How many perturbations break this model? Evaluating robustness beyond adversarial accuracy. (arXiv:2207.04129v2 [cs.LG] UPDATED)

Robustness to adversarial attack is typically evaluated with adversarial
accuracy. This metric quantifies the number of points for which, given a threat
model, successful adversarial perturbations cannot be found. While essential,
this metric does not capture all aspects of robustness and in particular leaves
out the question of how many perturbations can be found for each point. In this
work we introduce an alternative approach, adversarial sparsity, which
quantifies how difficult it is to find a successful perturbation given both …

accuracy arxiv lg robustness