttack includes checks to identify these cases and recommend alternative evaluation strategies, ensuring that the framework remains adaptable to evolving adversarial techniques.
Adversarial Defenses Evaluation
AutoAttack has been instrumental in evaluating a wide range of adversarial defenses across different threat models. The framework’s standard version includes untargeted APGD-CE, targeted APGD-DLR (with 9 target classes), targeted FAB (with 9 target classes), and Square Attack (with 5000 queries).
The evaluations conducted using AutoAttack have revealed significant discrepancies between reported and actual robust accuracies. For instance, in the case of CIFAR-10 under the Linf-norm with epsilon set to 8/255, many models exhibited robust accuracies that were substantially lower than those originally claimed in their respective papers.
AutoAttack’s evaluations are documented in detailed tables that include the source of the model, its architecture, clean accuracy, and robust accuracy under AutoAttack. Similarly, evaluations on CIFAR-100 and MNIST datasets followed the same rigorous process, with AutoAttack consistently identifying models with inflated robustness claims.
The framework also supports more expensive variants, such as AutoAttack+, which may include additional attacks or extended query budgets for more thorough evaluations.
AutoAttack’s role in evaluating defenses extends beyond individual models. It has been used to assess entire families of adversarial training techniques, including those that incorporate additional data, such as unlabeled examples or pre-training. For example, models marked with a ‡ symbol in evaluation tables exploit extra data during training, which can sometimes lead to higher robust accuracies.
The evaluations conducted with AutoAttack have led to the creation of a Model Zoo, where pre-trained models and their corresponding robust accuracies are made publicly available. This resource allows researchers to replicate results, compare their own models against established benchmarks, and contribute new defenses for evaluation. The Model Zoo is maintained in tandem with RobustBench, ensuring that it remains up-to-date with the latest advancements in adversarial robustness.
Evaluation Metrics and Datasets
AutoAttack’s evaluations are conducted across multiple datasets, including CIFAR-10, CIFAR-100, and MNIST, each with specific adversarial perturbation constraints. For CIFAR-10 and CIFAR-100 under the Linf-norm, the maximum perturbation epsilon is typically set to 8/255, though some models are evaluated at epsilon = 0.031 for consistency with their original papers.
The framework’s flexibility in supporting different norms ensures that it can adapt to various threat models and attack scenarios.
The evaluation tables for each dataset include columns for clean accuracy, reported robust accuracy (as claimed in the original papers), and AutoAttack’s measured robust accuracy. This side-by-side comparison underscores the discrepancies that often arise due to improper evaluation methods.
These evaluations highlight the critical role of standardized testing in adversarial machine learning. By providing a consistent and rigorous benchmark, AutoAttack helps researchers and practitioners identify which defenses are genuinely robust and which may require further refinement.