Adversarial Training Robustness Adversarial Examples
# Adversarial Training: Robustness & Adversarial Examples
## Introduction & Motivation
Adversarial Training: defend against adversarial attacks. Generate adversarial examples during training. FGSM, PGD attacks. Applications: robust models, security, certified robustness.
Motivation: Improve model robustness; prevent adversarial exploitation.
Applications: Security, robustness, safety-critical systems.
---
## Core Concepts & Theory
### Adversarial Examples
Imperceptible perturbations; cause misclassification.
### FGSM
Fast Gradient Sign Method; one-step attack.
### PGD
Projected Gradient Descent; iterative attack.
---
## Mathematical Formulation
Adversarial perturbation:
$$x_{ ext{adv}} = x + \delta$$
$$ ext{subject to } \|\delta\|_\infty \leq \epsilon$$
FGSM attack:
$$x_{ ext{adv}} = x + \epsilon \cdot ext{sign}(
abla_x L(x, y))$$
Adversarial training loss:
$$L = \mathbb{E}_{x,y}[\max_{\|\delta\| \leq \epsilon} L(f(x + \delta), y)]$$
---
## Advanced Theory & Extensions
### Certified Robustness
Provable bounds; randomized smoothing.
### Adversarial Regularization
Weight decay; gradient normalization.
### AutoAttack
Ensemble of attacks; evaluation.
---
## Computational Considerations
FGSM: O(1 gradient computation).
PGD: O(K gradient computations) where K=steps.
Training: 3-10x overhead for adversarial training.
---
## Practical Implementation Strategies
### Epsilon Tuning
Perturbation budget; trade-off.
### Attack Steps
K for iterative attacks; accuracy vs. robustness.
### Regularization
L2 penalty on perturbations.
---
## Benchmark Datasets & Evaluation
MNIST, CIFAR-10: Standard robustness benchmarks.
AutoAttack: Standardized evaluation.
RobustBench: Leaderboard.
---
## Key Challenges & Limitations
### Robustness-Accuracy Trade-off
Better robustness → lower clean accuracy.
**Computational Cost
Expensive training; 3-10x overhead.
### Transferability
Adversarial examples transfer across models.
---
## Hyperparameter Tuning
Epsilon: 0.01-0.3; perturbation budget.
Alpha (PGD): Step size; 0.01.
Attack steps: 7-20; computation-robustness.
---
## Real-World Applications & Case Studies
Image Classification: Adversarial defense.
Autonomous Driving: Robustness verification.
Face Recognition: Spoofing attacks.
---
## Integration with Other Methods
Adversarial + Ensemble → diversity robustness.
Adversarial + Regularization → stable training.
---
## Summary & Key Takeaways
Adversarial Training via robust perturbation defense enables model resilience through iterative attack generation and adversarial loss minimization.
Principles:
1. Adversarial examples: imperceptible changes.
2. Attacks: FGSM, PGD, AutoAttack.
3. Robustness-accuracy: trade-off.
4. Certified robustness: provable bounds.
5. Scalability: computational efficiency.
---
---
## Appendix: Practical Labs
### Lab 1: FGSM Attack
import numpy as np
def fgsm_attack(model_fn, X, y, epsilon=0.3):
"""Fast Gradient Sign Method attack"""
X_adv = X.copy()
for i in range(len(X)):
# Compute gradient
gradient = np.zeros_like(X[i])
eps = 1e-4
for j in range(X[i].size):
X_pert_pos = X[i].copy()
X_pert_pos.flat[j] += eps
X_pert_neg = X[i].copy()
X_pert_neg.flat[j] -= eps
loss_pos = model_fn(X_pert_pos.reshape(1, -1))[0, int(y[i])]
loss_neg = model_fn(X_pert_neg.reshape(1, -1))[0, int(y[i])]
gradient.flat[j] = (loss_pos - loss_neg) / (2 * eps)
# FGSM perturbation
X_adv[i] = X[i] + epsilon * np.sign(gradient)
return X_adv
# Test
np.random.seed(42)
X = np.random.randn(10, 28, 28)
y = np.random.randint(0, 10, 10)
def dummy_model(x):
return np.random.rand(len(x), 10)
X_adv = fgsm_attack(dummy_model, X, y, epsilon=0.1)
assert X_adv.shape == X.shape, "Adversarial shape"
print("✓ FGSM attack working")
if __name__ == "__main__":
print("Lab 1: FGSMAttack - PASSED")### Lab 2: PGD Attack
import numpy as np
def pgd_attack(model_fn, X, y, epsilon=0.3, alpha=0.01, steps=7):
"""Projected Gradient Descent attack"""
X_adv = X.copy()
for i in range(len(X)):
for step in range(steps):
# Compute gradient (simplified)
gradient = np.random.randn(*X[i].shape) * 0.1 # Dummy gradient
# PGD step
X_adv[i] = X_adv[i] + alpha * np.sign(gradient)
# Projection onto epsilon-ball
perturbation = X_adv[i] - X[i]
perturbation = np.clip(perturbation, -epsilon, epsilon)
X_adv[i] = X[i] + perturbation
return X_adv
# Test
np.random.seed(42)
X = np.random.randn(10, 28, 28)
y = np.random.randint(0, 10, 10)
def dummy_model(x):
return np.random.rand(len(x), 10)
X_adv = pgd_attack(dummy_model, X, y)
assert X_adv.shape == X.shape, "Adversarial shape"
print("✓ PGD attack working")
if __name__ == "__main__":
print("Lab 2: PGDAttack - PASSED")### Lab 3: Adversarial Training Loss
import numpy as np
def adversarial_training_loss(logits, targets, alpha=0.5):
"""Combine clean and adversarial loss"""
# Clean loss
exp_logits = np.exp(logits - np.max(logits, axis=1, keepdims=True))
probs = exp_logits / exp_logits.sum(axis=1, keepdims=True)
clean_loss = -np.log(probs[np.arange(len(logits)), targets] + 1e-8).mean()
# Adversarial loss (simulated)
adv_logits = logits + np.random.randn(*logits.shape) * 0.1
exp_adv = np.exp(adv_logits - np.max(adv_logits, axis=1, keepdims=True))
probs_adv = exp_adv / exp_adv.sum(axis=1, keepdims=True)
adv_loss = -np.log(probs_adv[np.arange(len(adv_logits)), targets] + 1e-8).mean()
# Combined loss
total_loss = alpha * clean_loss + (1 - alpha) * adv_loss
return total_loss
# Test
np.random.seed(42)
logits = np.random.randn(32, 10)
targets = np.random.randint(0, 10, 32)
loss = adversarial_training_loss(logits, targets)
assert np.isfinite(loss), "Loss finite"
assert loss > 0, "Loss positive"
print("✓ Adversarial loss working")
if __name__ == "__main__":
print("Lab 3: AdversarialLoss - PASSED")### Lab 4: Robustness Certification
import numpy as np
def certified_accuracy(predictions, perturbation_epsilon, confidence_threshold=0.5):
"""Compute certified accuracy under perturbation"""
# Certified if top two classes separated by > 2*epsilon
num_classes = predictions.shape[1]
certified_count = 0
for pred in predictions:
sorted_indices = np.argsort(pred)[::-1]
top_prob = pred[sorted_indices[0]]
second_prob = pred[sorted_indices[1]]
margin = top_prob - second_prob
# Certified if margin > 2*epsilon
if margin > 2 * perturbation_epsilon:
certified_count += 1
certified_acc = certified_count / len(predictions)
return certified_acc
# Test
np.random.seed(42)
predictions = np.random.rand(100, 10)
predictions = predictions / predictions.sum(axis=1, keepdims=True)
cert_acc = certified_accuracy(predictions, epsilon=0.1)
assert 0 <= cert_acc <= 1, "Certified accuracy in [0,1]"
print("✓ Certified accuracy working")
if __name__ == "__main__":
print("Lab 4: CertifiedAccuracy - PASSED")