A black-box spectral method is introduced for evaluating the adversarial robustness of a given machine learning (ML) model. Our approach, named SPADE, exploits bijective distance mapping between the input/output graphs constructed for approximating the manifolds corresponding to the input/output data. By leveraging the generalized Courant-Fischer theorem, we propose a SPADE score for evaluating the adversarial robustness of a given model, which is proved to be an upper bound of the best Lipschitz constant under the manifold setting. To reveal the most non-robust data samples highly vulnerable to adversarial attacks, we develop a spectral graph embedding procedure leveraging dominant generalized eigenvectors. This embedding step allows assigning each data sample a robustness score that can be further harnessed for more effective adversarial training. Our experiments show the proposed SPADE method leads to promising empirical results for neural network models adversarially trained with the MNIST and CIFAR-10 data sets.

本文提出了一个黑盒谱方法SPADEF，用于评估给定机器学习模型的对抗鲁棒性，它利用了构建输入/输出数据对应的流形的逆距离映射来进行，并通过广义Courant-Fischer定理提出了用于评估经过证明可以作为在流形设置下最佳Lipschitz常数的上界的SPADE分数。此外，通过利用占优广义特征向量，本文还开发了一种谱图嵌入过程，以揭示最易受到对抗攻击的最不鲁棒数据样本，并为更有效的对抗训练提供支持。经实验证明，所提出的SPADE方法对使用MNIST和CIFAR-10数据集进行对抗训练的神经网络模型具有良好的实验结果。

SPADE: 用于黑盒对抗鲁棒性评估的谱方法