Machine learning models -- deep neural networks in particular -- have
performed remarkably well on benchmark datasets across a wide variety of
domains. However, the ease of finding adversarial counter-examples remains a
persistent problem when training times are measured in hours or days and the
time needed to find a successful adversarial counter-example is measured in
seconds. Much work has gone into generating and defending against these
adversarial counter-examples, however the relative costs of attacks and
defences are rarely discussed. Additionally, machine learning research is
almost entirely guided by test/train metrics, but these would require billions
of samples to meet industry standards. The present work addresses the problem
of understanding and predicting how particular model hyper-parameters influence
the performance of a model in the presence of an adversary. The proposed
approach uses survival models, worst-case examples, and a cost-aware analysis
to precisely and accurately reject a particular model change during routine
model training procedures rather than relying on real-world deployment,
expensive formal verification methods, or accurate simulations of very
complicated systems (\textit{e.g.}, digitally recreating every part of a car or
a plane). Through an evaluation of many pre-processing techniques, adversarial
counter-examples, and neural network configurations, the conclusion is that
deeper models do offer marginal gains in survival times compared to more
shallow counterparts. However, we show that those gains are driven more by the
model inference time than inherent robustness properties. Using the proposed
methodology, we show that ResNet is hopelessly insecure against even the
simplest of white box attacks.