Robustness and Adversarial Defense
# Robustness and Adversarial Defense
## Introduction & Motivation
Robustness: ensuring model performance under perturbations. Adversarial defense: preventing attacks. Critical for real-world deployment and safety-critical applications.
Motivation: Build reliable, attack-resistant AI systems.
Applications: Autonomous driving, security, financial systems.
---
## Core Concepts & Theory
### Adversarial Examples
Inputs designed to fool models.
### Certified Defenses
Formal robustness guarantees.
### Adversarial Training
Learn robust representations.
### Input Perturbations
Bounded noise constraints.
---
## Mathematical Formulation
Adversarial Example:
$$x' = x + \delta, \quad \|\delta\|_p \leq \epsilon$$
Robust Optimization:
$$\min_ heta \mathbb{E}_{(x,y)} \max_{\|\delta\| \leq \epsilon} L(f_ heta(x+\delta), y)$$
Certified Robustness:
$$ ext{Rad}(x) = \sup_{x': \|x'-x\| \leq r} f(x')$$
---
## Advanced Theory & Extensions
### Randomized Smoothing
Statistical robustness certificates.
### TRADES Loss
Trade-off between accuracy and robustness.
### Fast Adversarial Training
Efficient robust learning.
---
## Computational Considerations
Attack Generation: O(K·D²) for K steps.
Adversarial Training: 5-10x standard training.
Certification: O(N·S) for N samples, S smoothing.
---
## Practical Implementation Strategies
### Attack Methods
PGD, FGSM, CW attacks.
### Defense Methods
Adversarial training, input preprocessing.
### Verification
Formal robustness proofs.
---
## Benchmark Datasets & Evaluation
MNIST: Simple robustness.
CIFAR-10: Medium complexity.
ImageNet: Large-scale robustness.
---
## Key Challenges & Limitations
### Accuracy-Robustness Tradeoff
Often conflicting objectives.
### Certified Guarantees
Loose bounds in high dimensions.
### Computational Cost
Expensive robust training.
---
## Hyperparameter Tuning
Epsilon (perturbation budget): 8/255 (CIFAR), 0.3 (MNIST).
Adversarial steps: 7-20.
Trade-off beta: 1.0-6.0.
---
## Real-World Applications & Case Studies
Autonomous Driving: Safety under perturbations.
Malware Detection: Adversarial robustness.
Facial Recognition: Robustness to patches.
---
## Integration with Other Methods
Robustness + interpretability; + uncertainty; + fairness.
---
## Summary & Key Takeaways
Robustness ensures reliable AI systems.
Principles:
1. Defense: Prevent adversarial attacks.
2. Training: Adversarial learning.
3. Certification: Formal guarantees.
4. Verification: Proof of robustness.
5. Tradeoff: Balance accuracy and robustness.
---
## Appendix: Practical Labs
### Lab 1: FGSM Attack
import numpy as np
def fgsm_attack(model, x, y, epsilon=0.1):
"""Fast Gradient Sign Method attack"""
# Compute gradient
gradient = compute_gradient(model, x, y)
# Adversarial perturbation
perturbation = epsilon * np.sign(gradient)
# Adversarial example
x_adv = x + perturbation
x_adv = np.clip(x_adv, -1, 1) # Clip to valid range
return x_adv
def compute_gradient(model, x, y):
"""Compute loss gradient (simplified)"""
gradient = np.random.randn(*x.shape) # Placeholder
return gradient
x = np.random.rand(10)
y = 0
model = lambda inp: inp.sum()
x_adv = fgsm_attack(model, x, y, epsilon=0.1)
print(f"✓ FGSM attack: perturbation norm={np.linalg.norm(x_adv - x):.3f}")### Lab 2: Adversarial Training
import numpy as np
def adversarial_training_step(model, x, y, epsilon=0.1, lr=0.01):
"""One step of adversarial training"""
# Generate adversarial example
gradient = np.random.randn(*x.shape)
x_adv = x + epsilon * np.sign(gradient)
x_adv = np.clip(x_adv, -1, 1)
# Train on both original and adversarial
clean_loss = np.mean((model(x) - y) ** 2)
robust_loss = np.mean((model(x_adv) - y) ** 2)
# Combined loss
total_loss = 0.5 * clean_loss + 0.5 * robust_loss
return total_loss
def train_robust_model(model_weights, X, y, epochs=10, epsilon=0.1):
"""Train adversarially robust model"""
for epoch in range(epochs):
total_loss = 0
for i in range(len(X)):
loss = adversarial_training_step(lambda x: x @ model_weights,
X[i], y[i], epsilon)
total_loss += loss
# Update model (simplified)
model_weights += 0.01 * np.random.randn(*model_weights.shape) * 0.001
model = np.random.randn(10, 1) * 0.01
X = np.random.randn(50, 10)
y = np.random.rand(50)
train_robust_model(model, X, y)
print(f"✓ Adversarial training completed")### Lab 3: Certified Robustness via Randomized Smoothing
import numpy as np
def randomized_smoothing_certification(model, x, sigma=0.25, num_samples=1000):
"""Certify robustness via randomized smoothing"""
# Generate noisy samples
noisy_samples = np.tile(x, (num_samples, 1)) + np.random.randn(num_samples, len(x)) * sigma
# Get predictions
predictions = np.array([model(sample) for sample in noisy_samples])
# Most confident class
predicted_class = np.argmax(np.bincount(predictions.astype(int)))
count_predicted = np.sum(predictions == predicted_class)
# Certified radius
p_lower = count_predicted / num_samples
if p_lower > 0.5:
certified_radius = (sigma / 2) * (2 * p_lower - 1)
else:
certified_radius = 0
return certified_radius
model = lambda x: 0 if x.sum() > 0 else 1
x = np.random.randn(10)
radius = randomized_smoothing_certification(model, x, sigma=0.25)
print(f"✓ Certified robustness radius: {radius:.3f}")### Lab 4: Robust Model Evaluation
import numpy as np
class RobustModelEvaluator:
def __init__(self, model):
self.model = model
self.results = {
'clean_accuracy': [],
'robust_accuracy': [],
'certified_radius': []
}
def evaluate_clean_accuracy(self, X_test, y_test):
"""Evaluate on clean data"""
predictions = np.array([self.model(x) for x in X_test])
accuracy = np.mean(predictions == y_test)
self.results['clean_accuracy'].append(accuracy)
return accuracy
def evaluate_robust_accuracy(self, X_test, y_test, epsilon=0.1, num_attacks=10):
"""Evaluate against adversarial attacks"""
correct_under_attack = 0
for x, y_true in zip(X_test, y_test):
# Generate multiple adversarial examples
is_robust = True
for _ in range(num_attacks):
gradient = np.random.randn(*x.shape)
x_adv = x + epsilon * np.sign(gradient)
if self.model(x_adv) != y_true:
is_robust = False
break
if is_robust:
correct_under_attack += 1
robust_accuracy = correct_under_attack / len(X_test)
self.results['robust_accuracy'].append(robust_accuracy)
return robust_accuracy
def report(self):
"""Generate robustness report"""
return self.results
model = lambda x: 0 if x.sum() > 0 else 1
X_test = np.random.randn(20, 10)
y_test = np.array([0 if x.sum() > 0 else 1 for x in X_test])
evaluator = RobustModelEvaluator(model)
clean_acc = evaluator.evaluate_clean_accuracy(X_test, y_test)
robust_acc = evaluator.evaluate_robust_accuracy(X_test, y_test)
print(f"✓ Clean accuracy: {clean_acc:.2%}")
print(f"✓ Robust accuracy: {robust_acc:.2%}")---