🤖 machine learning

PRBench: A Standardized Probabilistic Robustness Benchmark

This paper introduces PRBench, the first standardized benchmark for evaluating probabilistic robustness in deep learning models, which reveals that while adversarial training methods offer greater versatility across hyperparameters, probabilistic robustness-specific training methods achieve lower generalization error and higher clean accuracy.

Original authors: Yi Zhang, Zheng Wang, Zhen Chen, Wenjie Ruan, Qing Guo, Siddartha Khastgir, Carsten Maple, Xingyu Zhao

Published 2026-05-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yi Zhang, Zheng Wang, Zhen Chen, Wenjie Ruan, Qing Guo, Siddartha Khastgir, Carsten Maple, Xingyu Zhao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have built a very smart robot to recognize pictures of cats and dogs. You want to make sure this robot doesn't get confused by tiny, invisible changes to the pictures—like a few pixels shifting or a little bit of static noise.

In the world of AI, there are two main ways to test if your robot is "tough" enough:

The "Worst-Case" Test (Adversarial Robustness): This is like a master thief trying to find the single, perfect way to trick your robot. If the thief can find even one picture that makes the robot say "Dog" when it's clearly a "Cat," the robot fails. This is the standard way people have tested AI for years.
The "Real-World" Test (Probabilistic Robustness): This is more like a weather forecast. Instead of asking, "Can a thief trick the robot?" it asks, "If we shake the picture randomly 1,000 times, how often does the robot still get it right?" Maybe the robot fails 5 times out of 1,000, but gets it right 995 times. In the real world, that might be good enough.

The Problem: A Missing Scorecard

The authors of this paper noticed a big gap. We have a huge library of tests for the "Worst-Case" thief, but we don't have a standardized way to compare different training methods for the "Real-World" weather test.

Some researchers tried to build special training methods just to improve this "Real-World" score. But because everyone used different rules and different tests, no one could tell which method was actually the best. It was like trying to compare the speed of two cars when one driver is using a stopwatch and the other is using a sundial.

The Solution: PRBench (The New Scorecard)

The team created PRBench, the first standardized "scorecard" specifically designed to test how well AI handles these random, real-world disturbances.

They took 229 different AI models (ranging from simple ones to very complex ones) and trained them using 13 different methods. These methods included:

Standard Training: Just teaching the AI normally.
Adversarial Training (AT): Teaching the AI by showing it the "thief's" best tricks (the worst-case scenarios).
Probabilistic Training (RT): Teaching the AI specifically to handle random noise.
Hybrid Methods: A mix of both.

The Big Surprises

After running all these tests, the authors found some things that went against common intuition:

1. The "Free Lunch" Discovery
The biggest surprise was that the methods designed to stop the "thief" (Adversarial Training) were actually also the best at handling random noise.

Analogy: Imagine you are training a boxer. You decide to train them by fighting a heavyweight champion (the worst-case scenario). You expect them to get good at fighting heavyweights. But, surprisingly, they also become incredibly good at dodging random, light taps from a crowd.
The Finding: The paper claims that if you train your AI to be robust against the worst-case "thief," you get "probabilistic robustness" (handling random noise) almost for free. You don't necessarily need a separate, special training method just for random noise.

2. The Trade-Offs
However, there is a cost.

Adversarial Training (The Heavyweight Fighter): Makes the AI very tough against both thieves and random noise, but it sometimes makes the AI slightly slower or less accurate when looking at perfect, clean pictures.
Probabilistic Training (The Noise Specialist): These methods keep the AI very good at looking at clean pictures and handle random noise well, but they are surprisingly weak against the "thief" (worst-case attacks).

3. The "Hybrid" Hope
There is a new, fancy method called AT-PR that tries to combine the best of both worlds. It uses the "thief-fighting" strategy but tweaks it to also care about random noise. It does a great job balancing everything, but it is very expensive to run (like hiring a team of 100 trainers instead of one).

The Conclusion

The paper suggests that for a long time, people have been trying to invent complex, specialized tools just to fix the "random noise" problem. But the data shows that the standard "thief-fighting" tools (Adversarial Training) are already doing a fantastic job at fixing both problems.

The authors aren't saying we should stop researching "probabilistic robustness." Instead, they are saying: "Stop reinventing the wheel. The tools we already have for the worst-case scenarios are surprisingly good at handling the everyday stuff too."

They built this benchmark (PRBench) so that in the future, researchers can stop guessing and start using a clear, shared ruler to measure progress, ensuring we build AI that is safe and reliable in both extreme and everyday situations.

Technical Summary: PRBench: A Standardized Probabilistic Robustness Benchmark

Problem Statement

Deep learning models are inherently vulnerable to imperceptible input perturbations. While the field has extensively focused on Adversarial Robustness (AR)—evaluating a model's ability to withstand worst-case, deterministic adversarial examples (AEs)—this perspective often fails to capture the probabilistic nature of real-world risks. Probabilistic Robustness (PR) offers a more practical alternative by measuring the probability that a model's prediction remains correct under stochastic perturbations.

Despite the recognized value of PR, research into training methods specifically designed to improve it remains underexplored compared to AR. Existing PR-targeted training methods suffer from three critical limitations:

Non-comparable evaluation protocols: Methods use disparate metrics, preventing holistic assessment.
Limited baseline comparisons: There is insufficient understanding of how standard Adversarial Training (AT) methods, primarily designed for AR, perform as PR improvement tools, despite anecdotal evidence that they may enhance PR as a "free by-product."
Lack of unified theoretical framework: There is no common theoretical basis to compare the generalization capabilities of different PR-targeted training methods.

Methodology: PRBench

To address these gaps, the authors introduce PRBench, the first standardized benchmark dedicated to evaluating training methods for improving Probabilistic Robustness.

Experimental Scope

Scale: The benchmark trains and evaluates 229 models across 7 datasets (MNIST, SVHN, CIFAR-10, CIFAR-100, CINIC-10, TinyImageNet, ImageNet-50) and 10 model architectures (including VGG-19, ResNet variants, WideResNet, ViT, and DeiT).
Training Methods: PRBench categorizes and compares 13 distinct training approaches:
- Standard Training: Empirical Risk Minimization (ERM).
- Adversarial Training (AT): 6 methods including PGD, TRADES, MART, ALP, CLP, and a newly introduced diagnostic variant KL-PGD (using KL-divergence for AE generation but cross-entropy for training).
- Risk-Based Training (RT): 4 methods (Corruption training, CVaR, EVaR) that optimize statistical risks over perturbation distributions rather than worst-case AEs.
- Hybrid Method: AT-PR, a recent approach that adapts AT principles to target PR by identifying optimal AEs that maximize the "all-AE" region.
Evaluation Metrics: The benchmark employs a comprehensive suite of metrics:
- Clean Accuracy: Standard performance on unperturbed data.
- Adversarial Robustness (AR): Measured via 4 white-box attacks (PGD10, PGD20, C&W, Auto-Attack).
- Probabilistic Robustness (PR): Quantified using $PR_D(\gamma)$ (average probability of correct prediction under perturbation) and $ProbAcc(\rho)$ (fraction of inputs exceeding a robustness threshold).
- Generalization Error (GE): The gap between training and test performance for both AR and PR.
- Efficiency: Training time per epoch.

Theoretical Analysis

The authors provide a theoretical analysis grounded in Uniform Algorithmic Stability. They derive bounds for the Generalization Error (GE) under different training regimes:

RT Methods: Proven to yield smoother training processes (Lipschitz and smoothness properties) compared to AT, theoretically explaining their lower GE and reduced robust overfitting.
AT Methods: The analysis shows that AT introduces an additional term proportional to the smoothness of the surrogate loss, which contributes to robust overfitting. However, methods incorporating penalties on softmax outputs (like TRADES) can mitigate this by reducing the Lipschitz constant of the objective.

Key Results

The empirical evaluation reveals two distinct trade-off frontiers:

Adversarial Training (AT) Dominance in Robustness:
- Contrary to the assumption that PR requires specialized training, standard AT methods (e.g., PGD, TRADES) consistently outperform PR-targeted methods in improving both AR and PR.
- AT-trained models achieve over 99% PR performance within the training perturbation norm-ball, often with little to no extra cost compared to PR-specific methods.
- This suggests that for many scenarios, PR is a "free by-product" of strong AR training.
PR-Targeted Methods in Accuracy and Generalization:
- While RT methods (e.g., Corruption, CVaR) improve PR over standard ERM, they significantly lag behind AT in AR performance, often dropping to near-zero under strong attacks.
- However, RT methods maintain higher clean accuracy and exhibit lower Generalization Error (GE) compared to AT methods.
- The AT-PR hybrid method offers a balanced trade-off, achieving PR performance comparable to AT, AR performance superior to RT, and better clean accuracy than standard AT, though at a significantly higher computational cost.
Efficiency vs. Performance:
- Corruption training is highly efficient but offers limited robustness gains.
- CVaR and AT-PR are computationally expensive due to the need for multiple samples or complex optimization loops.
- Standard AT methods (like PGD and TRADES) offer a middle ground in efficiency while delivering the highest composite robustness scores.

Significance and Claims

The paper positions PRBench as a necessary standardization for the field, arguing that the current lack of unified evaluation hinders the understanding of the relationship between AR and PR.

Re-evaluating the Need for PR-Specific Methods: The authors propose a "bold hypothesis" that there may be limited practical need for developing separate PR-targeted training methods, given that strong AT methods already yield substantial PR improvements.
Future Direction: Rather than focusing solely on PR-specific approaches, the authors suggest future research should prioritize versatile, AT-based approaches (such as the diagnostic KL-PGD or the hybrid AT-PR) that jointly enhance AR and PR while maintaining clean accuracy and low generalization error.
Resource Availability: To facilitate this research, the authors have released a public leaderboard containing results for all 229 trained models and an open-source codebase, allowing for the systematic comparison of current and future robustness training methods.

In summary, PRBench demonstrates that while specialized PR training offers advantages in generalization and clean accuracy, standard adversarial training remains the most effective and efficient strategy for achieving high probabilistic robustness, challenging the necessity of siloed PR training paradigms.