# Evaluating Adversarial Robustness with Expected Viable Performance

arXiv: https://arxiv.org/abs/2309.09928 · HTML: https://mlsanity.com/paper/2309.09928/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 22 references that are in the map.
- First posted on arXiv 18 Sep 2023.

## Builds on (most cited first, 14 of 14)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Robustness May Be at Odds with Accuracy](https://mlsanity.com/paper/1805.12152/) (2018)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach](https://mlsanity.com/paper/1801.10578/) (2018)
- [Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models](https://mlsanity.com/paper/1808.01688/) (2018)
- [Robustness and Accuracy Could Be Reconcilable by (Proper) Definition](https://mlsanity.com/paper/2202.10103/) (2022)
- [On the Connection Between Adversarial Robustness and Saliency Map Interpretability](https://mlsanity.com/paper/1905.04172/) (2019)
- [Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers](https://mlsanity.com/paper/1906.04948/) (2019)
- [Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations](https://mlsanity.com/paper/2002.04599/) (2020)
- [SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation](https://mlsanity.com/paper/2102.03716/) (2021)
- [Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness](https://mlsanity.com/paper/1906.02896/) (2019)
- [Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size](https://mlsanity.com/paper/1804.07870/) (2018)
- [Overcoming Adversarial Attacks for Human-in-the-Loop Applications](https://mlsanity.com/paper/2306.05952/) (2023)

## Abstract (arXiv)

We introduce a metric for evaluating the robustness of a classifier, with particular attention to adversarial perturbations, in terms of expected functionality with respect to possible adversarial perturbations. A classifier is assumed to be non-functional (that is, has a functionality of zero) with respect to a perturbation bound if a conventional measure of performance, such as classification accuracy, is less than a minimally viable threshold when the classifier is tested on examples from that perturbation bound. Defining robustness in terms of an expected value is motivated by a domain general approach to robustness quantification.