Is Robustness the Cost of Accuracy? — A Comprehensive Study of the Robustness of 18 Deep Image Classification Models

1. 01What problem does this paper attempt to solve?

   The authors ask: does pursuing higher ImageNet accuracy come at the cost of adversarial robustness, and which factors affect robustness?

   Core question: Is there a trade-off between prediction accuracy and adversarial robustness in image classification models, and which model factors affect robustness.

   • Problem setting: The authors note that since AlexNet's breakthrough at ILSVRC 2012, DNN accuracy has continued to rise, but robustness has not been sufficiently studied; adversarial examples can apply perturbations to natural images that are imperceptible to the human eye and cause misclassification, and the authors cite research on a physical-world Stop sign being misrecognized to illustrate the real-world risk.
   • Existing gaps: The authors argue that accuracy has long been the sole criterion for comparing models (including the ImageNet competition), that robustness lacks a systematic benchmark, and that existing work is mostly a single attack or theoretical estimation, lacking comprehensive comparison across a large number of models.
   • Core observation: The authors hypothesize that robustness can be jointly characterized by adversarial attack distortion, success rate, transferability, and attack-agnostic metrics, and that 18 models spanning 7 architecture families with varying sizes and accuracies are suitable for analyzing influencing factors.
   • Paper output: A robustness benchmark study covering 18 ImageNet models, including transfer attack experiments on 306 model pairs, an accuracy-robustness Pareto frontier, and publicly released experiment code (the authors state it has been released; the address is omitted).
   • Threat model:
     • Attacker goal: Generate adversarial examples that cause the model to misclassify (untargeted) or predict a specified target class (targeted, including random target and least likely target).
     • Attacker knowledge: The main experiments are white-box attacks, assuming full access to the target DNN; the transfer experiments correspond to a black-box setting, where the attacker has no explicit knowledge of the target model.
     • Attacker capability: Apply l1, l2, and l∞ norm perturbations to input images, using four attack algorithms: FGSM, I-FGSM, C&W, and EAD-L1.
     • Victim system: 18 pretrained ImageNet image classification models (7 architecture families).

   Collapse this answer

2. 02What related research exists?

   Related work is divided into four groups: adversarial attacks, attack-agnostic robustness estimation, black-box transfer attacks, and the accuracy-robustness relationship.

   Adversarial attack methods

   • FGSM (Goodfellow et al., 2015) — a single-step gradient sign attack, efficient but with a lower success rate; I-FGSM (Kurakin et al., 2017) makes it iterative, and the authors state it can fool networks in more than 99% of cases.
   • C&W attack (Carlini & Wagner, 2017) — formulates adversarial example generation as an optimization problem; the authors call it one of the strongest l2 attacks and state it can bypass 10 adversarial detection methods.
   • EAD-L1 attack (Chen et al., 2018) — penalizes distortion with elastic-net regularization (l1+l2); the authors state it has high transferability and can bypass multiple defenses.

   Attack-agnostic robustness estimation

   • Szegedy et al. (2014) and Hein & Andriushchenko (2017) — theoretically analyze the robustness of simple networks by estimating global and local Lipschitz constants, respectively.
   • CLEVER (Weng et al., 2018) — estimates a lower bound on the minimum adversarial distortion using extreme value theory; this paper uses it as an attack-agnostic metric; there is also work on robustness lower bounds based on ReLU linear approximation (Weng et al., ICML 2018).

   Black-box and transfer attacks

   • Liu et al. (2017), Papernot et al. (2016) — study adversarial example transferability and transfer-based black-box attacks; this paper's definition of transferability follows Liu et al.
   • ZOO (Chen et al., 2017), AutoZOOM (Tu et al., 2018), Cheng et al. (2018) — zeroth order optimization black-box attacks; the authors cite them to show that transfer attacks are widely used in the black-box setting.

   Relationship between accuracy and robustness

   • Stock & Cisse (2017) — study "robustness" at the level of label semantics and reach conclusions different from this paper's; the authors discuss this specifically in Section 5.5 of the supplementary material, arguing that the two definitions differ and the conclusions are complementary rather than contradictory.
   • Tsipras et al. (2019) — contemporaneous with this paper; the authors state that it proves an accuracy-robustness trade-off does exist in one specific simple setting, providing a technical explanation for this paper's results; Bubeck et al. (2018) prove the difficulty of learning robust models, which the authors state is consistent with this paper's findings.

   Baselines and benchmarks: this paper is an evaluation study and has no method baselines; the evaluation subjects are 18 ImageNet models (Table 1), and the dataset is a sample of the ImageNet validation set.

   The authors position this paper as follows: they state it is the first study to conduct a comprehensive robustness comparison of 18 mainstream ImageNet models, and that the 306-model-pair transferability experiment was the largest of its kind at the time.

   Collapse this answer

3. 03How does the paper address this problem?

   Using four white-box attacks plus the CLEVER score, 18 models are evaluated on uniformly sampled ImageNet images, with 306 transfer experiments.

   Overall approach: operationalize robustness as "how hard it is to generate adversarial examples," measure 18 models on the same image set using multiple attack algorithms and one attack-agnostic metric, then analyze the distortion-accuracy relationship and cross-model transferability.

   Problem setting and formalization

   • Let the original image be x0 and the adversarial image be x, with model F outputting a class; assume F(x0)=y0 (the true label), excluding images that were originally misclassified to avoid trivial attacks.
   • Untargeted attacks require x to be close to x0 and F(x)≠y0; targeted attacks specify a target class t (t≠y0) and require x to be close to x0 and F(x)=t.

   Evaluation methods (four attacks + one score)

   • FGSM: single-step attack, x ← clip[x₀ − ϵ  sgn(∇ J(x₀, t))], i.e., perturb by ε along the sign of the loss gradient and clip to the valid pixel range.
   • I-FGSM: FGSM iterated T times with a perturbation of ε/T per step; the authors note it can be viewed as PGD within the l∞ ball and typically finds examples with smaller l∞ distortion.
   • C&W attack: solves min_x λ f(x,t) + |x−x₀|₂² (subject to x∈[0,1]^p), where f is max{max_{i≠t}[Logit(x)_i − Logit(x)_t], −κ}; κ is the confidence, and larger κ generally improves transferability.
   • EAD-L1: adds an elastic-net regularizer β‖x−x0‖₁ to the C&W objective.
   • CLEVER: estimates a lower bound on the minimum adversarial distortion l_p based on extreme value theory; a higher score indicates the network may be more robust; it is attack-agnostic and reflects the network's intrinsic robustness.

   Data and metrics

   • Data: 1,000 images randomly sampled from the ImageNet validation set, each subjected to random target and least likely target targeted attacks and untargeted attacks; CLEVER uses only 100 of them due to high computational cost; supplementary experiments use 327 images correctly classified by all 18 models.
   • Four metrics: attack success rate (higher means less robust); l2 and l∞ distortion (higher means more robust; l2 is normalized by total pixel count for fair comparison across input sizes); CLEVER score (higher means more robust); transferability—error rate for untargeted, top-5 matching rate for targeted.
   • Parameter selection: binary search is used to select ε for I-FGSM and λ for C&W for each model, in order to find the adversarial examples with minimum distortion.

   Transferability experiment design

   • For all 306 model pairs, adversarial examples generated by the source model are used to attack the target model; row i, column j of the heatmap is the success proportion of transferring source model i's examples to target model j, and the diagonal is the source model's own attack success rate.
   • When input sizes differ, center cropping is applied from large to small sizes, and white borders are added from small to large sizes; the authors state that simple resizing would notably reduce transfer success rates.

   Success determination and fitting

   • Attack success is determined by whether the predicted label changes (untargeted) or hits the target class (targeted), with no LLM or human review.
   • Regression is performed on the models on the Pareto frontier (AlexNet, VGG 16, VGG 19, ResNet-v2-152, Inception-ResNet-v2, NASNet), fitting the linear relationship distortion = a + b·log(classification-error).

   Collapse this answer

4. 04What experiments did the paper conduct?

   18 models, 1,000 images, four attacks plus CLEVER; the main result is a Pareto frontier on which distortion decreases log-linearly with classification error.

   Experimental setup

   • Tested models: 18 ImageNet models belonging to 7 families—AlexNet; VGG 16/19; Inception-v1/v2/v3/v4, Inception-ResNet-v2; ResNet-v2-50/101/152; DenseNet-121-k32/169-k32/161-k48; MobileNet-0.25-128/0.50-160/1.0-224; NASNet (sizes and accuracies in Table 1, e.g., AlexNet 60M parameters top-1 56.9%, NASNet 88.9M parameters top-1 82.7%).
   • Data: 1,000 images randomly sampled from the ImageNet validation set (excluding images originally misclassified by each model); 100 of them used for CLEVER; 327 images all correctly classified used for supplementary experiments.
   • Attacks: FGSM, I-FGSM, C&W, EAD-L1, all performed as targeted (random / least likely target) and untargeted.
   • Metrics: attack success rate, l2/l∞ distortion, l2 CLEVER score, transferability (untargeted error rate, targeted top-5 matching rate).
   • Determination method: automatically determined by predicted label, with no human or LLM review; the paper does not report the number of repetitions.

   Main results

   Main results are presented as scatter plots and fitted equations (Figure 2, random target, measured when attack success rate is near 100%):

   Metric (attack/method)	Pareto fitted equation (per Figure 2 caption)
   l∞ distortion (I-FGSM)	[2.9·ln(1−acc)+6.2]×10⁻²
   Per-pixel l2 distortion (C&W)	[1.1·ln(1−acc)+2.1]×10⁻⁵
   l2 CLEVER score	[4.6·ln(1−acc)+12.5]×10⁻⁶

   • The authors state that all three metrics change log-linearly with classification error: taking I-FGSM as an example, halving the classification error is expected to reduce l∞ distortion by about 0.02, about 60% of AlexNet's distortion.
   • The authors state that AlexNet has the best robustness while MobileNet-0.50-160 is more fragile on all metrics, indicating that architecture affects robustness more than model size; models within the same family have similar robustness.
   • The authors observe that deeper models within the DenseNet, ResNet, and Inception families show slightly improved l∞ distortion.

   Attack success rate comparison (Figure 1)

   • FGSM: targeted success rate is below 3% in all settings, and increasing ε actually decreases the success rate; the authors accordingly state that FGSM is a weak attack and targeted attacks require iterative methods.
   • I-FGSM: Figure 1(c) shows that only 10 iterations suffice to achieve very high targeted success rates on all models; C&W and EAD-L1 are near 100% for almost all models at κ=0.
   • Exception for κ: The authors point out that attack success rate under large κ cannot be used as a robustness metric—MobileNet-0.50-160 has a success rate near 0 at κ=40, but Figure 2 shows it is one of the most fragile networks; the authors explain this as differing logit output ranges across networks, so the difficulty of reaching a fixed logit margin κ is unrelated to intrinsic robustness.

   Transferability experiments (Figures 3–5, 306 pairs)

   • Ordering across attacks: In the untargeted setting, transferability order is FGSM ≻ I-FGSM ≻ EAD-L1 ≻ C&W; increasing ε for FGSM, reducing iterations for I-FGSM, and increasing κ for EAD-L1 each improve transferability.
   • VGG stripe pattern: The authors state that adversarial examples generated by VGG 16/19 transfer notably better than those of other models in both targeted and untargeted settings and under all attack methods, forming "stripes" in the heatmaps; the authors suggest this may stem from VGG's simple convolutional structure and regard it as a good starting point for launching black-box transfer attacks.
   • Within-family transfer: In the I-FGSM untargeted setting, transfer rates between different depths within the same DenseNet, ResNet, and VGG families are near 100%, while cross-family transfer is much lower; transfer is sometimes asymmetric (VGG 16→Inception-v2 high, reverse low). The authors state this provides an opportunity to reverse-infer black-box model architectures.

   Other ablations and analyses

   • Subset experiment on 327 images all correctly classified (Figure 6): trends are consistent with the main results, with fitted equations l∞ dist=[4.3·ln(1−acc)+8.5]×10⁻², l2 dist=[9.0·ln(1−acc)+17.3]×10⁻⁶.
   • Least likely target (Figure 7): I-FGSM and C&W still have near 100% success rates, and the log-linear pattern is still observed.
   • C&W transferability (Figure 8): worse than I-FGSM and EAD-L1; increasing κ only slightly improves it.
   • I-FGSM with different ε (Figures 9, 10): larger ε gives better transferability, and fewer iterations gives better transferability.
   • Label semantics check (Figure 11): 96.6% of least likely targets have a WordNet shortest distance greater than 5 from the true label; the authors accordingly argue that the fragility does not come from a label sensitivity effect.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that the study is limited to image classification and believe the conclusions can transfer to tasks such as detection and captioning; the experiments cover only 18 models and ImageNet.

   Limitations and future directions noted by the authors

   • In the Conclusions section, the authors explicitly write that this study focuses on the image classification task and believe its findings can provide reference for other vision tasks that use the same pretrained classifiers for feature extraction (such as object detection and image captioning)—this is an extrapolation direction offered by the authors, not a verified conclusion.
   • In Section 3.3, the authors state that increasing depth within a family brings a small improvement in l∞ robustness that "may provide new ideas for designing robust networks and further improve the Pareto frontier"; this is a conjecture proposed by the authors.
   • In Section 3.4, the authors state that the within-family clustering phenomenon of transferability "provides an opportunity" to reverse-infer black-box model architectures, which is not implemented in this paper.
   • Apart from the above, the paper has no dedicated Limitations section discussing other limitations.

   Scope of experimental coverage

   • The tested models are 18 pretrained ImageNet models belonging to 7 architecture families (Table 1), all models from between 2012 and 2017.
   • The dataset is ImageNet only: 1,000 validation images for attacks, 100 for CLEVER, and 327 for subset validation experiments.
   • The attack methods cover four types—FGSM, I-FGSM, C&W, and EAD-L1—plus the attack-agnostic CLEVER score; the perturbation norms are l1, l2, and l∞.
   • The transfer experiments cover all 306 model pairs, including both targeted (top-5 matching rate) and untargeted (error rate).
   • The paper does not report the number of experimental repetitions, confidence intervals for the fits, or statistical significance tests; the Pareto frontier fit is performed only on the 6 models on the frontier (AlexNet, VGG 16, VGG 19, ResNet-v2-152, Inception-ResNet-v2, NASNet).

   Collapse this answer

6. 06Summarize the main content of the paper

   A robustness benchmark study of 18 ImageNet models; the authors state that there is a trade-off between accuracy and robustness and that architecture is a key factor.

   This is a large-scale benchmark study of the adversarial robustness of ImageNet image classification models, addressing the question "does high accuracy come at the cost of robustness?"

   • Approach: Using four white-box attacks—FGSM, I-FGSM, C&W, and EAD-L1—and the attack-agnostic CLEVER score, 18 models (7 architecture families) are evaluated on a uniformly sampled set of 1,000 ImageNet validation images, and transfer attacks are performed on all 306 model pairs.
   • Linear scaling law: The authors state that l∞ distortion (I-FGSM), per-pixel l2 distortion (C&W), and l2 CLEVER score all change log-linearly with classification error, with fitted equations [2.9·ln(1−acc)+6.2]×10⁻², [1.1·ln(1−acc)+2.1]×10⁻⁵, and [4.6·ln(1−acc)+12.5]×10⁻⁶ respectively (Figure 2); according to the I-FGSM fit, halving the classification error is expected to reduce l∞ distortion by about 0.02.
   • Architecture and size: The authors state that models within the same family have similar robustness, and architecture is more critical than model size—the 60M-parameter AlexNet has the best robustness, while the 1.5M-parameter MobileNet-0.50-160 is more fragile on all metrics; deepening networks within the DenseNet, ResNet, and Inception families slightly improves l∞ robustness.
   • Transferability: The untargeted transferability order is FGSM ≻ I-FGSM ≻ EAD-L1 ≻ C&W; adversarial examples from VGG 16/19 transfer most strongly to all other models, while examples from the remaining models mostly transfer only within the same family (near 100% between different depths within a family).
   • Exceptions and checks: The authors point out that attack success rate under large κ cannot serve as a robustness metric (MobileNet-0.50-160 has a success rate near 0 at κ=40 but is actually fragile); supplementary experiments on the 327 images all correctly classified and on least likely targets reach consistent conclusions, with 96.6% of least likely targets having a WordNet distance greater than 5 from the true label.
   • Authors' conclusion: The authors believe that pursuing low test error alone makes models more vulnerable to attack, and recommend that ImageNet model designers use the accuracy-robustness Pareto frontier they provide to evaluate new networks; the authors state that this is the first comprehensive comparison across 18 models and that the transfer experiments were the largest at the time.

   Collapse this answer

Related papers