How Worst-Case Are Adversarial Attacks? Linking Adversarial and Perturbation Robustness
Not on the map. Why?
Abstract (arXiv)
Adversarial attacks are widely used to identify model vulnerabilities; however, their validity as proxies for robustness to random perturbations remains debated. We ask whether an adversarial example provides a representative estimate of misprediction risk under stochastic perturbations of the same magnitude, or instead reflects an atypical worst-case event. To address this question, we introduce a probabilistic analysis that quantifies this risk with respect to directionally biased perturbation distributions, parameterized by a concentration factor kappa that interpolates between isotropic noise and adversarial directions. Building on this, we study the limits of this connection by proposing an attack strategy designed to probe vulnerabilities in regimes that are statistically closer to uniform noise. Experiments on ImageNet and CIFAR-10 systematically benchmark multiple attacks, revealing when adversarial success meaningfully reflects robustness to perturbations and when it does not, thereby informing their use in safety-oriented robustness evaluation.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 30 of its 38 references that are in the map. First posted on arXiv 20 Jan 2026.
Builds on
30 of 38 references.
References · 30
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Wide Residual Networkscited by 3,057
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2017Visualizing the Loss Landscape of Neural Netscited by 1,126
- 2021A Survey of Uncertainty in Deep Neural Networkscited by 675
18 more
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2016Robustness of classifiers: from adversarial to random noisecited by 87
- 2015Analysis of classifiers' robustness to adversarial perturbationscited by 76
- 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
- 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
- 2018Classification Uncertainty of Deep Neural Networks Based on Gradient Informationcited by 43
- 2020Random Smoothing Might be Unable to Certify ℓ_∞ Robustness for High-Dimensional Imagescited by 35
- 2021Disrupting Deep Uncertainty Estimation Without Harming Accuracycited by 19
- 20231-Lipschitz Layers Compared: Memory, Speed, and Certifiable Robustnesscited by 15
- 2018The Limitations of Model Uncertainty in Adversarial Settingscited by 14
- 2022How many perturbations break this model? Evaluating robustness beyond adversarial accuracycited by 9
- 2024Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolumecited by 3
- 2025Benchmarking the Spatial Robustness of DNNs via Natural and Adversarial Localized Corruptionscited by 3
- 2022Testing robustness of predictions of trained classifiers against naturally occurring perturbationscited by 2
- 2025Rethinking Robustness in Machine Learning: A Posterior Agreement Approachcited by 1
Built on by
Not cited yet.