# CARBEN: Composite Adversarial Robustness Benchmark

arXiv: https://arxiv.org/abs/2207.07797 · HTML: https://mlsanity.com/paper/2207.07797/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 9 references that are in the map.
- First posted on arXiv 16 Jul 2022.

## Builds on (most cited first, 9 of 9)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [RobustBench: a standardized adversarial robustness benchmark](https://mlsanity.com/paper/2010.09670/) (2020)
- [EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples](https://mlsanity.com/paper/1709.04114/) (2017)
- [Perceptual Adversarial Robustness: Defense Against Unseen Threat Models](https://mlsanity.com/paper/2006.12655/) (2020)
- [Semantic Adversarial Examples](https://mlsanity.com/paper/1804.00499/) (2018)
- [Composite Adversarial Attacks](https://mlsanity.com/paper/2012.05434/) (2020)
- [Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations](https://mlsanity.com/paper/2202.04235/) (2022)

## Built on by (most cited first, 5 of 5)

- [Better Diffusion Models Further Improve Adversarial Training](https://mlsanity.com/paper/2302.04638/) (2023)
- [SecurityNet: Assessing Machine Learning Vulnerabilities on Public Models](https://mlsanity.com/paper/2310.12665/) (2023)
- [Efficient Search of Comprehensively Robust Neural Architectures via Multi-fidelity Evaluation](https://mlsanity.com/paper/2305.07308/) (2023)
- [Position: Towards Resilience Against Adversarial Examples](https://mlsanity.com/paper/2405.01349/) (2024)
- [Multi-objective Evolutionary Search of Variable-length Composite Semantic Perturbations](https://mlsanity.com/paper/2307.06548/) (2023)

## Abstract (arXiv)

Prior literature on adversarial attack methods has mainly focused on attacking with and defending against a single threat model, e.g., perturbations bounded in Lp ball. However, multiple threat models can be combined into composite perturbations. One such approach, composite adversarial attack (CAA), not only expands the perturbable space of the image, but also may be overlooked by current modes of robustness evaluation. This paper demonstrates how CAA's attack order affects the resulting image, and provides real-time inferences of different models, which will facilitate users' configuration of the parameters of the attack level and their rapid evaluation of model prediction. A leaderboard to benchmark adversarial robustness against CAA is also introduced.