Existing works have made great progress in improving adversarial robustness,
but typically test their method only on data from the same distribution as the
training data, i.e. in-distribution (ID) testing. As a result, it is unclear
how such robustness generalizes under input distribution shifts, i.e.
out-of-distribution (OOD) testing. This is a concerning omission as such
distribution shifts are unavoidable when methods are deployed in the wild. To
address this issue we propose a benchmark named OODRobustBench to
comprehensively assess OOD adversarial robustness using 23 dataset-wise shifts
(i.e. naturalistic shifts in input distribution) and 6 threat-wise shifts
(i.e., unforeseen adversarial threat models). OODRobustBench is used to assess
706 robust models using 60.7K adversarial evaluations. This large-scale
analysis shows that: 1) adversarial robustness suffers from a severe OOD
generalization issue; 2) ID robustness correlates strongly with OOD robustness,
in a positive linear way, under many distribution shifts. The latter enables
the prediction of OOD robustness from ID robustness. Based on this, we are able
to predict the upper limit of OOD robustness for existing robust training
schemes. The results suggest that achieving OOD robustness requires designing
novel methods beyond the conventional ones. Last, we discover that extra data,
data augmentation, advanced model architectures and particular regularization
approaches can improve OOD robustness. Noticeably, the discovered training
schemes, compared to the baseline, exhibit dramatically higher robustness under
threat shift while keeping high ID robustness, demonstrating new promising
solutions for robustness against both multi-attack and unforeseen attacks.

现有研究在提高对抗鲁棒性方面取得了很大进展，但通常只在与训练数据相同分布的数据上进行测试，即内分布（ID）测试。然而，如何在输入分布转移（即出分布（OOD）测试）下实现这种鲁棒性的泛化仍不清楚。因此，我们提出了一个名为 OODRobustBench 的基准来全面评估 OOD 对抗鲁棒性，使用 23 种数据集级的转移（即输入分布中的自然转移）和 6 种威胁级的转移（即未知的对抗威胁模型）。OODRobustBench 用于评估 706 个稳健模型，使用 60.7K 个对抗性评估。这个大规模分析显示：1）对抗鲁棒性在 OOD 泛化问题上存在严重问题；2）ID 鲁棒性与 OOD 鲁棒性在许多分布转移下呈正线性相关，这使得可以从 ID 鲁棒性预测 OOD 鲁棒性。基于这一点，我们能够预测现有强化训练方案的 OOD 鲁棒性的上限。研究结果表明，实现 OOD 鲁棒性需要设计超出传统方法的新方法。最后，我们发现额外数据、数据增强、先进的模型架构和特定的正则化方法可以提高 OOD 鲁棒性。值得注意的是，与基准相比，发现的训练方案在威胁转移下表现出明显更高的鲁棒性，同时保持高的 ID 鲁棒性，为多攻击和未知攻击的鲁棒性提供新的有希望的解决方案。