Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Rethinking Empirical Evaluation of Adversarial Robustness Using
  First-Order Attack Methods   We identify three common cases that lead to overestimation of adversarial
accuracy against bounded first-order attack methods, which is popularly used as
a proxy for adversarial robustness in empirical studies. For each case, we
propose compensation methods that either address sources of inaccurate gradient
computation, such as numerical instability near zero and non-differentiability,
or reduce the total number of back-propagations for iterative attacks by
approximating second-order information. These compensation methods can be
combined with existing attack methods for a more precise empirical evaluation
metric. We illustrate the impact of these three cases with examples of
practical interest, such as benchmarking model capacity and regularization
techniques for robustness. Overall, our work shows that overestimated
adversarial accuracy that is not indicative of robustness is prevalent even for
conventionally trained deep neural networks, and highlights cautions of using
empirical evaluation without guaranteed bounds.

12
The categories of this paper are: nucl-th
4
The categories of this paper are: cond-mat
7
The categories of this paper are: hep-th
9
The categories of this paper are: nlin
37
The categories of this paper are: supr-con
30
The categories of this paper are: q-alg
13
The categories of this paper are: quant-ph
3
The categories of this paper are: physics
15
The categories of this paper are: nucl-ex
35
The categories of this paper are: mtrl-th
19
The categories of this paper are: eess
0
The categories of this paper are: hep-ph
28
The categories of this paper are: alg-geom
23
The categories of this paper are: solv-int
21
The categories of this paper are: adap-org
2
The categories of this paper are: math