How to Handle Top-k Predictions in VERONA Attack-Based Robustness Estimation

VERONA evaluates neural network robustness by checking whether true labels remain within the top-k predictions after adversarial attacks, configurable through the top_k parameter in AttackEstimationModule and PredictionsBasedSampler.

VERONA (Vision Robustness Analysis) is an open-source framework by ada-research for estimating the robustness of deep learning models against adversarial perturbations. When handling top-k predictions in VERONA attack-based robustness estimation, the framework allows you to define robustness beyond the single highest-scoring class, enabling more nuanced safety evaluations where a model is considered correct if the true label appears anywhere in its k-most-confident predictions.

Core Components for Top-k Handling

VERONA implements top-k logic in two primary locations: the verification module that assesses attack success and the dataset sampler that filters data points based on model predictions.

AttackEstimationModule (Verification Logic)

The AttackEstimationModule class in ada_verona/verification_module/attack_estimation_module.py uses the top_k parameter to determine how many of the highest-scoring output classes are examined when verifying whether an attack succeeded. Defined in the __init__ method at line 35, this parameter controls the robustness criterion applied during verification.

After an attack generates a perturbed input, VERONA runs the model inference and calls torch.topk(output, self.top_k) at line 74 to retrieve the indices of the k highest logits. The verification checks whether the true label appears among these indices. If the true label is absent from the top-k predictions, the attack is considered successful.

PredictionsBasedSampler (Data Selection)

The PredictionsBasedSampler class in ada_verona/dataset_sampler/predictions_based_sampler.py leverages top_k to control whether a data point is classified as "correct" for sampling purposes. Initialized at line 28, this parameter filters datasets to include only points where the model's prediction behavior matches specific criteria.

For each data point, the sampler computes torch.topk(output, self.top_k) at line 65 and evaluates the presence or absence of the true label within those top predictions. This allows researchers to construct targeted subsets—such as "hard examples" where the model fails to place the correct label in its top-k confidence scores.

Why Top-k Matters for Robustness Metrics

The flexibility to adjust k values is essential for tasks where multiple classes are semantically similar or when evaluating confidence-based safety margins.

• Standard 1-top-k (default): VERONA's original robustness definition checks only the highest-scoring class, representing the strictest adversarial criterion.
• Higher k values: Allow more permissive robustness metrics where a model is considered robust if the true label stays within the top-3 or top-5 predictions after perturbation.
• Confidence analysis: Top-k evaluation helps identify models that maintain correct labels within their confidence envelope even when the argmax changes due to small input perturbations.

Implementation Details and Code Examples

Using AttackEstimationModule with Custom Top-k

The following example demonstrates how to configure VERONA to verify robustness using a top-5 criterion instead of the default top-1:

from ada_verona.verification_module.attack_estimation_module import AttackEstimationModule
from ada_verona.verification_module.attacks.pgd_attack import PGDAttack
from ada_verona.verification_module.property_generator.one2any_property_generator import One2AnyPropertyGenerator
from ada_verona.database.experiment_repository import ExperimentRepository
from pathlib import Path

# Load an experiment (network + dataset) – replace with your own repository path

repo = ExperimentRepository(Path("/tmp/verona_experiments"))
vc = repo.load_verification_context(
    experiment_id="exp01", 
    data_point_id=42,
    property_generator=One2AnyPropertyGenerator()
)

# Instantiate the PGD attack (ε = 0.03) and wrap it with a top‑5 estimator

attack = PGDAttack(epsilon=0.03, steps=40, step_size=0.01)
estimator = AttackEstimationModule(attack=attack, top_k=5)

# Run the verification

result = estimator.verify(vc, epsilon=0.03)
print(result)  # → CompleteVerificationData with SAT/UNSAT and the top‑5 labels

Setting top_k=5 instructs VERONA to examine the five highest-scoring classes when determining if the adversarial attack successfully removed the true label from the prediction set.

Sampling Datasets Based on Top-k Predictions

You can also filter datasets to retain only challenging examples where models fail to rank the true label highly:

from ada_verona.dataset_sampler.predictions_based_sampler import PredictionsBasedSampler
from ada_verona.database.experiment_repository import ExperimentRepository
from pathlib import Path

repo = ExperimentRepository(Path("/tmp/verona_experiments"))
network = repo.load_network("resnet18")
dataset = repo.load_dataset("cifar10_test")

# Keep only points that are *incorrectly* classified in the top‑3 predictions

sampler = PredictionsBasedSampler(sample_correct_predictions=False, top_k=3)
hard_subset = sampler.sample(network, dataset)

print(f"Subset size: {len(hard_subset)}")  # Number of challenging examples

Here, sample_correct_predictions=False combined with top_k=3 selects data points where the true label is not among the model's three most confident predictions, creating a dataset of adversarially vulnerable examples.

Limitations and Property Generator Compatibility

Currently, AttackEstimationModule.verify supports only the One-to-Any verification setting via One2AnyPropertyGenerator. In this mode, the property asserts that any class among the top-k should not be the true label after the attack. Attempting to use other property generators raises a NotImplementedError at line 84 in ada_verona/verification_module/attack_estimation_module.py.

When designing experiments, ensure you instantiate the verification context with One2AnyPropertyGenerator() to avoid runtime errors when using custom top-k values.

Summary

• VERONA exposes top_k parameters in AttackEstimationModule and PredictionsBasedSampler to enable flexible robustness definitions beyond argmax predictions.
• The verification logic uses torch.topk() at line 74 of attack_estimation_module.py to check if true labels persist within the top-k predictions after adversarial perturbation.
• Dataset sampling supports filtering based on top-k correctness, useful for creating targeted evaluation subsets of hard examples.
• Only One2AnyPropertyGenerator is currently supported when using AttackEstimationModule with custom top-k values.
• Higher k values provide more permissive robustness metrics appropriate for multi-class scenarios with semantically similar categories.

Frequently Asked Questions

What is the default top-k value in VERONA?

By default, VERONA uses top_k=1 in both AttackEstimationModule and PredictionsBasedSampler, corresponding to standard top-1 accuracy and the strictest adversarial robustness definition where only the highest-scoring class is considered.

How does top-k affect robustness estimation results?

Increasing top_k generally improves reported robustness percentages because the criterion becomes less strict—a model is considered robust if the true label appears anywhere in its k-most-confident predictions, not exclusively as the top prediction. This captures scenarios where adversarial perturbations shift confidence rankings without completely eliminating the correct class from consideration.

Can I use top-k with any property generator in VERONA?

No. As implemented in ada_verona/verification_module/attack_estimation_module.py, the verify method at line 84 explicitly checks for One2AnyPropertyGenerator and raises a NotImplementedError if other property generators are provided. This limitation exists because the top-k verification logic is currently designed only for the One-to-Any adversarial specification.

How do I filter datasets using top-k predictions?

Use PredictionsBasedSampler from ada_verona/dataset_sampler/predictions_based_sampler.py with the top_k parameter. Set sample_correct_predictions=True to retain points where the true label is in the top-k, or False to collect hard negatives where the model fails to rank the correct class highly. The sampler calls torch.topk() at line 65 to evaluate each data point against your criteria.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}