Existing works have made great progress in improving adversarial robustness, but typically test their method only on data from the same distribution as the training data, i.e. in-distribution (ID) testing. As a result, it is unclear how such robustness generalizes under input distribution shifts, i.e. out-of-distribution (OOD) testing. This is a concerning omission as such distribution shifts are unavoidable when methods are deployed in the wild. To address this issue we propose a benchmark named OODRobustBench to comprehensively assess OOD adversarial robustness using 23 dataset-wise shifts (i.e. naturalistic shifts in input distribution) and 6 threat-wise shifts (i.e., unforeseen adversarial threat models). OODRobustBench is used to assess 706 robust models using 60.7K adversarial evaluations. This large-scale analysis shows that: 1) adversarial robustness suffers from a severe OOD generalization issue; 2) ID robustness correlates strongly with OOD robustness, in a positive linear way, under many distribution shifts. The latter enables the prediction of OOD robustness from ID robustness. Based on this, we are able to predict the upper limit of OOD robustness for existing robust training schemes. The results suggest that achieving OOD robustness requires designing novel methods beyond the conventional ones. Last, we discover that extra data, data augmentation, advanced model architectures and particular regularization approaches can improve OOD robustness. Noticeably, the discovered training schemes, compared to the baseline, exhibit dramatically higher robustness under threat shift while keeping high ID robustness, demonstrating new promising solutions for robustness against both multi-attack and unforeseen attacks.

翻译：现有工作在提升对抗鲁棒性方面取得了显著进展，但通常仅在与训练数据同分布的数据（即同分布测试）上测试其方法。因此，此类鲁棒性在输入分布偏移（即分布外测试）下如何泛化尚不明确。由于方法部署到实际环境时此类分布偏移不可避免，这一疏漏值得关注。为解决此问题，我们提出名为OODRobustBench的基准，利用23种数据集层面偏移（即输入分布的自然偏移）和6种威胁层面偏移（即未预见的对抗威胁模型）全面评估分布外对抗鲁棒性。OODRobustBench通过60.7万次对抗评估对706个鲁棒模型进行了分析。大规模分析表明：1）对抗鲁棒性存在严重的分布外泛化问题；2）在多种分布偏移下，同分布鲁棒性与分布外鲁棒性呈强正线性相关。后者使基于同分布鲁棒性预测分布外鲁棒性成为可能。据此，我们能够预测现有鲁棒训练方案的分布外鲁棒性上限，结果表明实现分布外鲁棒性需设计超越传统方法的新方案。最后发现，额外数据、数据增强、先进模型架构及特定正则化方法可提升分布外鲁棒性。值得注意的是，与基线相比，所发现的训练方案在威胁层面偏移下展现出显著更高的鲁棒性，同时保持高同分布鲁棒性，为应对多攻击及未预见攻击提供了有前景的新解决方案。