SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation

Wuxinlin Cheng; Chenhui Deng; Zhiqiang Zhao; Yaohui Cai; Zhiru Zhang; Zhuo Feng

SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation

Wuxinlin Cheng
, Chenhui Deng
, Zhiqiang Zhao
, Yaohui Cai
, Zhiru Zhang
, Zhuo Feng

Department of Electrical and Computer Engineering

Stevens Institute of Technology

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

A black-box spectral method is introduced for evaluating the adversarial robustness of a given machine learning (ML) model. Our approach, named SPADE, exploits bijective distance mapping between the input/output graphs constructed for approximating the manifolds corresponding to the input/output data. By leveraging the generalized Courant-Fischer theorem, we propose a SPADE score for evaluating the adversarial robustness of a given model, which is proved to be an upper bound of the best Lipschitz constant under the manifold setting. To reveal the most non-robust data samples highly vulnerable to adversarial attacks, we develop a spectral graph embedding procedure leveraging dominant generalized eigenvectors. This embedding step allows assigning each data sample a robustness score that can be further harnessed for more effective adversarial training. Our experiments show the proposed SPADE method leads to promising empirical results for neural network models that are adversarially trained with the MNIST and CIFAR-10 data sets.

Original language	English
Title of host publication	Proceedings of the 38th International Conference on Machine Learning, ICML 2021
Publisher	ML Research Press
Pages	1814-1824
Number of pages	11
ISBN (Electronic)	9781713845065
State	Published - 2021
Event	38th International Conference on Machine Learning, ICML 2021 - Virtual, Online Duration: Jul 18 2021 → Jul 24 2021

Publication series

Name	Proceedings of Machine Learning Research
Volume	139

Conference

Conference	38th International Conference on Machine Learning, ICML 2021
City	Virtual, Online
Period	7/18/21 → 7/24/21

ASJC Scopus subject areas

Artificial Intelligence
Software
Control and Systems Engineering
Statistics and Probability

Cite this

@inproceedings{bc994407160b43448763d822ae16782a,

title = "SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation",

abstract = "A black-box spectral method is introduced for evaluating the adversarial robustness of a given machine learning (ML) model. Our approach, named SPADE, exploits bijective distance mapping between the input/output graphs constructed for approximating the manifolds corresponding to the input/output data. By leveraging the generalized Courant-Fischer theorem, we propose a SPADE score for evaluating the adversarial robustness of a given model, which is proved to be an upper bound of the best Lipschitz constant under the manifold setting. To reveal the most non-robust data samples highly vulnerable to adversarial attacks, we develop a spectral graph embedding procedure leveraging dominant generalized eigenvectors. This embedding step allows assigning each data sample a robustness score that can be further harnessed for more effective adversarial training. Our experiments show the proposed SPADE method leads to promising empirical results for neural network models that are adversarially trained with the MNIST and CIFAR-10 data sets.",

author = "Wuxinlin Cheng and Chenhui Deng and Zhiqiang Zhao and Yaohui Cai and Zhiru Zhang and Zhuo Feng",

note = "Publisher Copyright: Copyright {\textcopyright} 2021 by the author(s); 38th International Conference on Machine Learning, ICML 2021 ; Conference date: 18-07-2021 Through 24-07-2021",

year = "2021",

language = "English",

series = "Proceedings of Machine Learning Research",

publisher = "ML Research Press",

pages = "1814--1824",

booktitle = "Proceedings of the 38th International Conference on Machine Learning, ICML 2021",

}

Cheng, W, Deng, C, Zhao, Z, Cai, Y, Zhang, Z & Feng, Z 2021, SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation. in Proceedings of the 38th International Conference on Machine Learning, ICML 2021. Proceedings of Machine Learning Research, vol. 139, ML Research Press, pp. 1814-1824, 38th International Conference on Machine Learning, ICML 2021, Virtual, Online, 7/18/21.

SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation. / Cheng, Wuxinlin; Deng, Chenhui; Zhao, Zhiqiang et al.
Proceedings of the 38th International Conference on Machine Learning, ICML 2021. ML Research Press, 2021. p. 1814-1824 (Proceedings of Machine Learning Research; Vol. 139).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - SPADE

T2 - 38th International Conference on Machine Learning, ICML 2021

AU - Cheng, Wuxinlin

AU - Deng, Chenhui

AU - Zhao, Zhiqiang

AU - Cai, Yaohui

AU - Zhang, Zhiru

AU - Feng, Zhuo

PY - 2021

Y1 - 2021

N2 - A black-box spectral method is introduced for evaluating the adversarial robustness of a given machine learning (ML) model. Our approach, named SPADE, exploits bijective distance mapping between the input/output graphs constructed for approximating the manifolds corresponding to the input/output data. By leveraging the generalized Courant-Fischer theorem, we propose a SPADE score for evaluating the adversarial robustness of a given model, which is proved to be an upper bound of the best Lipschitz constant under the manifold setting. To reveal the most non-robust data samples highly vulnerable to adversarial attacks, we develop a spectral graph embedding procedure leveraging dominant generalized eigenvectors. This embedding step allows assigning each data sample a robustness score that can be further harnessed for more effective adversarial training. Our experiments show the proposed SPADE method leads to promising empirical results for neural network models that are adversarially trained with the MNIST and CIFAR-10 data sets.

AB - A black-box spectral method is introduced for evaluating the adversarial robustness of a given machine learning (ML) model. Our approach, named SPADE, exploits bijective distance mapping between the input/output graphs constructed for approximating the manifolds corresponding to the input/output data. By leveraging the generalized Courant-Fischer theorem, we propose a SPADE score for evaluating the adversarial robustness of a given model, which is proved to be an upper bound of the best Lipschitz constant under the manifold setting. To reveal the most non-robust data samples highly vulnerable to adversarial attacks, we develop a spectral graph embedding procedure leveraging dominant generalized eigenvectors. This embedding step allows assigning each data sample a robustness score that can be further harnessed for more effective adversarial training. Our experiments show the proposed SPADE method leads to promising empirical results for neural network models that are adversarially trained with the MNIST and CIFAR-10 data sets.

UR - https://www.scopus.com/pages/publications/85147978650

UR - https://www.scopus.com/pages/publications/85147978650#tab=citedBy

M3 - Conference contribution

T3 - Proceedings of Machine Learning Research

SP - 1814

EP - 1824

BT - Proceedings of the 38th International Conference on Machine Learning, ICML 2021

PB - ML Research Press

Y2 - 18 July 2021 through 24 July 2021

ER -

SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation

Abstract

Publication series

Conference

ASJC Scopus subject areas

Other files and links

Fingerprint

Cite this