[Paper Review] PRoA: A Probabilistic Robustness Assessment against Functional Perturbations

Tianle Zhang, Wenjie Ruan+1 more|arXiv (Cornell University)|Jul 5, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

PRoA introduces a scalable, probabilistic robustness assessment framework for deep neural networks that uses adaptive concentration inequalities to statistically bound the likelihood of failure under functional perturbations—such as rotation, blurring, and color shifts—offering provable guarantees without requiring assumptions about network architecture. It outperforms state-of-the-art baselines in certified accuracy across diverse models and perturbation types, including ResNetV2-50 and Vision Transformers.

ABSTRACT

In safety-critical deep learning applications robustness measurement is a vital pre-deployment phase. However, existing robustness verification methods are not sufficiently practical for deploying machine learning systems in the real world. On the one hand, these methods attempt to claim that no perturbations can ``fool'' deep neural networks (DNNs), which may be too stringent in practice. On the other hand, existing works rigorously consider $L_p$ bounded additive perturbations on the pixel space, although perturbations, such as colour shifting and geometric transformations, are more practically and frequently occurring in the real world. Thus, from the practical standpoint, we present a novel and general {\it probabilistic robustness assessment method} (PRoA) based on the adaptive concentration, and it can measure the robustness of deep learning models against functional perturbations. PRoA can provide statistical guarantees on the probabilistic robustness of a model, extit{i.e.}, the probability of failure encountered by the trained model after deployment. Our experiments demonstrate the effectiveness and flexibility of PRoA in terms of evaluating the probabilistic robustness against a broad range of functional perturbations, and PRoA can scale well to various large-scale deep neural networks compared to existing state-of-the-art baselines. For the purpose of reproducibility, we release our tool on GitHub: \url{ https://github.com/TrustAI/PRoA}.

Motivation & Objective

• To address the limitations of deterministic robustness verification, which assumes no adversarial examples exist within an epsilon-ball, by shifting focus to probabilistic robustness.
• To enable robustness assessment under realistic, non-additive functional perturbations such as geometric transformations and image corruptions, which are common in real-world deployments.
• To develop a method that is agnostic to neural network architecture, enabling evaluation of large-scale, state-of-the-art black-box models.
• To provide statistical guarantees on the failure probability of a model under perturbation, with provable confidence intervals.
• To improve scalability and efficiency over existing methods by using an adaptive sampling strategy that terminates early when sufficient confidence is reached.

Proposed method

• PRoA employs an adaptive concentration inequality framework to estimate the probability of adversarial examples under functional perturbations, dynamically adjusting the number of samples based on ongoing statistical confidence.
• It formulates the robustness assessment as a sequential hypothesis test, where sampling continues until the estimated failure probability falls within a user-defined tolerance level with high confidence.
• The method does not assume any specific structure of the neural network, making it applicable to arbitrary black-box models, including ResNet, EfficientNet, and Vision Transformers.
• It uses random sampling of perturbed inputs from a functional threat model (e.g., rotation, blurring, hue shift) and evaluates the model’s prediction to estimate the failure rate.
• The approach leverages confidence intervals derived from the Agresti–Coull method and compares them to the adaptive sampling results to ensure statistical validity.
• The algorithm terminates early when the confidence bounds allow a decision to be made, avoiding unnecessary sampling and improving efficiency.

Experimental results

Research questions

• RQ1 Can a probabilistic robustness assessment framework provide provable guarantees on the failure probability of deep neural networks under realistic functional perturbations?
• RQ2 How does PRoA’s adaptive sampling strategy compare to fixed-sample methods in terms of efficiency and accuracy across diverse perturbation types?
• RQ3 To what extent can PRoA scale to large, state-of-the-art deep neural networks without architectural assumptions?
• RQ4 Does PRoA achieve higher certified accuracy than existing methods like Agresti–Coull and SRC under the same confidence level?
• RQ5 How does the computational cost of PRoA vary with model complexity and perturbation type?

Key findings

• PRoA achieves the highest certified accuracy across all evaluated models and perturbation types, with ResNetV2-50 attaining 54% certified accuracy under rotation and 40% under brightness/contrast perturbations.
• For the Gaussian blurring perturbation, PRoA required the least average runtime (3.89 seconds) compared to Agresti–Coull (6.38 sec) and SRC (5.72 sec), demonstrating superior efficiency under complex perturbations.
• On the Vision Transformer (ViT-Base), PRoA achieved 41% certified accuracy under rotation and 34% under brightness/contrast, outperforming both Agresti–Coull and SRC.
• The average number of samples required by PRoA increased with model size and perturbation complexity, but remained reasonable—e.g., 7,260 samples on ViT-Base for rotation with a standard deviation of 80.11.
• PRoA’s adaptive sampling strategy reduced redundant computation, especially in high-complexity scenarios like Gaussian blurring, where it terminated earlier than fixed-sample baselines.
• The method demonstrated strong scalability, successfully certifying robustness for models including ResNetV2-50, EfficientNet-B0, and ViT-Base-Patch16-224 under diverse functional threat models.