[1] [1]

[cor1]Corresponding author

# Efficient Search of Comprehensively Robust Neural Architectures via Multi-
fidelity Evaluation

Jialiang Sun Wen Yao Tingsong Jiang Xiaoqian Chen Defense Innovation
Institute, Chinese Academy of Military Science, Beijing 100071, China

###### Abstract

Neural architecture search (NAS) has emerged as one successful technique to
find robust deep neural network (DNN) architectures. However, most existing
robustness evaluations in NAS only consider $l_{\infty}$ norm-based
adversarial noises. In order to improve the robustness of DNN models against
multiple types of noises, it is necessary to consider a comprehensive
evaluation in NAS for robust architectures. But with the increasing number of
types of robustness evaluations, it also becomes more time-consuming to find
comprehensively robust architectures. To alleviate this problem, we propose a
novel efficient search of comprehensively robust neural architectures via
multi-fidelity evaluation (ES-CRNA-ME). Specifically, we first search for
comprehensively robust architectures under multiple types of evaluations using
the weight-sharing-based NAS method, including different $l_{p}$ norm attacks,
semantic adversarial attacks, and composite adversarial attacks. In addition,
we reduce the number of robustness evaluations by the correlation analysis,
which can incorporate similar evaluations and decrease the evaluation cost.
Finally, we propose a multi-fidelity online surrogate during optimization to
further decrease the search cost. On the basis of the surrogate constructed by
low-fidelity data, the online high-fidelity data is utilized to finetune the
surrogate. Experiments on CIFAR10 and CIFAR100 datasets show the effectiveness
of our proposed method.

###### keywords:

Model robustness adversarial attacksneural architecture search surrogate model

##  1 Introduction

Deep neural network (DNN) has achieved notable success in various computer
vision tasks, including image classification [1, 2], object detection [3, 4],
and semantic segmentation [5]. However, the majority of works have proved that
adding the specific perturbations can make DNN output wrong results [6, 7, 8].
The images with perturbations are called adversarial examples (AEs), which can
bring a huge threat to the real-world application of DNN, such as auto driving
and face recognition systems. Therefore, improving the robustness of DNN has
attracted the increasing attention of researchers.

Over the past years, to improve the robustness of DNN against AEs, various
defensed methods are developed, such as the defensive distillation [9],
dimensionality reduction [10], input transformations [11], and adversarial
training [12, 13, 14]. Recently, intrinsically robust architectures have been
increasing researchers’ attention. Designing intrinsically robust
architectures can also easily combine other defense techniques, such as
adversarial training to further enhance the robustness of DNN models. However,
manually-design needs to take a large burden, and the designed architecture
may not possess superior performance. As an emerging tool, neural architecture
search (NAS) [15, 16, 17] have been developed to help automatically find more
robust architectures. NAS can not only release human labor but also improve
the performance of models.

The core objective of NAS is to find near-optimal neural architectures by
searching in a predefined model search space. During the search process, the
key procedure includes defining the search space, performance evaluation, and
conducting the search strategy. In the NAS works, the adopted strategies are
evolutionary algorithm [18], bayesian optimization [19], reinforcement
learning [20], gradient-based optimization [21], and weight sharing based
search algorithm [22]. The gradient-based optimization method is
differentiable, while others are non-differentiable. Among these NAS methods,
the process of the weight-sharing-based search algorithm includes training the
supernet consisting of all possible sub-network and searching in the trained
supernet, which can reduce the computational burden of training each candidate
architecture from scratch.

With the rapid development of NAS techniques, more recent works have been
devoted to improving the robustness of DNN models. The earliest work about NAS
for robust architectures is RobNet, proposed by Guo et al. [23], which can
find more robust architectures under projected gradient descent (PGD) attack
using weight sharing based architecture search method. To improve the
performance of the searched architectures, many search strategies are also
combined into NAS for robust architectures, which can be categorized into
differentiable and non-differentiable based. Among the former methods,
Hosseini et al. [24] utilized the differentiable architecture search method to
efficiently find robust architectures by taking the $F$ norm of the Jacobian
matrix as the robustness evaluation. Mok et al. [25] further considered the
$F$ norm of the Hessian matrix in the evaluation of differentiable NAS. Among
the latter methods, Liu et al. [26] proposed to find robust architectures
against multiple $l_{\infty}$ norm attacks by using evolutionary algorithms.
In general, the robustness evaluation metrics are indirect during
differentiable NAS, while that in non-differentiable NAS can be direct, such
as the robust accuracy of models under adversarial attacks.

(a) Clean

(b) Hue

(c) Saturation

(d) Rotation

(e) Brightness

(f) Contrast

(g) FGSM-$\mathscr{l}_{\infty}$

(h) PGD-$\mathscr{l}_{\infty}$

(i) MI Attack-$\mathscr{l}_{\infty}$

(j) PGD-$\mathscr{l}_{2}$

(k) MI Attack–$\mathscr{l}_{2}$

(l) CAA

Figure 1: The illustration of adversarial examples generated by different
attack methods.

Though many works above-mentioned have been developed to find more robust
neural architectures by NAS techniques, they only focus on improving the
robustness under $l_{\infty}$ norm-based adversarial attacks. It remains an
open problem to find comprehensively robust architectures under multiple types
of evaluations, including different types of $l_{p}$ $(p=2,\infty)$ norm-based
adversarial attacks, semantic adversarial attacks [27, 28, 29] and composite
adversarial attack (CAA) [38]. An illustration of different types of attacks
is presented in Figure 1. When comprehensively robust neural architectures are
hoped to be found by NAS, the largest challenge is the huge computational cost
of robustness performance evaluation. The robustness evaluation under
adversarial attack is farther slower than the standard accuracy, which is also
called clean accuracy. In addition, increasing the type of robustness
evaluation would also further increase the computational cost. These problems
will incur that even though the surrogate model technique [30] is applied to
predict the robustness performance of neural architectures, preparing the
training data consisting of hundreds of data pairs still needs to take a huge
computational burden.

To address the above limitations, this work introduces a novel approach for
discovering comprehensively robust neural network architectures using a multi-
fidelity surrogate-based evolutionary algorithm that incorporates multiple
types of robustness evaluations. The key contributions of this work can be
succinctly stated as follows:

  * •

We first propose to search for comprehensively robust architectures under
multiple types of evaluations using the weight-sharing-based NAS method,
including different $l_{p}$ norm attacks, semantic adversarial attacks, and
composite adversarial attacks.

  * •

We reduce the number of robustness evaluations by the correlation analysis,
which can incorporate similar evaluations and decrease the evaluation cost.

  * •

We propose to decrease the search cost through multi-fidelity evaluations. A
multi-fidelity online surrogate during optimization is constructed. On the
basis of the surrogate constructed by low-fidelity data, the online high-
fidelity data is utilized to finetune the surrogate.

The paper is structured as follows: In Section 2, a brief introduction will be
provided on the related techniques used in this work. Section 3 will elaborate
on the proposed approach to search for comprehensively robust neural
architectures in detail, including encoding, correlation analysis for
different evaluations, the multi-fidelity surrogate, and the search framework
based on the archive. Experimental settings and results are presented in
Section 4. Finally, we make conclusions and discuss future work in Section 5.

##  2 Background

This section introduces the background of adversarial attacks and NAS for
robust neural architectures.

###  2.1 Adversarial Attacks

The goal of adversarial attacks is to generate specific perturbations to make
DNN models output wrong results. From the magnitude of the generated
perturbations, existing methods can be categorized into $l_{p}$ norm-based and
semantic adversarial attacks. In addition, composite adversarial attacks that
combine multiple types of adversarial attacks together are also developed. In
this section, we introduce the related work about $l_{p}$ norm adversarial
attack, semantic adversarial attack, and composite adversarial attack,
respectively.

####  2.1.1 $\mathscr{l}_{p}$-norm Adversarial Attacks

The $l_{p}$ norm-based adversarial attack is an optimization problem with the
constraint intrinsically, which can be formulated as Eq. 1.

$\begin{array}[]{l}\underset{\Delta
x}{\arg\max}\mathcal{L}\left(x_{adv},y;\mathcal{F}\right)\\\ x_{adv}=x+\Delta
x\\\ \text{ s.t. }\|\Delta x\|_{p}\leq\varepsilon\end{array}$ (1)

where $p$ represents the norm type of the perturbation such as $l_{2}$ and
$l_{\infty}$. $\mathcal{L}$ is the loss function. $x$ is the original image,
which is also called the clean image. $\Delta x$ stands for the perturbation,
whose magnitude is $\epsilon$. $\mathcal{F}$ is the DNN model. The true label
is denoted as $y$. $x_{adv}$ is the final generated adversarial example.

To solve Eq. 1, many adversarial attack algorithms have been developed. The
fast gradient sign method (FGSM) is the earliest adversarial attack method,
which was proposed by Goodfellow et al. [31], as shown in Eq. 2.

$x_{adv}=\operatorname{clip}_{[0,1]}\left\\{x+\epsilon\cdot\operatorname{sign}\left(\nabla_{x}\mathcal{L}(x,y;\mathcal{F})\right)\right\\}$
(2)

FGSM utilized the single-step updating strategy, which is easily trapped in
the local optimum. To solve the problem, Madry et al. [6] further developed
the multi-step updating method, PGD, which is presented in Eq. 3.

$x_{l+1}=\operatorname{project}\left\\{x_{l}+\epsilon_{step}\cdot\operatorname{sign}\left(\nabla_{x}\mathcal{L}\left(x_{l},y;\mathcal{F}\right)\right)\right\\}$
(3)

where $\epsilon_{step}$ denotes the magnitude of perturbation at each
iteration. In the above-mentioned process, the initial image can either be the
original image or a perturbed image resulting from random initialization.

Carlini and Wagner [32] proposed a modified loss function for adversarial
attacks. This loss function calculates the distance between the logit values
of the target label $y$ and the second most likely class, as shown in Eq. 4.

$\mathcal{L}_{CW}(x,y;\mathcal{F})=\max\left(\max_{i\neq
y}\left(\mathcal{F}(x)_{(i)}\right)-\mathcal{F}(x)_{(y)},-\kappa\right)$ (4)

where the parameter $\kappa$ serves to define the margin between the logit
value of the adversarial class and the logit value of the second most likely
class [33].

In addition to the adversarial attacks previously described, other works such
as MultiTargeted (MT) attack [34], Momentum Iterative (MI) attack [35], and
Decoupled Direction and Norm (DDN) attack [36] are also further developed.
These methods have been designed to further improve the performance of
adversarial attacks by changing the way gradients are updated, the magnitude
of perturbations, the number of attack iterations, and the loss functions
used.

####  2.1.2 Semantic Adversarial Attacks

For most of the semantic perturbations, the parameters that need to be
optimized are continuous. Under the white-box attack setting, the parameters
of semantic attacks can be updated by the gradient descent algorithm.
Specifically, the paragraph outlines how the parameters can be updated for
five different types of semantic perturbations, namely hue, saturation,
brightness, contrast, and rotation. To optimize these perturbations, the
iterative gradient sign method is extended for $T$ iterations, which is
defined as:

$\delta_{k}^{t+1}=\operatorname{clip}_{\epsilon_{k}}\left(\delta_{k}^{t}+\alpha\cdot\operatorname{sign}\left(\nabla_{\delta_{k}^{t}}J\left(\mathcal{F}\left(A_{k}\left(X;\delta_{k}^{t}\right)\right),y\right)\right)\right),$
(5)

where $t$ is the iteration number, $\mathcal{F}$ stands for the DNN model, $X$
denotes the input images, $y$ is the prediction label, $\epsilon_{k}$ is the
perturbation interval. Assume $\epsilon_{k}=[\alpha_{k},\beta_{k}]$, the
element-wise clipping operation $\operatorname{clip}_{\epsilon_{k}}$ is
expressed as:

$\operatorname{clip}_{\epsilon_{k}}(z)=\operatorname{clip}_{\left[\alpha_{k},\beta_{k}\right]}(z)=\left\\{\begin{aligned}
\alpha_{k}&\text{ if }z<\alpha_{k},\\\ z&\text{ if }\alpha_{k}\leq
z\leq\beta_{k},\\\ \beta_{k}&\text{ if }\beta_{k}<z\end{aligned}\right.$ (6)

The following description provides an explanation of each semantic attack.

Hue: The Hue attack can transfer clean images from RGB space to hue-
saturation-value (HSV) space, causing a dropping in accuracy. The Hue value
ranges from 0 to 2$\pi$. Hence, the maximum perturbation interval of Hue
attack is [-2$\pi$,2$\pi$] [37].

$x_{H}^{t}=\operatorname{Hue}\left(x_{\mathrm{adv}}^{t}\right)=\operatorname{clip}_{[0,2\pi]}\left(x_{H}+\delta_{H}^{t}\right)$
(7)

Saturation: The Saturation attack can change the colorfulness of clean images
by modifying the Saturation value, which ranges from 0 to 1. If the saturation
value tends to be 1, the image becomes more colorful, while that is a gray-
scale image if the saturation value is 0 [38].

$x_{S}^{t}=\operatorname{Sat}\left(x_{\text{adv
}}^{t}\right)=\operatorname{clip}_{[0,1]}\left(x_{S}\cdot\delta_{S}^{t}\right)$
(8)

Brightness and Contrast: Brightness and contrast are different from hue and
saturation in that they are defined in the RGB color space (pixel space) and
determine the brightness and darkness differences of images. In our
implementation, we first convert the images from the [0, 255] scale to the [0,
1] scale. The perturbation interval for brightness is defined as
$\epsilon_{B}=[\alpha_{B},\beta_{B}]$, where
$-1\leq\alpha_{B}\leq\beta_{B}\leq 1$, while for contrast it is defined as
$\epsilon_{C}=[\alpha_{C},\beta_{C}]$, where
$-1\leq\alpha_{C}\leq\beta_{C}\leq 1$.

Similarly to the hue and saturation attacks, we choose initial perturbations
$\delta^{0}_{B}$ and $\delta^{0}_{C}$ uniformly from $\epsilon_{B}$ and
$\epsilon_{C}$, respectively, and update them using equation 5. The perturbed
image $x^{t}_{adv}$ under the brightness attack is then obtained by adding the
perturbation to the original image x, clamping the resulting values to be
between 0 and 1, and scaling the result back to the [0, 255] scale. The
Brightness and Contrast attacks determine the lightness, darkness, and
brightness difference of images in RGB color space [37], which can be obtained
by Eq. 9.

$x_{\mathrm{adv}}^{t}=\operatorname{clip}_{[0,1]}\left(x+\delta_{B}^{t}\right)\text{
and
}x_{\mathrm{adv}}^{t}=\operatorname{clip}_{[0,1]}\left(x\cdot\delta_{C}^{t}\right)$
(9)

Rotation: The purpose of this transformation is to discover an angle of
rotation that maximizes the loss of the rotated image. The rotation algorithm
was developed by [39]. Assuming we have a square image $x$, we can denote a
pixel’s position as $\left(i,j\right)$, and the center of $x$ as
$\left(c,c\right)$. To calculate the new position
$\left(i^{\prime},j^{\prime}\right)$ of a pixel rotated by an angle of
$\theta$ degrees, we can use the following formula:

$\left[\begin{array}[]{l}i^{\prime}\\\
j^{\prime}\end{array}\right]=\left[\begin{array}[]{c}\cos\theta\cdot
i+\sin\theta\cdot j+(1-\cos\theta)\cdot c-\sin\theta\cdot c\\\
-\sin\theta\cdot i+\cos\theta\cdot j+\sin\theta\cdot c+(1-\cos\theta)\cdot
c\end{array}\right]$ (10)

####  2.1.3 Composite Adversarial Attacks

As for the white-box model, each attack above-mentioned can obtain the optimal
perturbations by iteratively updating according to the gradient of model
predictions. CAA constructed the mathematical model of combining multiple
types of attacks, which includes two modes, namely the fixed and scheduled.
The fixed one means that the ensemble attack with the fixed sequence is
utilized. The scheduled one means that the order of the attack sequence can be
adaptively adjusted with the batch data, achieving a higher attack success
rate. An illustration of the process of CAA is presented in Figure. 2. The
attack space includes five types of semantic adversarial attacks. When the
attack sequence is given, the input image would be fed to different attacks
subsequently. If the scheduled mode is selected, the order will be updated to
complete the semantic attack.

Figure 2: The illustration of composite adversarial attack.

###  2.2 NAS for Robust Architectures

Neural Architecture Search (NAS) is one technique that belongs to auto machine
learning (AutoML), whose objective is to automatically discover high-
performing neural network architectures from a given search space. To
accomplish this, various effective search strategies, such as reinforcement
learning, evolutionary algorithms, and Bayesian optimization, are utilized.
NAS methods can search architectures without much domain knowledge, further
improving the performance of DNN with the predefined evaluation metrics.

In previous works, much effort has been devoted to improving the clean
accuracy of DNN models. With the development of adversarial attack and defense
community, finding robust architectures has emerged as one increasing
direction. Thus over the past years, some works tried to apply NAS techniques
to find robust architectures against AEs. To realize that, the robustness
evaluation metrics are first needed to be determined. The efficient search
strategies can be combined to find robust architectures within the given
search space. In general, existing NAS methods for robust architectures can be
categorized into differentiable and non-differentiable based. The non-
differentiable-based methods evaluate the robustness of each architecture
using adversarial attacks like PGD during the search process. The processes of
searching and evaluating the architectures are separate, which is relatively
time-consuming. Guo et al. [23] applied the weight-sharing-based random search
to find robust network architectures toward PGD. There are also some works
that utilize evolutionary algorithms to find more robust architectures [40,
41, 42, 43]. Chen et al. [44] applied reinforcement learning algorithms to
find robust neural architectures. In contrast, the differentiable methods
adopt the differentiable metric into differentiable architecture search
methods, which greatly accelerates the search process. Hosseini et al. [24]
proposed DSRNA, which combines the quantified metrics, such as the norm of the
Jacobian matrix and certified lower bound, into the differential architecture
search to efficiently find robust model architectures. Mok et al. [25]
proposed AdvRush, which finds more robust architectures based on the $F$ norm
of the Hessian matrix. Qian et al. [45] defined the similarity between the
adversarial examples and clean examples in the feature space as the robustness
metric to guide the differentiable architecture search, which also realizes
the search of robust architectures. Their method is termed RNAS. Ou et al.
[46] developed the two-stage training method in differentiable architecture
search in their carefully crafted search space. Dong et al. [50] proposed
RACL, which combines the Lipschitz constant into the differentiable NAS method
to find robust architectures. Though these above-mentioned works have been
developed in the community of NAS for robust architectures, the related work
that finds comprehensively more robust architectures has not been explored due
to the higher computational burden.

##  3 Proposed Method

Deep neural networks (DNNs) have proved to be vulnerable to adversarial
attacks, and the robustness performance of a model can vary depending on the
type of adversarial attack. Thus to find a comprehensively robust neural
architecture, the robust accuracy of models under multiple types of attacks is
needed to be considered. Unfortunately, evaluating the robustness using all
types of adversarial attacks can lead to a huge computational burden. To
address the above challenges, we propose an algorithm to search for robust
architectures, termed ES-CRNA-ME in short. ES-CRNA-ME is designed to search
for neural architectures that are less sensitive to different types of
adversarial attacks.

Figure 3: The framework of the proposed efficient search of comprehensively
robust neural architectures via multi-fidelity evaluation.

In the following, we will elaborate on the main components of the proposed
algorithm. We start with the encoding strategy, followed by a description of
the correlation analysis for reducing the type of robustness evaluations. Then
the multi-fidelity surrogate model in our proposed method is introduced.
Lastly, we will describe the whole framework of the proposed method.

###  3.1 Encoding

This work employs the cell-based search space proposed by Zoph et al. [47]
consisting of normal and reduction cells. Normal cells do not change the size
of the feature map, while reduction cells reduce that half. In this space,
each cell consists of seven nodes, where the first two nodes are inputs from
the two previous cells, which are denoted as $c$$\\_$k-2 and $c$$\\_$k-1,
respectively. The number of intermediate nodes is four, which are denoted as
0, 1, 2, and 3. Two edges are allowed to connect between any two nodes. Each
edge can take one of several predefined operations. At last, the outputs of
four intermediate nodes will be combined as inputs and enter the seventh node
together, whose output is denoted as $c$$\\_$k, which is also the output of
the current cell. In this way, the whole neural architecture can be
represented by a connected directed acyclic graph (DAG). To encode this type
of architectures, the adopted encoding method is the same as that proposed by
Liu et al. [41] in previous work. In normal cells and reduction cells, each
node receives information from two other nodes. For a given node, we need to
determine which node the inputs come from and which operation operator to
select for the edge between the two nodes. Thus, four variables can determine
the input configuration of a node. Because there are eight nodes in two types
of cells in total, we can use the 32-dimensional decision variables to
represent a neural architecture. For example, the sequence that represents
each cell is divided into four segments. Each segment has two tuples. In each
tuple, the first bit indicates the operation to be performed, and the second
bit indicates which nodes this node is connected to. A normal cell, for
instance, is encoded by the segment ‘[(3, 1), (1, 0)]’, indicating that nodes
1 and 0 have operations ‘skip$\\_$connect’ and ‘max$\\_$3x3’ applied to them,
respectively. In the encoding, two input nodes are denoted as 0 and 1. An
illustration of encoding this type of architecture can be seen in Figure 4.
The search space includes eight operations, namely none, max$\\_$pool$\\_$3x3,
avg$\\_$pool$\\_$3x3,
sep$\\_$conv$\\_$3x3, dil$\\_$conv$\\_$3x3, skip$\\_$connect,
sep$\\_$conv$\\_$5x5, and sep$\\_$conv$\\_$5x5. In Figure 4, we simplify some
operations to easier representations.

Figure 4: The encode strategy in our proposed method.

###  3.2 Correlation analysis for different evaluations

The core idea of weight-sharing-based architecture search is first to
construct the supernet consisting of all possible subpaths. Each subpath
represents a sub-model. After the supernet is trained, the evolutionary
algorithm can be easily combined to find the near-optimal architecture. In
this process, the robustness evaluation on the trained supernet is needed to
be performed. Though weight-sharing-based architecture search can decrease the
search cost greatly, it does not solve the computational burden due to the
consideration of searching for comprehensively robust architectures. In
particular, with the increasing number of the type of evaluations, the
computational cost of robustness evaluation can further increase.

To alleviate this problem, in this work, we propose to utilize correlation
analysis to reduce the number of robustness evaluations by incorporating
similar evaluations. Assume that there exist $n$ evaluations, which are
expressed as

$F=\\{{{f}_{1}},{{f}_{2}},\cdots,{{f}_{n}}\\}$ (11)

where $f$ is the function to calculate the robust accuracy under the
adversarial attack. The robust accuracy is calculated as

$Robust\text{ }Accuracy\text{ =}\frac{{{n}_{adv}}}{{{n}_{total}}}$ (12)

where ${n}_{total}$ stands for the number of total test samples that are
generated by the adversarial attack. ${n}_{adv}$ denotes the number of
examples that are predicted rightly. In this paper, 11 adversarial attacks are
considered. Thus, 11 robust accuracies are calculated. Besides, the clean
accuracy of the model is also taken as one of the objectives, which is defined
as the accuracy of the model on the clean examples that are not perturbed by
any adversarial attack. Hence, there exist 12 evaluations of the accuracy of
the models in total.

Then we sample some architectures from the supernet and evaluate their robust
accuracies. If two types of evaluation are similar, we will merge them
together. The similarity adopts the correlation value as a metric. In this
way, $n$ evaluations can be further reduced to $m$ evaluations.

$\tilde{F}=\\{{{\tilde{f}}_{1}},{{\tilde{f}}_{2}},\cdots,{{\tilde{f}}_{m}}\\}\
$ (13)

The robust accuracy of models is estimated as Eq. 14.

$RA=\frac{{{k}_{1}}{{{\tilde{f}}}_{1}}+{{k}_{2}}{{{\tilde{f}}}_{2}}+\cdots+{{k}_{m}}{{{\tilde{f}}}_{m}}}{n}$
(14)

Assume the accuracy from ${{\tilde{f}}}_{m}$ to ${{\tilde{f}}}_{n}$ can be
represented by ${{\tilde{f}}}_{m}$. The coefficient ${k}_{m}$ of
${{{\tilde{f}}}_{m}}$ of Eq. 14 is calculated as

${{k}_{m}}=\frac{{{f}_{m}}+{{f}_{m+1}}+\cdots+{{f}_{n}}}{{{f}_{m}}}\ $ (15)

Other coefficients, including ${{k}_{i}}(i=1,2,...,m)$, can also be determined
by this way. Therefore, we just need to calculate the robust accuracy under
$m$ adversarial attacks rather than the original $n$ attacks.

###  3.3 Multi-fidelity surrogate

Though the above-mentioned correlation analysis can decrease the evaluation
cost to some extent, there still exist some evaluations under multiple types
of attacks that need to be performed. To further reduce the search cost, we
propose the multi-fidelity strategy that learns the mapping from the
architectures to the corresponding comprehensively robust accuracy. To realize
that, we use the Multilayer Perceptron (MLP) as the surrogate model. We first
train the surrogate using low-fidelity data. The low-fidelity evaluation means
that the robust accuracy of models is evaluated using a small number of data.
In contrast, the high-fidelity evaluation uses a large number of data to
calculate the robust accuracy of models. Hence, the high-fidelity evaluation
is more accurate. However, it is very time-consuming to train the surrogate
using a large number of high-fidelity evaluations. Thus, the low-fidelity data
can provide a good initialization for training the surrogate. Then we use the
high-fidelity data to update the surrogate iteratively.

###  3.4 The search framework based on the archive

Combined with the above two strategies to decrease the search cost, we
introduce the search framework based on the archive in the following. The
whole process of our proposed method is presented in Figure 3. The
corresponding pseudocode can be seen in Algorithm 1.

Algorithm 1 The procedure of the proposed ES-CRNA-ME

Input: The population size $N$, the maximal generation number $G$, the trained
supernet, different types of adversarial attacks
Output: The near-optimal trained architecture

1:Sample $m$ architectures from the supernet and evaluate their robust
accuracies using the supernet on different types of attacks

2:Calculate the correlation between different attacks and merge the similar
attacks according to Eq. 14

3:// Train the surrogate using low-fidelity data

4:Sample $n$ architectures from the supernet and evaluate their robust
accuracy using the low-fidelity data, then train the surrogate

5:Initialize the population $P$ with $N$ individuals by randomly generating
different architectures

6:High-fidelity evaluation: Evaluate the robust accuracy of population $P$
using high-fidelity data and preserve the results into the archive

7:for $t=0$ to $G$ do

8: Crossover and mutation: Generate $N$ offspring individuals through
crossover and mutation operations, and all the individuals are evaluated using
the trained surrogate

9: Selection: Select $N$ individuals to form the new population and $m$
individuals that are not in the archive to perform the next high-fidelity
evaluation

10: Evaluate these $m$ individuals using high-fidelity data

11: // Update the surrogate using high-fidelity data

12: Using the high-fidelity data finetune the trained surrogate model

13:end for

14:Obtain the best individual in the archive

15:Final training: Decode the best individual from the archive for the final
deep training

16:return The trained architecture

As presented in Figure 3 and Algorithm 1, ES-CRNA-ME starts with determining
the type of robustness evaluations according to the trained supernet, which is
described in Section 3.2. Some architectures are sampled from the supernet and
evaluated under different types of robustness evaluations. The correlation
analysis is performed to reduce the number of evaluations. Then we use the
low-fidelity data to train the surrogate model, which can substitute the
evaluation during evolutionary optimization for robust architectures.

Then based on the reduced robustness evaluation, the trained supernet, and the
surrogate model, we conduct the search for comprehensively robust
architectures. At first, the initial population with $n$ individuals is
randomly generated, which is all evaluated by high-fidelity data. We use an
archive to preserve high-fidelity data. In addition, all the high-fidelity
data is utilized to finetune the surrogate model. During the optimization, we
generate the offspring by the crossover and mutation operations iteratively.
When we conduct the selection operation, the evaluation of all individuals is
based on the prediction of the surrogate model. In this procedure, to
guarantee population diversity, if the selected individuals exist in the
archive, we will regenerate the individuals randomly. After $G$ generations,
the best individual in the archive will be output as the final searched
architecture. At last, we retrain the searched architecture and obtain a
comprehensively robust model.

Table 1: The settings of different attacks. Methods | Magnitude | Iteration number
---|---|---
Hue | [-$\pi$, $\pi$] | 1
Saturation | [0.7,1.3] | 1
Rotation | [-10, 10] | 1
Brightness | [-0.2, 0.2] | 1
Contrast | [0.7, 1.3] | 1
CAA | - | 1
FGSM-$\mathscr{l}_{\infty}$ | 1/255 | 7
PGD-$\mathscr{l}_{\infty}$ | 1/255 | 7
MI-attack-$\mathscr{l}_{2}$, | 1/255 | 7
PGD-$\mathscr{l}_{2}$ | 1/255 | 7
MI-attack-$\mathscr{l}_{2}$ | 1/255 | 7
Table 2: The performance of different architectures on CIFAR10. The first four
models are manually designed architectures, while the last seven models are
the searched cell-based architectures by NAS. Among that, ES-CRNA-ME is the
searched architectures by us. The best results are highlighted in bold.

Networks | Clean | Hue | Saturation | Rotation | Brightness | Contrast | CAA | FGSM-$\mathscr{l}_{\infty}$ | PGD-$\mathscr{l}_{\infty}$ | MI attack-$\mathscr{l}_{2}$ | PGD-$\mathscr{l}_{2}$ | MI attack-$\mathscr{l}_{2}$ | Avg
---|---|---|---|---|---|---|---|---|---|---|---|---|---
GoogleNet | 94.47 | 81.21 | 92.61 | 86.66 | 89.15 | 91.49 | 4.50 | 44.2 | 28.0 | 27.4 | 65.6 | 65.4 | 64.22
MobileNetV2 | 93.01 | 77.28 | 91.32 | 84.02 | 86.88 | 89.40 | 4.47 | 46.4 | 25.8 | 25.2 | 62.8 | 62.2 | 62.40
DenseNet121 | 94.34 | 80.67 | 93.10 | 87.00 | 89.10 | 91.50 | 6.07 | 55.2 | 34.6 | 33.4 | 67.6 | 66.0 | 66.55
VGG19 | 92.34 | 75.73 | 90.11 | 83.15 | 86.39 | 88.32 | 8.84 | 60.0 | 47.0 | 46.4 | 75.6 | 75.4 | 69.11
Random | 87.99 | 66.59 | 85.00 | 75.70 | 79.71 | 82.90 | 3.78 | 38.6 | 28.0 | 27.6 | 59.8 | 59.6 | 51.08
DARTS | 94.14 | 82.60 | 92.77 | 87.04 | 89.79 | 91.64 | 6.82 | 54.8 | 34.2 | 33.2 | 71.0 | 69.0 | 67.25
PDARTS | 93.78 | 82.29 | 92.51 | 86.49 | 89.32 | 91.63 | 7.95 | 57.4 | 43.0 | 42.8 | 73.4 | 72.6 | 69.43
RACL | 93.31 | 82.26 | 92.21 | 85.22 | 89.20 | 90.87 | 7.91 | 53.4 | 35.0 | 35.0 | 70.6 | 69.4 | 67.04
RNAS | 91.61 | 78.28 | 90.14 | 84.06 | 87.05 | 88.99 | 11.44 | 63.0 | 52.2 | 52.4 | 78.6 | 78.6 | 71.36
Advrush | 93.85 | 83.26 | 92.76 | 86.70 | 89.58 | 91.57 | 8.62 | 55.6 | 37.6 | 37.6 | 73.2 | 71.8 | 68.51
ES-CRNA-ME | 92.31 | 79.67 | 90.62 | 84.90 | 87.75 | 89.61 | 12.5 | 64.4 | 52.4 | 52.4 | 77.4 | 77.0 | 71.75

Table 3: The performance of different architectures on CIFAR100.

Networks | Clean | Hue | Saturation | Rotation | Brightness | Contrast | CAA | FGSM-$\mathscr{l}_{\infty}$ | PGD-$\mathscr{l}_{\infty}$ | MI attack-$\mathscr{l}_{2}$ | PGD-$\mathscr{l}_{2}$ | MI attack-$\mathscr{l}_{2}$ | Avg
---|---|---|---|---|---|---|---|---|---|---|---|---|---
GoogleNet | 76.26 | 39.56 | 70.86 | 62.60 | 64.22 | 68.13 | 0.99 | 20.6 | 7.00 | 7.00 | 33.0 | 30.8 | 33.00
MobileNetV2 | 72.00 | 36.09 | 65.41 | 56.37 | 59.07 | 62.82 | 1.27 | 21.8 | 6.4 | 6.4 | 30.8 | 30.4 | 37.40
DenseNet121 | 77.04 | 40.20 | 71.07 | 62.96 | 64.41 | 68.34 | 1.38 | 25.2 | 12.4 | 11.8 | 36.0 | 33.0 | 41.98
VGG | 67.73 | 29.25 | 60.25 | 52.28 | 55.48 | 58.42 | 1.04 | 24.8 | 14.8 | 14.2 | 40.2 | 39.6 | 38.17
Random | 42.58 | 17.47 | 34.28 | 32.01 | 31.35 | 33.16 | 1.02 | 17.6 | 13.4 | 13.2 | 25.6 | 25.0 | 23.82
DARTS | 75.85 | 40.00 | 70.13 | 63.57 | 64.41 | 68.15 | 2.00 | 33.2 | 18.8 | 18.4 | 43.2 | 41.4 | 44.93
PDARTS | 76.27 | 40.22 | 71.07 | 64.19 | 65.86 | 69.39 | 2.21 | 33.4 | 20.0 | 20.8 | 46.2 | 46.0 | 46.30
RACL | 73.99 | 38.59 | 68.39 | 61.36 | 62.87 | 66.50 | 2.03 | 31.0 | 19.2 | 19.0 | 40.8 | 39.2 | 43.58
RNAS | 68.58 | 33.17 | 62.17 | 57.10 | 57.80 | 60.99 | 2.20 | 35.6 | 24.8 | 24.8 | 48.6 | 48.0 | 43.65
Advrush | 76.04 | 39.62 | 70.78 | 63.87 | 65.45 | 68.68 | 2.10 | 31.4 | 18.6 | 17.8 | 42.2 | 42.2 | 44.90
ES-CRNA-ME | 73.29 | 36.22 | 67.84 | 61.22 | 61.59 | 65.84 | 2.26 | 35.6 | 26.0 | 25.8 | 51.4 | 50.6 | 46.47

##  4 Experiments

To show the effectiveness of ES-CRNA-ME, we conduct experiments on the CIFAR10
and CIFAR100 datasets. In section 4.1, we give a brief description of the
experiment protocol. In section 4.2 and section 4.3, the experimental results
on CIFAR10 and CIFAR100 datasets are presented, respectively. In section 4.4,
we make the analysis of the relativity of different evaluations. In section
4.5, we analyze the performance of the multi-fidelity surrogate model and the
efficiency of the two strategies. Finally, in section 4.6, we discuss the
strength and weaknesses of our method.

###  4.1 Experiment Protocol

Both CIFAR10 and CIFAR100 datasets include 50,000 training images and 10,000
test images. In our setting, the evaluation results on 100 images are
addressed as the low-fidelity evaluation, while that on 5,000 images stands
for the high-fidelity evaluation. The batch size is set to 32. The number of
sampled architectures using low-fidelity evaluation $n$ is set to 200. During
the optimization, the population size $N$ is set to 20, and the iteration
number $G$ is set to 20. The number of selected individuals that are preserved
into the archive $m$ is set to 3. The searched architecture is retrained by
standard training on the whole training dataset. The training epoch is set to
50. The trained models are evaluated by 12 types of evaluations, including
Clean, Hue, Saturation, Rotation, Brightness, Contrast, CAA,
FGSM-$\mathscr{l}_{\infty}$, PGD-$\mathscr{l}_{\infty}$, MI-
attack-$\mathscr{l}_{2}$, PGD-$\mathscr{l}_{2}$ and MI-
attack-$\mathscr{l}_{2}$, respectively. The detailed parameters of different
attacks are listed in Table 1. Among that, CAA is the combination of five
semantic adversarial attacks and PGD-$\mathscr{l}_{\infty}$, where the
magnitude is the same as the single type of attack. Our comparison models
include the manually-designed ones and those searched by NAS. The manually-
designed models include GoogleNet, MobileNetV2, DenseNet121 and VGG19. The
models found by NAS are Random [48], DARTS [21], PDARTS [49], RACL [50], RNAS
[45], and Advrush [25]. All models adopt the same training strategy.

###  4.2 Performance of ES-CRNA-ME on CIFAR10

We first conduct the experiments on the CIFAR10 dataset. The robust accuracy
of the searched architectures on the supernet during the optimization is shown
in Figure 5. From Figure 5, we can see that the robust accuracy increase
significantly with the increase of the iteration number, which verifies the
effectiveness of the whole surrogate model-based optimization. Then we retrain
the searched model and evaluate it using multiple types of attacks. The
performance of different models is presented in Table 2. From Table 2, we can
see that some manually-designed models possess high clean accuracy, while they
are not robust enough against diverse adversarial attacks. In the cell-based
architectures, the randomly selected one is also not robust. However, by NAS
methods, the robustness performance of model architectures can be improved
greatly. But achieving the trade-off between the semantic adversarial attacks
and $l_{p}$ based attacks is difficult. Taking the comparison between RACL and
RNAS as an example, though RNAS is farther more robust on the $l_{p}$ based
attacks, RACL is more robust on semantic attacks. It can prove the necessity
of searching for comprehensively robust architectures under multiple types of
evaluations. We can also observe that our method can find the most
comprehensively robust architectures. The searched architecture is visualized
in Figure 6.

Besides, the comparison between existing methods and our proposed ES-CRNA-ME
is presented in Table 4. From Table 4, we can observe that our method can
utilize less computational burden to find better architectures. The comparison
methods are differentiable-based architecture search methods, while our
proposed method is non-differentiable. In non-differentiable-based search
methods, the robustness evaluation is more flexible but generally time-
consuming. However, due to the proposed acceleration strategies, our method
can efficiently find robust architectures.

Figure 5: The corelation of the robust accuracies between different types of
attacks.

(a) Normal Cell

(b) Reduction Cell

Figure 6: Normal and reduction convolutional cell architectures found by ES-CRNA-ME on CIFAR10 dataset. Table 4: The comparison of the searching time by different methods. Methods | Time (GPU/Days)
---|---
Advrush | 1
DARTS | 1
RACL | 1
RNAS | 1
ES-CRNA-ME | 0.5

###  4.3 Performance of ES-CRNA-ME on CIFAR100

We also conduct experiments on the CIFAR100 dataset. The comparison between
the performance of the searched model and existing models are listed in Table
3. From Table 3, it can be seen that our method can still find the mostly
comprehensively robust architectures. Compared with manually-designed
architectures, the comprehensively robust accuracy of ES-CRNA-ME is farther
higher. In addition, ES-CRNA-ME also possesses obvious advantages over
randomly selected architectures. Among all comparison methods, PDARTS possess
the highest robust accuracy under clean examples and semantic adversarial
attacks. However, it has relatively poor performance on $l_{p}$-norm-based
attacks. In general, the experimental results on CIFAR100 can also verify the
effectiveness of our method. The searched architecture is visualized in Figure
7.

(a) Normal Cell

(b) Reduction Cell

Figure 7: Normal and reduction convolutional cell architectures found by ES-
CRNA-ME on CIFAR100 dataset.

###  4.4 Analysis of the relativity of different evaluations

In this section, the analysis of the relativity of different evaluations on
CIFAR10 dataset is performed. After the supernet is trained, we utilize
different types of adversarial attacks to evaluate the robust accuracy of the
supernet. We sample 5 architectures and calculate the correlation between the
accuracies under different evaluations. The result is visualized in Figure 8.
In this figure, positive values mean positive correlation, while negative
values stand for negative correlations. The number from one to twelve
represents the robust accuracies under Clean, Hue, Saturation, Rotation,
Brightness, Contrast, CAA, FGSM-$\mathscr{l}_{\infty}$,
PGD-$\mathscr{l}_{\infty}$, MI attack-$\mathscr{l}_{2}$, PGD-$\mathscr{l}_{2}$
and MI attack-$\mathscr{l}_{2}$, respectively. For instance, the correlation
between clean accuracy and Rotation can reach 1. Thus, we just need to
evaluate the clean accuracy rather than both of them. We set a threshold, such
as 0.7, to select similar evaluations and merge them. The evaluation pairs
that meet the constraints are presented in Table 5. The merged evaluations are
shown in Table 6. In this way, given the trained supernet and any type of
robustness evaluation, we can adaptively merge the similar robustness
evaluation and decrease the search cost to efficiently find comprehensively
robust neural architectures. In our experiment on the CIFAR10 dataset, we can
reduce four robust evaluations. To realize the accurate robustness estimation,
three coefficients are needed to be recalculated according to Eq. 15. We
obtain the average coefficient values using five architectures, which are
illustrated in Table 7. $k_{1}$, $k_{2}$ and $k_{9}$ are the coefficients of
three evaluations, including Clean, Hue, PGD-$\mathscr{l}_{\infty}$,
respectively. Then, the comprehensively robust accuracy can be obtained
according to Eq. 14 during optimization.

Figure 8: The correlation of the robust accuracies between different types of attacks. Table 5: The result of merging similar attacks. Original Attacks | Correlation value
---|---
0-3 | 1
0-2 | 0.8
1-5 | 0.95
2-3 | 0.8
2-4 | 0.8
8-11 | 0.74
9-11 | 0.74
Table 6: The result of merging similar attacks. Original Attacks | Merged Attacks
---|---
Clean, Saturation, Rotation | Clean
Hue, Contrast | Hue
PGD-$\mathscr{l}_{\infty}$, MI attack-$\mathscr{l}_{2}$ | PGD-$\mathscr{l}_{\infty}$
Table 7: The coefficients of merged attacks. Model | $k_{1}$ | $k_{2}$ | $k_{9}$
---|---|---|---
1 | 3.37 | 1.84 | 1.34
2 | 3.37 | 1.98 | 1.71
3 | 3.37 | 2.12 | 1.52
4 | 3.51 | 2.03 | 1.59
5 | 3.54 | 2.10 | 1.54
Avg | 3.43 | 2.01 | 1.54

To further illustrate the effectiveness of our proposed reduced evaluations,
we select one architecture and evaluate the robust accuracy using complete and
reduced robustness evaluation, respectively. The comparison of them is
presented in Figure 9. From Figure 9, we can see that if the number of test
samples is too small, the robustness evaluation is not accurate enough. With
the increase in the number of test samples, the robustness evaluation tends to
be more accurate. In addition, the reduced robustness evaluation can remain at
the same level as the complete evaluation. The Kendall’s tau coefficient of
them can also reach 1, which verifies the effectiveness of our proposed
method. The corresponding evaluation cost is also shown in Figure 10. From
Figure 10, we can see that our method can reduce over 1/3 time cost to
evaluate the model architectures.

Figure 9: The comparison of robust accuracy using complete and reduced
evaluations. Figure 10: The comparison of time cost using complete and reduced
evaluations.

###  4.5 Analysis of multi-fidelity online learning

In this section, we present the performance of the surrogate model utilized in
our proposed method. First, we evaluate the initial prediction accuracy using
low-fidelity data. We sample randomly 20 architectures and evaluate them on
the supernet. The comparison of the true robust accuracy and the predicted one
is presented in Figure 11. From Figure 11, we can see that the surrogate model
can possess a superior prediction ability of the performance of different
architectures.

Figure 11: The corelation of the robust accuracies between different types of
attacks.

By combining the two above-mentioned strategies, we can realize the purpose of
an efficient search for comprehensively robust neural architectures. To
illustrate the effect of two strategies on the performance of searched
architectures, we also further conduct the ablation study. The experimental
result is presented in Table 8. S-CRNA utilizes the evolutionary algorithm to
find robust architectures under complete evaluations. ES-CRNA uses the reduced
evaluation while not utilizing the multi-fidelity surrogate model. In S-CRNA
and ES-CRNA, both the population size and iteration number are set to 20. From
Table 8, we can see that S-CRNA takes the most computational burden, whose
search time can reach 2.5GPU/Days. When the reduced evaluation is performed,
that is also, ES-CRNA, the search time can be reduced to 1.5GPU/Days. On the
basis of reduced evaluation, when the multi-fidelity online surrogate model is
utilized, the whole-time cost can achieve the lowest level, which is only
0.5GPU/Days. In addition, ES-CRNA-ME can possess slightly higher robust
accuracy than S-CRNA and ES-CRNA, which can verify the effectiveness of our
proposed strategies.

Table 8: The comparison of the searching efficiency of ES-CRNA-ME. Methods | Time (GPU/Days) | Accuracy
---|---|---
S-CRNA | 2.5 | 71.51
ES-CRNA | 1.5 | 71.38
ES-CRNA-ME | 0.5 | 71.75

###  4.6 Discussions

In the CIFAR10 and CIFAR100 datasets, our experimental results have verified
the effectiveness of the proposed efficient search of comprehensively robust
neural architectures via multi-fidelity evaluation. The whole framework is
first devised to solve the problem of finding comprehensively robust neural
architectures. In our work, two key components, including correlation analysis
and multi-fidelity surrogate model online learning, can effectively handle the
huge computational burden brought by the comprehensive robustness evaluations.
However, in our work, we do not deeply explore and analyze the effect of
different search spaces on the performance of NAS. We believe this is one key
component to defining a suitable and efficient search space in the areas of
searching for robust neural architectures.

##  5 Conclusions

Different from existing works that only focus on automatically finding robust
neural architectures against $l_{p}$ norm-based adversarial attacks, in this
paper, we first try to apply the NAS method to search for comprehensively
robust neural architectures. To realize an efficient search, we use the
weight-sharing neural architecture search to reduce the computational cost of
retraining the architecture. In addition, we propose two strategies to reduce
the evaluation cost. On the one hand, we use correlation analysis to merge
similar attacks, which can save about 1/3 computational burden. On the one
hand, the multi-fidelity online surrogate model is utilized to substitute the
real evaluation, which can further accelerate the search process. Experimental
results on CIFAR10 and CIFAR100 datasets show that our proposed method can
find comprehensively more robust neural architectures than existing state-of-
art methods. Besides, the time cost of our method is also the least. In future
work, the more efficient search space towards improving the robustness against
multiple types of attacks can be further studied.

## Acknowledgment

This work was supported in part by National Natural Science Foundation of
China under Grant No.52005505.

## References

  * Lu and Weng [2007] D. Lu, Q. Weng,  A survey of image classification methods and techniques for improving classification performance,  International journal of Remote sensing 28 (2007) 823–870.
  * Wang et al. [2017] F. Wang, M. Jiang, C. Qian, S. Yang, C. Li, H. Zhang, X. Wang, X. Tang,  Residual attention network for image classification,  in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 3156–3164.
  * Szegedy et al. [2013] C. Szegedy, A. Toshev, D. Erhan,  Deep neural networks for object detection,  Advances in neural information processing systems 26 (2013).
  * Zhao et al. [2019] Z.-Q. Zhao, P. Zheng, S.-t. Xu, X. Wu,  Object detection with deep learning: A review,  IEEE transactions on neural networks and learning systems 30 (2019) 3212–3232.
  * Cai et al. [2022] Q. Cai, Y. Qian, S. Zhou, J. Li, Y. Yang, F. Wu, D. Zhang,  AVLSM: adaptive variational level set model for image segmentation in the presence of severe intensity inhomogeneity and high noise,  IEEE Trans. Image Process. 31 (2022) 43–57.
  * Madry et al. [2018] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu,  Towards deep learning models resistant to adversarial attacks,  in: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings, OpenReview.net, 2018\.
  * Li et al. [2022] C. Li, H. Wang, J. Zhang, W. Yao, T. Jiang,  An approximated gradient sign method using differential evolution for black-box adversarial attack,  IEEE Transactions on Evolutionary Computation 26 (2022) 976–990.
  * Li et al. [2023] C. Li, W. Yao, H. Wang, T. Jiang,  Adaptive momentum variance for attention-guided sparse adversarial attacks,  Pattern Recognition 133 (2023) 108979.
  * Papernot et al. [2016] N. Papernot, P. McDaniel, X. Wu, S. Jha, A. Swami,  Distillation as a defense to adversarial perturbations against deep neural networks,  in: 2016 IEEE symposium on security and privacy (SP), IEEE, 2016, pp. 582–597.
  * Chattopadhyay et al. [2022] N. Chattopadhyay, S. Chatterjee, A. Chattopadhyay,  Robustness against adversarial attacks using dimensionality,  in: Security, Privacy, and Applied Cryptography Engineering: 11th International Conference, SPACE 2021, Kolkata, India, December 10–13, 2021, Proceedings, Springer, 2022, pp. 226–241.
  * Bhagoji et al. [2018] A. N. Bhagoji, D. Cullina, C. Sitawarin, P. Mittal,  Enhancing robustness of machine learning systems via data transformations,  in: 2018 52nd Annual Conference on Information Sciences and Systems (CISS), IEEE, 2018, pp. 1–5.
  * Tramèr et al. [2017] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, P. McDaniel,  Ensemble adversarial training: Attacks and defenses,  arXiv preprint arXiv:1705.07204 (2017).
  * Shafahi et al. [2019] A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, T. Goldstein,  Adversarial training for free!,  Advances in Neural Information Processing Systems 32 (2019).
  * Andriushchenko and Flammarion [2020] M. Andriushchenko, N. Flammarion,  Understanding and improving fast adversarial training,  Advances in Neural Information Processing Systems 33 (2020) 16048–16059.
  * Elsken et al. [2019] T. Elsken, J. H. Metzen, F. Hutter,  Neural architecture search: A survey,  The Journal of Machine Learning Research 20 (2019) 1997–2017.
  * Yao et al. [2020] Q. Yao, J. Xu, W.-W. Tu, Z. Zhu,  Efficient neural architecture search via proximal iterations,  in: Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, 2020, pp. 6664–6671.
  * Pham et al. [2018] H. Pham, M. Guan, B. Zoph, Q. Le, J. Dean,  Efficient neural architecture search via parameters sharing,  in: International conference on machine learning, PMLR, 2018, pp. 4095–4104.
  * Liu et al. [2021] Y. Liu, Y. Sun, B. Xue, M. Zhang, G. G. Yen, K. C. Tan,  A survey on evolutionary neural architecture search,  IEEE transactions on neural networks and learning systems (2021).
  * White et al. [2021] C. White, W. Neiswanger, Y. Savani,  Bananas: Bayesian optimization with neural architectures for neural architecture search,  in: Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, 2021, pp. 10293–10301.
  * Zoph and Le [2016] B. Zoph, Q. V. Le,  Neural architecture search with reinforcement learning,  arXiv preprint arXiv:1611.01578 (2016).
  * Liu et al. [2018] H. Liu, K. Simonyan, Y. Yang,  Darts: Differentiable architecture search,  arXiv preprint arXiv:1806.09055 (2018).
  * Chu et al. [2021] X. Chu, B. Zhang, R. Xu,  Fairnas: Rethinking evaluation fairness of weight sharing neural architecture search,  in: Proceedings of the IEEE/CVF International Conference on computer vision, 2021, pp. 12239–12248.
  * Guo et al. [2020] M. Guo, Y. Yang, R. Xu, Z. Liu, D. Lin,  When NAS meets robustness: In search of robust architectures against adversarial attacks,  in: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, Computer Vision Foundation / IEEE, 2020, pp. 628–637. doi:10.1109/CVPR42600.2020.00071.
  * Hosseini et al. [2021] R. Hosseini, X. Yang, P. Xie,  DSRNA: differentiable search of robust neural architectures,  in: IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, Computer Vision Foundation / IEEE, 2021, pp. 6196–6205.
  * Mok et al. [2021] J. Mok, B. Na, H. Choe, S. Yoon,  Advrush: Searching for adversarially robust neural architectures,  CoRR abs/2108.01289 (2021).
  * Liu and Jin [2021] J. Liu, Y. Jin,  Multi-objective search of robust neural architectures against multiple types of adversarial attacks,  Neurocomputing 453 (2021) 73–84.
  * Joshi et al. [2019] A. Joshi, A. Mukherjee, S. Sarkar, C. Hegde,  Semantic adversarial attacks: Parametric transformations that fool deep classifiers,  in: Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 4773–4783.
  * Hosseini and Poovendran [2018] H. Hosseini, R. Poovendran,  Semantic adversarial examples,  in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2018, pp. 1614–1619.
  * Bhattad et al. [2019] A. Bhattad, M. J. Chong, K. Liang, B. Li, D. A. Forsyth,  Unrestricted adversarial examples via semantic manipulation,  arXiv preprint arXiv:1904.06347 (2019).
  * Sobester et al. [2008] A. Sobester, A. Forrester, A. Keane, Engineering design via surrogate modelling: a practical guide, John Wiley & Sons, 2008\.
  * Goodfellow et al. [2014] I. J. Goodfellow, J. Shlens, C. Szegedy,  Explaining and harnessing adversarial examples,  arXiv preprint arXiv:1412.6572 (2014).
  * Carlini and Wagner [2017] N. Carlini, D. Wagner,  Towards evaluating the robustness of neural networks,  in: 2017 ieee symposium on security and privacy (sp), IEEE, 2017, pp. 39–57.
  * Mao et al. [2021] X. Mao, Y. Chen, S. Wang, H. Su, Y. He, H. Xue,  Composite adversarial attacks,  in: Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, AAAI Press, 2021, pp. 8884–8892.
  * Gowal et al. [2019] S. Gowal, J. Uesato, C. Qin, P.-S. Huang, T. Mann, P. Kohli,  An alternative surrogate loss for pgd-based adversarial testing,  arXiv preprint arXiv:1910.09338 (2019).
  * Dong et al. [2018] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, J. Li,  Boosting adversarial attacks with momentum,  in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9185–9193.
  * Rony et al. [2019] J. Rony, L. G. Hafemann, L. S. Oliveira, I. B. Ayed, R. Sabourin, E. Granger,  Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses,  in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 4322–4330.
  * Hsiung et al. [2022] L. Hsiung, Y.-Y. Tsai, P.-Y. Chen, T.-Y. Ho,  CARBEN: Composite Adversarial Robustness Benchmark,  in: Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, International Joint Conferences on Artificial Intelligence Organization, 2022.
  * Hsiung et al. [2023] L. Hsiung, Y.-Y. Tsai, P.-Y. Chen, T.-Y. Ho,  Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations,  in: IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, IEEE, 2023\.
  * Riba et al. [2020] E. Riba, D. Mishkin, D. Ponsa, E. Rublee, G. Bradski,  Kornia: an open source differentiable computer vision library for pytorch,  in: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2020, pp. 3674–3683.
  * Vargas et al. [2019] D. V. Vargas, S. Kotyan, S. IIIT-NR,  Evolving robust neural architectures to defend from adversarial attacks,  arXiv preprint arXiv:1906.11667 (2019).
  * Liu and Jin [2021] J. Liu, Y. Jin,  Multi-objective search of robust neural architectures against multiple types of adversarial attacks,  Neurocomputing 453 (2021) 73–84.
  * Liu et al. [2022] J. Liu, R. Cheng, Y. Jin,  Bi-fidelity evolutionary multiobjective search for adversarially robust deep neural architectures,  arXiv preprint arXiv:2207.05321 (2022).
  * Ning et al. [2020] X. Ning, J. Zhao, W. Li, T. Zhao, Y. Zheng, H. Yang, Y. Wang,  Discovering robust convolutional architecture at targeted capacity: A multi-shot approach,  arXiv preprint arXiv:2012.11835 (2020).
  * Chen et al. [2020] H. Chen, B. Zhang, S. Xue, X. Gong, H. Liu, R. Ji, D. Doermann,  Anti-bandit neural architecture search for model defense,  in: European Conference on Computer Vision, Springer, 2020, pp. 70–85.
  * Qian et al. [2022] Y. Qian, S. Huang, B. Wang, X. Ling, X. Guan, Z. Gu, S. Zeng, W. Zhou, H. Wang,  Robust network architecture search via feature distortion restraining,  in: Computer Vision–ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part V, Springer, 2022, pp. 122–138.
  * Ou et al. [2022] Y. Ou, X. Xie, S. Gao, Y. Sun, K. C. Tan, J. Lv,  Differentiable search of accurate and robust architectures,  arXiv preprint arXiv:2212.14049 (2022).
  * Zoph et al. [2018] B. Zoph, V. Vasudevan, J. Shlens, Q. V. Le,  Learning transferable architectures for scalable image recognition,  in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 8697–8710.
  * Li and Talwalkar [2020] L. Li, A. Talwalkar,  Random search and reproducibility for neural architecture search,  in: Uncertainty in artificial intelligence, PMLR, 2020, pp. 367–377.
  * Liu et al. [2018] C. Liu, B. Zoph, M. Neumann, J. Shlens, W. Hua, L.-J. Li, L. Fei-Fei, A. Yuille, J. Huang, K. Murphy,  Progressive neural architecture search,  in: Proceedings of the European conference on computer vision (ECCV), 2018, pp. 19–34.
  * Dong et al. [2020] M. Dong, Y. Li, Y. Wang, C. Xu,  Adversarially robust neural architectures,  arXiv preprint arXiv:2009.00902 (2020).