{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/190808016","title":"Testing Robustness Against Unforeseen Adversaries","arxiv_id":"1908.08016","date":"2019-08-21","proceeding":null,"authors":["Max Kaufmann","Daniel Kang","Yi Sun","Steven Basart","Xuwang Yin","Mantas Mazeika","Akul Arora","Adam Dziedzic","Franziska Boenisch","Tom Brown","Jacob Steinhardt","Dan Hendrycks"],"abstract":"Adversarial robustness research primarily focuses on L_p perturbations, and most defenses are developed with identical training-time and test-time adversaries. However, in real-world applications developers are unlikely to have access to the full range of attacks or corruptions their system will face. Furthermore, worst-case inputs are likely to be diverse and need not be constrained to the L_p ball. To narrow in on this discrepancy between research and reality we introduce ImageNet-UA, a framework for evaluating model robustness against a range of unforeseen adversaries, including eighteen new non-L_p attacks. To perform well on ImageNet-UA, defenses must overcome a generalization gap and be robust to a diverse attacks not encountered during training. In extensive experiments, we find that existing robustness measures do not capture unforeseen robustness, that standard robustness techniques are beat by alternative training strategies, and that novel methods can improve unforeseen robustness. We present ImageNet-UA as a useful tool for the community for improving the worst-case behavior of machine learning systems.","url_abs":"https://arxiv.org/abs/1908.08016v4","url_pdf":"https://arxiv.org/pdf/1908.08016v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"190808016","repo_url":"https://github.com/centerforaisafety/adversarial-corruptions","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"190808016","repo_url":"https://github.com/ddkang/advex-uar","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"190808016","repo_url":"https://github.com/gatheluck/Stronghold","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1908.08016","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1908.08016"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/centerforaisafety/adversarial-corruptions","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ddkang/advex-uar","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/gatheluck/Stronghold","reach":null}],"summary":{"ran_violates":1,"ran_draft_wrong":2,"unverified":15},"by_repo_kind":{"official":{"samples":17,"ran":2,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"c1e43d48e3be5a73","entry":"normalize_l2","repo":"centerforaisafety/adversarial-corruptions","repo_kind":"official","path":"attacks/attacks.py","file_url":"https://github.com/centerforaisafety/adversarial-corruptions/blob/HEAD/attacks/attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c1e43d48e3be5a73"}},{"code_sha256_prefix":"5b640b32a444ae38","entry":"tensor_clamp","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"5b640b32a444ae38"}},{"code_sha256_prefix":"0cf0b2e3ac7eb3ab","entry":"tensor_clamp_l2","repo":"centerforaisafety/adversarial-corruptions","repo_kind":"official","path":"attacks/attacks.py","file_url":"https://github.com/centerforaisafety/adversarial-corruptions/blob/HEAD/attacks/attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0cf0b2e3ac7eb3ab"}},{"code_sha256_prefix":"397083ca14c129e6","entry":"compute_uar","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_uar.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_uar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"397083ca14c129e6"}},{"code_sha256_prefix":"6b64dfab81078b74","entry":"fog_creator","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/fog.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/fog.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6b64dfab81078b74"}},{"code_sha256_prefix":"ae65e44ca288d223","entry":"get_attack","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_ata.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_ata.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ae65e44ca288d223"}},{"code_sha256_prefix":"5b9cee62b4db0aa5","entry":"get_attack_types","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_uar.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_uar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5b9cee62b4db0aa5"}},{"code_sha256_prefix":"a5fe600c6f90a29e","entry":"get_attacks","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_ata.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_ata.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"a5fe600c6f90a29e"}},{"code_sha256_prefix":"8cfbe3915f54e09f","entry":"get_defense_run_ids","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_uar.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_uar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8cfbe3915f54e09f"}},{"code_sha256_prefix":"d611a25ed152d734","entry":"get_eps_params","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/attacks.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d611a25ed152d734"}},{"code_sha256_prefix":"2c107ae31d213cb3","entry":"get_gabor","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/gabor.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/gabor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"2c107ae31d213cb3"}},{"code_sha256_prefix":"c6dc9d5916f95448","entry":"get_imagenet_params","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/attacks.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"c6dc9d5916f95448"}},{"code_sha256_prefix":"68e2adcd4a226d1f","entry":"normalize","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/gabor.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/gabor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"68e2adcd4a226d1f"}},{"code_sha256_prefix":"4195644f8fd630c7","entry":"parse_logs","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/analysis/compute_ata.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/analysis/compute_ata.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4195644f8fd630c7"}},{"code_sha256_prefix":"f377568c1b1b92e8","entry":"rgb_to_ycbcr","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/jpeg.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/jpeg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f377568c1b1b92e8"}},{"code_sha256_prefix":"76d91377101614b7","entry":"rgb_to_ycbcr_jpeg","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/jpeg.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/jpeg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"76d91377101614b7"}},{"code_sha256_prefix":"4b0cb77b372f4eef","entry":"tensordot_pytorch","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/jpeg.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/jpeg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4b0cb77b372f4eef"}},{"code_sha256_prefix":"603ca4e51314b267","entry":"valid_position","repo":"ddkang/advex-uar","repo_kind":"official","path":"advex_uar/attacks/gabor.py","file_url":"https://github.com/ddkang/advex-uar/blob/HEAD/advex_uar/attacks/gabor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"603ca4e51314b267"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}