Assessing Robustness via Score-Based Adversarial Image Generation
Marcel Kollovieh Lukas Gosch Yan Scholten Marten Lienen Stephan Günnemann
Most adversarial attacks and defenses focus on perturbations within small
$\ell_p$-norm constraints. However, $\ell_p$ threat models cannot capture all
relevant semantic-preserving perturbations, and hence, the scope of robustness
evaluations is limited. In this work, we introduce Score-Based Adversarial
Generation (ScoreAG), a novel framework that leverages the advancements in
score-based generative models to generate adversarial examples beyond
$\ell_p$-norm constraints, so-called unrestricted adversarial examples,
overcoming their limitations. Unlike traditional methods, ScoreAG maintains the
core semantics of images while generating realistic adversarial examples,
either by transforming existing images or synthesizing new ones entirely from
scratch. We further exploit the generative capability of ScoreAG to purify
images, empirically enhancing the robustness of classifiers. Our extensive
empirical evaluation demonstrates that ScoreAG matches the performance of
state-of-the-art attacks and defenses across multiple benchmarks. This work
highlights the importance of investigating adversarial examples bounded by
semantics rather than $\ell_p$-norm constraints. ScoreAG represents an
important step towards more encompassing robustness assessments.