Adversarial Robustness Adversarial Training Defense
# Adversarial Robustness: Adversarial Training & Defense
## Introduction & Motivation
Adversarial examples: small perturbations fool models. Adversarial training: augment training data with adversarial examples. Improves robustness to perturbations; certified defense. Applications: security-critical systems, autonomous driving, biometric verification.
Motivation: Neural networks vulnerable to small, imperceptible perturbations. Adversarial training builds robust models against adversarial attacks.
Applications: Autonomous vehicles, medical imaging, security systems, model robustness.
---
## Core Concepts & Theory
### Adversarial Examples
Perturbations δ constrained (L∞, L2); fool model despite imperceptibility.
### Adversarial Training
Minimize: min_θ E[(x,y)~D][max_{||δ||≤ε} L(θ, x+δ, y)]. Inner max: find worst-case perturbation; outer min: train.
### Certified Defense
Provable robustness bound; independent of attack method.
---
## Mathematical Formulation
Adversarial perturbation (L∞ constraint):
$$\delta^* = \arg\max_{||\delta||_\infty \leq \epsilon} L( heta, x + \delta, y)$$
Adversarial training objective:
$$\min_ heta \mathbb{E}_{(x,y) \sim D} \left[ \max_{||\delta||_\infty \leq \epsilon} L( heta, x + \delta, y)
ight]$$
Certified robustness (randomized smoothing):
$$ ext{Pr}[ ext{robust} | x] \geq 2\Phi\left(\frac{c_A \sigma}{2} - \frac{\sigma R}{2}
ight) - 1$$
---
## Advanced Theory & Extensions
### FGSM (Fast Gradient Sign Method)
One-step attack; δ = ε·sign(∇_x L).
### PGD (Projected Gradient Descent)
Iterative attack; stronger than FGSM.
### Certified Defenses via Randomized Smoothing
Add Gaussian noise; probabilistic certification.
---
## Computational Considerations
Adversarial training: 2-3× slower (inner maximization).
Attack generation: O(iterations × forward passes).
Certification: O(samples × noise scales).
---
## Practical Implementation Strategies
### Attack Strength ε
Balance robustness-accuracy; typically ε ∈ [0.03, 0.3] for images.
### Training Schedule
Gradually increase ε; curriculum learning.
### Random Initialization
Re-randomize perturbations each epoch.
---
## Benchmark Datasets & Evaluation
CIFAR-10 Adversarial: Standard; L∞ ε=8/255.
ImageNet Adversarial: Larger scale; ε=2/255 typical.
Metrics: Clean accuracy, robust accuracy under attack, certified radius.
---
## Key Challenges & Limitations
### Robustness-Accuracy Trade-off
Adversarial training degrades clean accuracy 2-10%.
### Computational Cost
3× training time limits large-scale deployment.
### Transferability
Adversarial examples transfer across models; but not perfectly.
---
## Hyperparameter Tuning
ε (perturbation bound): 0.03-0.3; domain-specific.
Attack iterations (PGD): 7-20 steps.
Step size α: 0.5-2.0 × ε.
---
## Real-World Applications & Case Studies
Autonomous Vehicles: Adversarial robustness critical for safety.
Face Recognition: Defense against spoofing attacks.
Malware Detection: Adversarial examples evade classifiers.
---
## Integration with Other Methods
Adversarial training + Certified defense → provable robustness.
Adversarial training + Ensemble → better generalization.
---
## Summary & Key Takeaways
Adversarial training robustifies models by training on worst-case perturbations, achieving resilience to adversarial attacks while maintaining accuracy.
Principles:
1. Adversarial examples: imperceptible perturbations fool models.
2. Adversarial training: minimize max loss over perturbation budget.
3. FGSM: fast single-step attack; PGD: iterative stronger attack.
4. Trade-off between clean and robust accuracy.
5. Certified defenses provide provable robustness guarantee.
---
---
## Appendix: Practical Labs
### Lab 1: FGSM Attack
import torch
import torch.nn as nn
import numpy as np
def fgsm_attack(model, x, y, epsilon=0.1):
"""Fast Gradient Sign Method attack"""
x.requires_grad = True
logits = model(x)
loss = nn.CrossEntropyLoss()(logits, y)
model.zero_grad()
loss.backward()
grad_sign = x.grad.sign()
x_adv = x + epsilon * grad_sign
x_adv = torch.clamp(x_adv, 0, 1)
return x_adv.detach()
# Test
model = nn.Sequential(nn.Linear(20, 32), nn.ReLU(), nn.Linear(32, 5))
x = torch.rand(8, 20)
y = torch.randint(0, 5, (8,))
x_adv = fgsm_attack(model, x, y, epsilon=0.1)
print(f"Perturbation magnitude: {(x_adv - x).abs().max():.4f}")
assert (x_adv - x).abs().max() <= 0.11, "Should respect epsilon bound"
assert (x_adv >= 0).all() and (x_adv <= 1).all(), "Should stay in [0,1]"
print("✓ FGSM attack working")
if __name__ == "__main__":
print("Lab 1: FGSM - PASSED")### Lab 2: Adversarial Training Step
import torch
import torch.nn as nn
import torch.optim as optim
def adversarial_training_step(model, x, y, optimizer, epsilon=0.1, n_steps=7):
"""One step of adversarial training (PGD)"""
model.train()
# Generate adversarial example (PGD)
x_adv = x.clone().detach().requires_grad_(True)
for _ in range(n_steps):
logits = model(x_adv)
loss = nn.CrossEntropyLoss()(logits, y)
loss.backward()
with torch.no_grad():
x_adv.data += 0.1 * x_adv.grad.sign()
x_adv.data = torch.clamp(x_adv.data, x - epsilon, x + epsilon)
x_adv.grad.zero_()
# Train on adversarial example
optimizer.zero_grad()
logits = model(x_adv.detach())
loss = nn.CrossEntropyLoss()(logits, y)
loss.backward()
optimizer.step()
return loss.item()
# Test
model = nn.Linear(10, 5)
optimizer = optim.Adam(model.parameters(), lr=0.01)
x = torch.randn(16, 10)
y = torch.randint(0, 5, (16,))
loss = adversarial_training_step(model, x, y, optimizer, epsilon=0.1)
print(f"Adversarial training loss: {loss:.4f}")
assert loss > 0, "Loss should be positive"
print("✓ Adversarial training step working")
if __name__ == "__main__":
print("Lab 2: Adversarial Training - PASSED")### Lab 3: Robustness Evaluation
import torch
import torch.nn as nn
import numpy as np
def evaluate_robustness(model, x_test, y_test, epsilon=0.1, n_attacks=10):
"""Evaluate clean and robust accuracy"""
model.eval()
with torch.no_grad():
logits_clean = model(x_test)
clean_acc = (logits_clean.argmax(dim=1) == y_test).float().mean()
robust_correct = 0
for _ in range(n_attacks):
x_adv = x_test + torch.randn_like(x_test) * epsilon * 0.5
x_adv = torch.clamp(x_adv, 0, 1)
logits = model(x_adv)
robust_correct += (logits.argmax(dim=1) == y_test).float().mean()
robust_acc = robust_correct / n_attacks
return clean_acc.item(), robust_acc.item()
# Test
model = nn.Sequential(nn.Linear(20, 32), nn.ReLU(), nn.Linear(32, 5))
x_test = torch.rand(50, 20)
y_test = torch.randint(0, 5, (50,))
clean, robust = evaluate_robustness(model, x_test, y_test, epsilon=0.1)
print(f"Clean accuracy: {clean:.2%}, Robust accuracy: {robust:.2%}")
assert 0 <= clean <= 1, "Accuracy should be in [0,1]"
assert 0 <= robust <= 1, "Accuracy should be in [0,1]"
print("✓ Robustness evaluation working")
if __name__ == "__main__":
print("Lab 3: Robustness - PASSED")### Lab 4: Perturbation Analysis
import torch
import numpy as np
def analyze_perturbation_effects(model, x, epsilons):
"""Measure accuracy drop at different perturbation budgets"""
model.eval()
with torch.no_grad():
logits_clean = model(x)
pred_clean = logits_clean.argmax(dim=1)
results = []
for eps in epsilons:
x_pert = x + torch.randn_like(x) * eps
logits = model(x_pert)
acc = (logits.argmax(dim=1) == pred_clean).float().mean()
results.append({'epsilon': eps, 'accuracy': acc.item()})
return results
# Test
model = nn.Sequential(nn.Linear(20, 32), nn.ReLU(), nn.Linear(32, 10))
x = torch.randn(30, 20)
epsilons = [0.0, 0.05, 0.1, 0.2]
results = analyze_perturbation_effects(model, x, epsilons)
print(f"Accuracy at ε=0.1: {results[2]['accuracy']:.2%}")
assert len(results) == 4, "Should have 4 results"
assert all(0 <= r['accuracy'] <= 1 for r in results), "Accuracies should be valid"
print("✓ Perturbation analysis working")
if __name__ == "__main__":
print("Lab 4: Perturbation Analysis - PASSED")