adversarial

**Adversarial Robustness Deep Learning** is **the study of neural network vulnerability to small input perturbations (adversarial examples) and development of robust models resistant to attacks** — critical for deployment in adversarial settings. Adversarial robustness remains open challenge. **Adversarial Examples** small perturbations to input (imperceptible to humans) cause misclassification. Images: pixel-level noise. Text: character/word-level changes. Audio: imperceptible frequency shifts. Discovered by Szegedy et al. 2013. **FGSM (Fast Gradient Sign Method)** simple attack: perturb in direction of gradient toward wrong class. One-step attack, fast, often effective. **Iterative Attacks** IFGSM (Iterative FGSM): apply FGSM multiple steps, stronger attack. PGD (Projected Gradient Descent): optimal attack under L-infinity constraint. **C&W Attack** Carlini-Wagner: formulate adversarial example as optimization problem. Very effective, computationally expensive. **Black-Box Attacks** without model access. Transferability: adversarial examples for one model often fool others. Use substitute model. Query-based attacks estimate gradients via queries. **Adversarial Training** train on adversarial examples. Include adversarial perturbations in training data. Defense reduces accuracy-robustness tradeoff. **Certified Defenses** mathematically prove robustness bounds. Randomized smoothing: smoothed classifier certifiably robust. Verification methods (abstract interpretation, SAT solvers) prove no adversarial examples exist in region. **Robustness Metrics** L2 perturbation (Euclidean), L-infinity (max deviation), L0 (sparsity). Different norms have different attack strategies. **TRADES (Trade-offs between Accuracy and Robustness)** balance accuracy on clean data with adversarial robustness. Robust models sacrifice some clean accuracy. **Evaluation Methodology** properly evaluating robustness difficult. Adaptive attacks account for defense—sometimes 'defense' circumventable. Red teaming: adversary knows defense. **Backdoor Attacks** poisoning training data: specific patterns trigger misclassification. Defense: outlier detection, fine-tuning on clean data. **Trojan Attacks** similar to backdoor. Neural network Trojans activate under specific input pattern. **Transferability** adversarial examples transfer across models, architectures, datasets. Implies commonality in adversarial space. **Interpretability and Adversarial Examples** adversarial examples exploit model's feature representations. Saliency maps highlight features used. **Robustness and Interpretability Link** more interpretable models might be more robust? Unclear relationship. **Geometry of Adversarial Space** adversarial examples lie near decision boundary. Robust models have larger margins. **Defense Mechanisms** many proposed: defensive distillation, neural network purification, ensemble methods. Most have been broken. **Perturbation Budgets** maximum allowed perturbation epsilon. Smaller epsilon easier to defend (larger epsilon harder). **Poisoning vs. Evasion** poisoning: attack during training, evasion: attack at test time. **Certified Perturbation Bounds** formal bounds: if model is ε-robust, adversarial perturbation magnitude guaranteed bounded. **Applications and Deployment** autonomous vehicles (adversarial stop sign), biometric systems (spoofing), medical imaging (misdiagnosis). **Current State** perfect robustness infeasible. Practical deployment uses modest robustness with detection. **Robustness Benchmarks** RobustBench: standardized robustness evaluation, model comparison. **Open Questions** fundamental limits of robustness: is accuracy-robustness tradeoff inherent? Adversarial robustness remains active research** with significant practical implications.