adversarial training robustness

**Adversarial Training and Robustness** is the **defense methodology that trains networks on adversarial examples (perturbed inputs designed to fool models) — improving robustness against distribution shifts and intentional attacks while maintaining clean accuracy on unperturbed data**. **Adversarial Examples Phenomenon:** - Imperceptible perturbations: small human-imperceptible pixel changes flip model predictions; reveals adversarial vulnerability - Distribution shift: adversarial examples expose brittleness of networks trained on clean data; lack of learned robustness - Universal perturbations: some perturbations fool model across many images; suggests models learn non-robust spurious correlations - Transferability: adversarial examples transfer across models; suggests shared adversarial directions in high-dimensional space **Adversarial Attack Methods:** - FGSM (Fast Gradient Sign Method): single-step gradient-based attack; perturb input in direction of gradient sign by ε - PGD (Projected Gradient Descent): multi-step iterative attack; maximize loss by taking steps in gradient direction with projection - Attack strength: ε controls perturbation magnitude (typically 8/255 for 8-bit images); larger ε → harder problem - Threat model: ℓ∞ norm (pixel-wise), ℓ2 norm (Euclidean distance), ℓ0 (sparsity); different threat models require different robustness **Adversarial Training Objective:** - Min-max optimization: minimize loss over clean+adversarial examples; max over perturbations within ε-ball: min_θ E[max_{δ≤ε} L(θ, x+δ, y)] - PGD adversarial training: generate PGD adversarial examples; train on adversarial examples like standard training - Robust and standard accuracy tradeoff: increasing robustness often decreases clean accuracy; fundamental tradeoff observed - Computational cost: adversarial training requires generating attacks per batch; 2-10x slowdown vs standard training **Certified Robustness:** - Provable robustness: guarantee model correct on all inputs within ε-ball of given example; not just empirical attack resistance - Randomized smoothing: add Gaussian noise during inference; prediction aggregated over noisy samples - Certification via smoothing: Neyman-Pearson lemma provides certified radius from noisy predictions; provably robust - Certified robustness radius: certified for ℓ2 perturbations; quantifies worst-case robustness guarantee - Limitations: certified robustness typically weaker than empirical; large ε→ poor certified radius; computational overhead **Robustness Evaluation and Benchmarks:** - RobustBench: standardized benchmark for adversarial robustness; compares methods on ImageNet, CIFAR datasets - Strong attack evaluation: adaptive attacks exploit model defenses; white-box attacks more reliable than black-box - AutoAttack: ensemble of diverse attacks; reliable evaluation without manual attack tuning - Robustness metrics: adversarial accuracy at various ε levels; certified radius for provable robustness **Factors Affecting Robustness:** - Model capacity: larger models achieve better robust accuracy; capacity necessary for learning robust features - Training data: more data helps robustness; robust features require larger dataset than standard learning - Architectural choices: residual networks more robust; batch norm beneficial; architectural design affects robustness ceiling - Regularization: larger weight decay helps; prevents overconfidence on adversarial examples **Adversarial training defends against malicious inputs by training on generated adversarial examples — improving robustness at cost of clean accuracy tradeoff and substantial computational overhead.**