Adversarial Risk and the Dangers of Evaluating Against Weak Attacks

Understand

This paper investigates recently proposed approaches for defending against adversarial examples and evaluating adversarial robustness.

• We motivate 'adversarial risk' as an objective for achieving models robust to worst-case inputs.
• We then frame commonly used attacks and evaluation metrics as defining a tractable surrogate objective to the true adversarial risk.
• This suggests that models may optimize this surrogate rather than the true adversarial risk.