IC-542The PyTorch pretrained ResNet50 on ImageNet is vulnerable to (1, y)-ACE calibration attacks that increase ECE from 3.70% to 47.23% while preserving accuracy

Cornelius Emde, Francesco Pinto, Thomas Lukasiewicz, Philip Torr, Adel Bibi

SourceTowards Certification of Uncertainty Calibration under Adversarial Attacks

The authors introduce a family of parameterised attacks, (η, ω)-ACE, that perturb the input to alter the model's confidence without changing its predicted label. Applied to the standard PyTorch pretrained ResNet50 on ImageNet, a (1, y)-ACE attack with ε=2/255 increases the ECE from 3.70% to 47.23%, and a (1, ŷ)-ACE attack increases it to 25.17%. The attack preserves the predicted class, so accuracy is unchanged, yet the model's confidence becomes severely miscalibrated. This demonstrates that a released model can be robust to label-flipping attacks while remaining vulnerable to calibration-specific adversaries.

Evidence

correlational

Key metric

ResNet50 on ImageNet, standard training: unattacked ECE 3.70%; (1,y)-ACE ε=2/255 ECE 47.23%; (1,ŷ)-ACE ε=2/255 ECE 25.17%; (−1,y)-ACE ε=2/255 ECE 1.06%; (−1,ŷ)-ACE ε=2/255 ECE 11.87%

Caveat

The attack is evaluated on the validation set only; the paper does not report results on the full test set for this specific model. The attack requires access to the model's gradients (white-box).

Model

ResNet / ResNet-152 / ResNet-101 / ResNet-50-BN ResNet50

Concepts

Failure mode

Datasets

ImageNet-1k / ImageNet / ImageNet-1k-val / ImageNet-Val [eval]

Methods

PGD (Projected Gradient Descent) [supporting]

Extraction

automatic-extraction