RobustCheck: A Python package for black-box robustness assessment of image classifiers

SoftwareX 27 (2024) 101831 Available online 23 July 2024 2352-7110/© 2024 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/). Contents lists available at ScienceDirect SoftwareX journal homepage: www.elsevier.com/locate/softx Original software publication RobustCheck: A Python package for black-box robustness assessment of image classifiers Andrei Ilie a,∗, Alin Stefanescu a,b aUniversity of Bucharest, Romania bInstitute for Logic and Data Science, Romania ARTICLE INFO Dataset link: https://github.com/andreiilie1/R obustCheck Keywords: Adversarial machine learning Adversarial robustness Computer vision Black-box adversarial attack Machine learning development tools ABSTRACT The robustness of computer vision models against adversarial attacks is a critical matter in machine learning that is often overlooked by researchers and developers. A contributing factor to this oversight is the complexity involved in assessing model robustness. This paper introduces RobustCheck, a Python package designed for evaluating the adversarial robustness of computer vision models. Utilizing black-box adversarial techniques, it allows for the assessment of model resilience without internal model access, reflecting real-world application constraints. RobustCheck is distinctive for its rapid integration into development workflows and its efficiency in robustness testing. The tool provides an essential resource for developers to enhance the security and reliability of computer vision systems. Code metadata Current code version 1.1.0 Permanent link to code/repository used for this code version https://github.com/ElsevierSoftwareX/SOFTX-D-24-00187 Permanent link to Reproducible Capsule https://codeocean.com/capsule/2082563/tree/v2 Legal Code License MIT License Code versioning system used git Software code languages, tools, and services used Python, Pytest for testing, MLflow for experiment tracking, Sphinx for automatic documentation generation Compilation requirements, operating environments & dependencies Python ≥3.8.0, matplotlib ≥3.7.0, numpy ≥1.18.0, mlflow ≥1.2.0, tqdm ≥4.64.1 (note: all specified in setup.py) If available Link to developer documentation/manual https://andreiilie1.github.io/RobustCheck Support email for questions [email protected] 1. Motivation and significance 1.1. Motivation Computer vision systems have rapidly transitioned from novel innovations to essential components across diverse applications such as autonomous vehicles, medical diagnostics, and user authentication. Ensuring the reliability of these systems, particularly their robustness against adversarial attacks, is critical for user safety and data security. This reliability is paramount in real-world scenarios where anomalies, both natural and adversarially introduced, are common and can significantly impact performance. ∗Corresponding author. E-mail addresses: [email protected] (Andrei Ilie), [email protected] (Alin Stefanescu). Despite its importance, machine learning robustness has historically been overlooked, partly due to the complexity of evaluating it and the lack of accessible evaluation tools. This oversight perpetuates a cycle where the scarcity of evaluation tools stems from and contributes to the community’s limited focus on robustness. Recent initiatives have begun to address this gap by developing tools for assessing the robustness of specific architectures [1,2]. To advance the state-of-the-art, we present RobustCheck [3], a user-friendly Python package designed to evaluate the adversarial robustness of computer vision classifiers through efficient evolutionary algorithms. Unlike previous tools, RobustCheck is architecture-agnostic https://doi.org/10.1016/j.softx.2024.101831 Received 22 March 2024; Received in revised form 12 July 2024; Accepted 15 July 2024 SoftwareX 27 (2024) 101831 2 Andrei Ilie and Alin Stefanescu and integrates seamlessly into development and deployment workflows, facilitating broad adoption and enhancing the security posture of computer vision applications. 1.2. Related work In our previous work [4] we introduced AttackType.EvoBA, one of the evolutionary algorithms that fuel RobustCheck, to efficiently assess the adversarial robustness of computer vision classifiers. This algorithm outperforms SimBA [5], a similarly purposed and widely used state-ofthe-art adversarial attack, in terms of speed and requires fewer queries to produce adversarial perturbations of similar magnitude, offering a practical solution for rapid robustness evaluation. RobustCheck also provides support for running robustness evaluations using SimBA, broadening its range of adversarial techniques. Compared with ODE4ViTRobustness [1], a similar tool which assesses the robustness of transformer-based models and requires internal model access, RobustCheck supports a black-box approach applicable to any architecture, aligning more closely with real-world application needs. Another similar package, Adversarial Robustness Toolbox [6], provides support for assessing the robustness of machine learning models by using both black-box and white-box adversarial attacks. In comparison, RobustCheck specializes in black-box adversarial attacks, providing a lightweight way to run the more recent and efficient attack AttackType.EvoBA, which was shown in [4] to surpass in efficiency the former state-of-the-art attacks supported in Adversarial Robustness Toolbox, such as SimBA or Zeroth Order Optimisation (ZOO) attacks [7]. Our primary contribution is the introduction of RobustCheck, an open-source Python package designed to assess the adversarial robustness of various black-box computer vision classifiers. By employing evolutionary strategies that treat images as population individuals and mutate their pixels intelligently to deceive targeted models, RobustCheck offers more efficient and comprehensive robustness evaluations compared to similar tools. Integrating RobustCheck into development workflows is straightforward, as demonstrated by the code snippets in Section 2.3. Section 3illustrates how RobustCheck enables new research into enhancing neural network robustness through ensembling with gradientboosted models. Furthermore, RobustCheck is used at Bolt,1Europe’s largest super-app company for transportation and food delivery, to assess and enhance the robustness of the computer vision models used in micromobility. These include applications such as over-the-edge pedestrian or sidewalk detection from on-scooter cameras for safety purposes. 2. Software description The methodology employed by RobustCheck is straightforward. It requires access to the inference method of black-box computer vision classifiers and a labeled dataset of images. RobustCheck uses blackbox adversarial attacks to efficiently find adversarial perturbations for each image sample. It then generates and logs dataset statistics, including adversarial accuracy, average black-box query counts, and the average magnitudes (L0, L2 norms) of successful adversarial perturbations, helping developers understand the adversarial robustness of their models. 2.1. Software architecture Fig. 1 presents a simplified overview of RobustCheck’s architecture, focusing on its core components and functionalities. 1https://bolt.eu The primary user interface, RobustnessCheck, encapsulates the model under evaluation and a sample of labeled images, and builds UntargetedAttack implementations that execute the underlying adversarial attacks. The abstract class UntargetedAttack wraps the model and one labeled image, requiring implementations for run_adversarial_attack() to run the attack, and is_perturbed() to verify attack success. EvoStrategy provides an interface for evolutionary strategies, encouraging open-source contributors to extend RobustCheck with new implementations that comply with the UntargetedAttack interface. A useful implementation detail is that EvoStrategyUniformUntargeted includes a clean_memory flag to optimize memory usage. When enabled, it triggers EvoStrategyUniformUntargeted._flush_memory(), which clears the memory of all but the fittest individual per generation. This feature prevents memory usage spikes and helps support larger generation_size values. The utils sub-module provides methods to save robustness check results, ensuring RobustnessCheck remains focused on its core functionalities. For example, generate_mlflow_logs() saves artifacts compatible with MLflow [8] servers, facilitating interactive visualization. 2.2. Software functionalities Our package enables users to perform comprehensive adversarial robustness checks, generating a suite of robustness metrics for computer vision classifiers. The main functionality of RobustCheck is evaluating the adversarial robustness of black-box models against a labeled dataset of images. Developers can gauge the resilience of their models by determining how many correctly classified images can be adversarially perturbed under predefined conditions, such as black-box query limits and adversarial attack parameters. These conditions are flexible: users can either employ the default settings for immediate assessments or customize them based on heuristics we provide. The robustness metrics produced by RobustCheck include the adversarial accuracy (percentage of images still classified correctly after RobustCheck attempted various perturbations), along with statistics of the black-box query counts and the magnitude of successful perturbations, measured by L0 (number of modified pixels) and L2 (Euclidean) norms. These equip practitioners with a clear understanding of their model’s vulnerability to adversarial attacks, the computational effort required for such perturbations, and the severity of modifications needed to deceive the model. Access to the adversarially altered images is also provided, enabling further qualitative analysis. Using these metrics, developers can take targeted actions to enhance model robustness, such as applying adversarial training [9] or distillation techniques [10]. RobustCheck provides a quantitative foundation for evaluating the impact of such improvements on adversarial resilience. RobustCheck offers three ways to access its robustness metrics: displaying in a human-readable format on standard output, logging metrics and artifacts such as histograms on the disk, or logging metrics, artifacts, and perturbed images in an MLflow-compatible way. 2.3. Sample code snippets analysis Our package simplifies the process of evaluating image classifier robustness through three distinct black-box adversarial attacks. The first adversarial attack, AttackType.EVOBA, leverages an evolutionary strategy to iteratively mutate images, selecting offspring most likely to evade correct classification as the basis for subsequent generations. The second, AttackType.EPSGREEDY, uses a variant of the classic Epsilon-Greedy strategy, commonly utilized in reinforcement learning [11]. This approach involves randomly altering pixels within specific groups chosen in advance, focusing on those groups that have SoftwareX 27 (2024) 101831 3 Andrei Ilie and Alin Stefanescu Fig. 1. Simplified architecture of RobustCheck. shown to most significantly lower classification accuracy on average. Both strategies are designed to be straightforward yet effective, offering users practical tools for assessing and enhancing the adversarial robustness of their models. The third method, AttackType.SIMBA, is another simple and effective black-box attack that fits our rapid robustness evaluation framework. Using a greedy strategy, it iteratively attempts to perturb pixels at random by adding or subtracting a fixed amount of noise, only retaining modifications that reduce the image’s correct classification likelihood. A robustness assessment requires the following: •amodel exposing a .predict method that outputs a class probability distribution, •a labeled dataset of images x_test, y_test, •the chosen attack2:AttackType.EVOBA, AttackType.EPSGREEDY, or AttackType.SIMBA, •attack parameters via attack_params for the chosen method. In practice, running a robustness assessment and obtaining the robustness metrics can be easily achieved by: 1from robustcheck import RobustnessCheck 2from robustcheck.types.AttackType import AttackType 3 4model = load_model(...) 5x_test , y_test = load_data (...) 6 7rc = RobustnessCheck( 8model=model , 9x_test=x_test , 10 y_test=true_labels , 11 attack=AttackType.EVOBA , 12 attack_params={ 2New users are recommended to start with AttackType.EVOBA for its faster execution and similar functional completeness compared to AttackType.EPSGREEDY and AttackType.SIMBA.AttackType.EPSGREEDY and AttackType.SIMBA require less adjustment of hyperparameters and can produce adversarial perturbations with fewer total black-box model queries, but generally take longer due to their iterative nature. 13 "generation_size ": 30, 14 " one_step_perturbation_pixel_count": 1, 15 " pixel_space_int_flag " : True , 16 "pixel_space_min ": 0, 17 "pixel_space_max ": 255, 18 " steps " : 100, 19 " verbose " : False , 20 } 21 ) 22 23 rc.run_robustness_check() 24 rc.print_robustness_stats() A test using 1000 images from the CIFAR-100 dataset [12] with a classic VGG model [13]3produced: Robustness s t a t i s t i c s −using AttackType .EVOBA ___________________ Perturbed succ e ssfu lly 698/698 images Adversarial accuracy : 0.0 Average query count : 207.13180515759313 Average l0 distance : 20.482808022922637 Average l2 distance per pixel : 0.0006218724202762773 Median query count : 151.0 Median l0 d is t : 15.0 Max query count : 1891 Max l0 d is t : 182 ___________________ In of the 1000 image sample, 698 were correctly classified before the robustness check. All 698 correctly classified images were successfully adversarially perturbed within 100 steps (𝚜𝚝𝚎𝚙𝚜 ∶𝟷𝟶𝟶) using AttackType.EVOBA, with each step exploring 30 potential perturbations (𝚐𝚎𝚗𝚎𝚛𝚊𝚝𝚒𝚘𝚗_𝚜𝚒𝚣𝚎 ∶𝟹𝟶). Each perturbation modifies 1random pixel (𝚘𝚗𝚎_𝚜𝚝𝚎𝚙_𝚙𝚎𝚛𝚝𝚞𝚛𝚋𝚊𝚝𝚒𝚘𝚗_𝚙𝚒𝚡𝚎𝚕_𝚌𝚘𝚞𝚗𝚝 ∶𝟷) at a time. After the perturbations, none of the 1000 images were classified correctly, resulting in a 0% adversarial accuracy. 3Used the implementation from [14]. SoftwareX 27 (2024) 101831 4 Andrei Ilie and Alin Stefanescu Fig. 2. A histogram of the queries required to produce successful adversarial perturbations. This is one of the artifacts that both utils.save_robustness_stats_artifacts() and utils.generate_mlflow_logs() produce. For best results, set 𝚘𝚗𝚎_𝚜𝚝𝚎𝚙_𝚙𝚎𝚛𝚝𝚞𝚛𝚋𝚊𝚝𝚒𝚘𝚗_𝚙𝚒𝚡𝚎𝚕_𝚌𝚘𝚞𝚗𝚝 to approximately 0.1% of an image’s total pixels. Increasing 𝚐𝚎𝚗𝚎𝚛𝚊𝚝𝚒𝚘𝚗_𝚜𝚒𝚣𝚎 to 100–400 enhances speed but requires more queries. Refer to the original paper [4] for detailed guidance on tuning AttackType.EVOBA. To log robustness artifacts, use the following code snippet: 1from robustcheck.utils import save_robustness_stats_artifacts 2save_robustness_stats_artifacts(rc, path_to_output) This stores artifacts at 𝚙𝚊𝚝𝚑_𝚝𝚘_𝚘𝚞𝚝𝚙𝚞𝚝, including histograms of successful adversarial perturbation L0 and L2 norms (𝚕𝟶_𝚍𝚒𝚜𝚝𝚜_𝚑𝚒𝚜𝚝𝚘𝚐𝚛𝚊𝚖.𝚙𝚗𝚐 and 𝚕𝟸_𝚍𝚒𝚜𝚝𝚜_𝚑𝚒𝚜𝚝𝚘𝚐𝚛𝚊𝚖.𝚙𝚗𝚐), a histogram of query counts (𝚚𝚞𝚎𝚛𝚒𝚎𝚜_𝚑𝚒𝚜𝚝𝚘𝚐𝚛𝚊𝚖.𝚙𝚗𝚐 -Fig. 2), and a JSON file with both aggregated metrics and raw data (𝚛𝚘𝚋𝚞𝚜𝚝𝚗𝚎𝚜𝚜_𝚜𝚝𝚊𝚝𝚜.𝚓𝚜𝚘𝚗). To generate MLflow-compatible artifacts, including all previously described metrics, artifacts, and perturbed images for quick qualitative assessment, use the following code snippet: 1from robustcheck.utils import save_robustness_stats_artifacts 2generate_mlflow_logs(rc, run_name , experiment_name , tracking_uri) 3. Illustrative examples In our ongoing research, we enhance neural network robustness by combining them with gradient-boosted models, leveraging the inherent Lipschitz continuity of neural network layers [15]. This property ensures that input variations result in linearly bounded output changes, meaning adversarial perturbations accumulate across layers instead of causing large deviations in any single layer. We create a more robust stacked model by using an initial portion of a neural network as input to a gradient-boosted model. We use 𝐑𝐨𝐛𝐮𝐬𝐭𝐂𝐡𝐞𝐜𝐤 to test our hypothesis that ensembles of gradient-boosted models and deep neural networks are more adversarially robust than deep neural networks alone. We compare the robustness of a VGG neural network, as described in Section 2.3, against a prefix of the same network ensembled with a final LightGBM [16]. Both models are trained on the CIFAR-100 training data and are validated using 𝐑𝐨𝐛𝐮𝐬𝐭𝐂𝐡𝐞𝐜𝐤 on a sample of 1000 test images. The results are presented in Table 1. The ensemble model (Stack), which combines a neural network with a gradient-boosted model, consistently outperforms the standalone neural network (NN) in adversarial accuracy. The two attacks we introduced, AttackType.EVOBA and AttackType.EPSGREEDY, are more effective and faster than AttackType.SIMBA, perturbing more images in less time. However, the improved robustness of Stack comes with a slight reduction in accuracy: NN achieve 70.48% accuracy on the CIFAR-100 test set, while Stack achieves 69.97%. Comparing average query counts, distances, and iteration times across models with largely different adversarial accuracies can be problematic due to selection bias. This happens as robustness is influenced by both model design and the inherent characteristics of image samples [17]. When attacking robust models, fewer of the inherently more robust images are successfully perturbed, skewing the evaluation towards easier-to-perturb samples. For instance, when using AttackType.EPSGREEDY in our study, NN had a higher average query count (39.1) than Stack (36.2) for all perturbed images. Yet, when only considering images perturbed by both, the bias disappears, revealing average query counts of 35.4 for NN and 36.8 for Stack and reinforcing Stack’s superior robustness. Therefore, while these metrics indicate a measure of robustness, they require careful assessments. Adversarial accuracy, however, is unaffected by biases and serves as the most reliable robustness measure. 4. Impact RobustCheck simplifies the evaluation of adversarial robustness for computer vision classifiers, simulating real-world scenarios where attackers only use API calls and do not have access to model internals. This tool addresses the often-overlooked aspect of adversarial robustness, aiming to shift the focus towards creating safer, more reliable models, especially as their use in critical areas increases. Designed for developer convenience, RobustCheck provides quick and meaningful robustness metrics through efficient attacks. In integrates seamlessly into development workflows and CI/CD pipelines. This facilitates robustness testing and establishing baseline robustness criteria for automatic model deployment. The 𝙰𝚝𝚝𝚊𝚌𝚔𝚃𝚢𝚙𝚎.𝙴𝚅𝙾𝙱𝙰 attack, a key component of RobustCheck, is proven in our peer-reviewed research [4] to effectively assess the robustness of models such as ResNet-50 [18] or the classic LeNet [19] on standard datasets such as MNIST [20], CIFAR [12], or ImageNet [21]. We demonstrated that it matches the effectiveness of state-of-the-art black-box attacks while offering faster run times, thus enabling efficient robustness studies. Interestingly, our research found that simpler models and tasks tend to be more robust’’. The package is currently fueling our research into building more robust models by stacking components of deep learning models with gradient-boosted models such as LightGBM. Additionally, the package is used at Bolt, Europe’s first mobility super-app, to assess the robustness of computer vision models used in micromobility. These models include pavement classifiers that analyze images from scooter cameras to detect sidewalk riding, which is dangerous and prohibited in many cities. The package has been downloaded almost 1000 times over slightly above one month since its release in late January 2024.4 5. Conclusions In this work, we introduced RobustCheck, a Python package designed for the efficient and user-friendly assessment of adversarial robustness of computer vision models. RobustCheck is already enhancing our research into robust deep learning models and supporting industrial applications at Bolt, particularly for scooter-related vision models. 4Download stats are tracked here: https://www.pepy.tech/projects/ robustcheck. SoftwareX 27 (2024) 101831 5 Andrei Ilie and Alin Stefanescu Table 1 Comparison of robustness metrics for two models as output by 𝑅𝑜𝑏𝑢𝑠𝑡𝐶ℎ𝑒𝑐𝑘. NN is a VGG neural network architecture, while Stack is an ensemble of a prefix of the same neural network and a gradient-boosted model. Attack Type Model Adversarial accuracy Average query count Average L0 distance Average L2 distance (×10−4) Seconds per iteration EVOBA NN 0.0% 204.5 20.3 6.1 1.4 Stack 6.6% 255.0 25.0 6.2 2.6 EPS NN 10.8% 39.1 49.4 8.6 1.8 Stack 20.0% 36.2 38.4 7.5 1.2 SIMBA NN 42.7% 73.5 36.6 1.8 4.7 Stack 53.0% 73.6 22.6 1.4 3.34 While RobustCheck focuses on computer vision tasks, moving forward we plan to expand its capabilities to support text, audio, and video. Its adaptable design, based on evolutionary black-box strategies, will facilitate the integration of these modalities, providing a comprehensive suite for robustness assessment across various AI applications. CRediT authorship contribution statement Andrei Ilie: Writing – review & editing, Writing – original draft, Visualization, Validation, Software, Resources, Project administration, Methodology, Investigation, Formal analysis, Data curation, Conceptualization. Alin Stefanescu: Writing – review & editing, Writing – original draft, Supervision, Software, Project administration, Methodology, Conceptualization. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Data availability All code is open under MIT license https://github.com/andreiilie1/ RobustCheck. Declaration of Generative AI and AI-assisted technologies in the writing process During the preparation of this work, the authors used OpenAI’s ChatGPT to enhance the manuscript’s readability, identify and correct typographical errors, and refine the text for conciseness and clarity. After using this tool/service, the authors reviewed and edited the content as needed and take full responsibility for the content of the publication. Acknowledgments This research was partially supported by the European Union’s Horizon Europe research and innovation programme under grant agreement number 101070455, project DYNABIC. We are grateful to Marius Popescu, professor at the University of Bucharest, who helped us develop AttackType.EVOBA as part of our original publication [4]. We would also like to thank Traian Delca and Amatia Lomax, senior data scientists at Bolt, who tested, provided feedback and adopted the RobustCheck package for their micromobility computer vision research. References [1] Wang Zheng, Ruan Wenjie, Yin Xiangyu. ODE4ViTRobustness: A tool for understanding adversarial robustness of vision transformers. Software Impacts 2023;15:100449. http://dx.doi.org/10.1016/j.simpa.2022.100449. [2] Khan Shahrukh, Shahid Mahnoor, Singh Navdeeppal. BERT probe: A python package for probing attention based robustness evaluation of BERT models. Software Impacts 2022;13:100310. http://dx.doi.org/10.1016/j.simpa.2022. 100310. [3] Ilie Andrei. andreiilie1/RobustCheck: support AttackType.simba, v1.1.0, Zenodo. 2024, https://zenodo.org/doi/10.5281/zenodo.10789485. [4] Ilie Andrei, Popescu Marius, Stefanescu Alin. EvoBA: An evolution strategy as a strong baseline for black-box adversarial attacks. In: Proc. of the 28th int. conf. on neural information processing (iCONIP’21), part III. 2021, p. 188–200. http://dx.doi.org/10.1007/978-3-030-92238-2_16. [5] Guo Chuan, Gardner Jacob, You Yurong, Wilson Andrew Gordon, Weinberger Kilian. Simple black-box adversarial attacks. In: Proc. of the int. conf. on machine learning. 2019, p. 2484–93. [6] Nicolae Maria-Irina, Sinn Mathieu, Tran Minh Ngoc, Buesser Beat, Rawat Ambrish, Wistuba Martin, et al. Adversarial robustness toolbox v1.2.0. 2018, CoRR, vol. 1807.01069. https://arxiv.org/pdf/1807.01069. [7] Chen Pin-Yu, Zhang Huan, Sharma Yash, Yi Jinfeng, Hsieh Cho-Jui. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In: Proc. of the 10th ACM workshop on artificial intelligence and security. 2017, p. 15–26. http://dx.doi.org/10.1145/3128572. 3140448. [8] Zaharia Matei A, Chen Andrew, Davidson Aaron, Ghodsi Ali, Hong Sue Ann, Konwinski Andy, et al. Accelerating the machine learning lifecycle with MLflow. IEEE Data Eng Bull 2018;41:39–45, https://api.semanticscholar.org/CorpusID: 83459546. [9] Bai Tao, Luo Jinqi, Zhao Jun, Wen Bihan, Wang Qian. Recent advances in adversarial training for adversarial robustness. In: Proc. of the 13th int. joint conf. on artificial intelligence. 2021, p. 4312–21. http://dx.doi.org/10.24963/ ijcai.2021/591. [10] Papernot Nicolas, McDaniel Patrick D, Wu Xi, Jha Somesh, Swami Ananthram. Distillation as a defense to adversarial perturbations against deep neural networks. In: IEEE symposium on security and privacy. 2016, p. 582–97. http: //dx.doi.org/10.1109/SP.2016.41. [11] Wunder Michael, Littman Michael L, Babes Monica. Classes of multiagent qlearning dynamics with epsilon-greedy exploration. In: Proc. of the 27th int. conf. on machine learning. 2010, p. 1167–74. [12] Krizhevsky Alex, Hinton Geoffrey. Learning multiple layers of features from tiny images. Technical report, Toronto, Ontario: University of Toronto; 2009, https://www.cs.toronto.edu/kriz/learning-features-2009-TR.pdf. [13] Simonyan Karen, Zisserman Andrew. Very deep convolutional networks for largescale image recognition. In: Proc of. the 3rd int. conf. on learning representations. 2015, http://arxiv.org/abs/1409.1556. [14] Geifman Yonatan. Cifar-vgg git repository. 2013, https://github.com/geifmany/ cifar-vgg. [15] Gouk Henry, Frank Eibe, Pfahringer Bernhard, Cree Michael J. Regularisation of neural networks by enforcing Lipschitz continuity. Mach Learn 2021;110(3):393–416. http://dx.doi.org/10.1007/s10994-020-05929-w. [16] Ke Guolin, Meng Qi, Finley Thomas, Wang Taifeng, Chen Wei, Ma Weidong, et al. Lightgbm: A highly efficient gradient boosting decision tree. In: Advances in neural information processing systems, vol. 30, 2017, p. 3146–54, https: //lightgbm.readthedocs.io/en/stable/. [17] Ilie Andrei, Stefanescu Alin, Popescu Marius. Robustness as inherent property of datapoints. In: Proc. of the workshop on artificial intelligence safety 2020 co-located with the 29th int. joint conf. on artificial intelligence and the 17th Pacific Rim int. conf. on artificial Intelligence. 2021. [18] He Kaiming, Zhang Xiangyu, Ren Shaoqing, Sun Jian. Deep residual learning for image recognition. In: IEEE conf. on computer vision and pattern recognition. 2016, p. 770–8. http://dx.doi.org/10.1109/CVPR.2016.90. [19] LeCun Yann, Bottou Léon, Bengio Yoshua, Haffner Patrick. Gradient-based learning applied to document recognition. Proc IEEE 1998;86(11):2278–324, http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.42.7665. [20] Deng Li. The MNIST database of handwritten digit images for machine learning research. IEEE Signal Process Mag 2012;29(6):141–2. [21] Deng Jia, Dong Wei, Socher Richard, Li Li-Jia, Li Kai, Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In: IEEE conf. on computer vision and pattern recognition. 2009, p. 248–55. http://dx.doi.org/10.1109/CVPR.2009. 5206848.