adversarial robustness evaluation

**Adversarial Robustness Evaluation** is the **systematic assessment of a model's resistance to adversarial attacks** — measuring how much imperceptible perturbation is needed to change the model's prediction, using standardized attack methods and metrics. **Evaluation Methodology** - **Attacks**: PGD (Projected Gradient Descent), AutoAttack, C&W (Carlini & Wagner), DeepFool. - **Metrics**: Adversarial accuracy (accuracy under attack), minimum perturbation distance, certified radius. - **Norms**: Evaluate under $L_infty$, $L_2$, and $L_1$ perturbation budgets ($epsilon$-balls). - **Benchmarks**: RobustBench provides standardized leaderboards for adversarial robustness. **Why It Matters** - **Security**: Quantifies how vulnerable a model is to adversarial manipulation. - **Standardization**: AutoAttack provides a reliable, standardized evaluation (avoids "gradient masking" that fools weaker attacks). - **Trade-Off**: Adversarial robustness typically trades off against clean accuracy — evaluation quantifies this trade-off. **Adversarial Robustness Evaluation** is **stress-testing against worst-case inputs** — measuring how resistant the model is to deliberately crafted adversarial perturbations.