Adversarial Training and Robustness is the defense methodology that trains networks on adversarial examples (perturbed inputs designed to fool models) — improving robustness against distribution shifts and intentional attacks while maintaining clean accuracy on unperturbed data.

Adversarial Examples Phenomenon:

• Imperceptible perturbations: small human-imperceptible pixel changes flip model predictions; reveals adversarial vulnerability
• Distribution shift: adversarial examples expose brittleness of networks trained on clean data; lack of learned robustness
• Universal perturbations: some perturbations fool model across many images; suggests models learn non-robust spurious correlations
• Transferability: adversarial examples transfer across models; suggests shared adversarial directions in high-dimensional space

Adversarial Attack Methods:

• FGSM (Fast Gradient Sign Method): single-step gradient-based attack; perturb input in direction of gradient sign by ε
• PGD (Projected Gradient Descent): multi-step iterative attack; maximize loss by taking steps in gradient direction with projection
• Attack strength: ε controls perturbation magnitude (typically 8/255 for 8-bit images); larger ε → harder problem
• Threat model: ℓ∞ norm (pixel-wise), ℓ2 norm (Euclidean distance), ℓ0 (sparsity); different threat models require different robustness

Adversarial Training Objective:

• Min-max optimization: minimize loss over clean+adversarial examples; max over perturbations within ε-ball: min_θ E[max_{δ≤ε} L(θ, x+δ, y)]
• PGD adversarial training: generate PGD adversarial examples; train on adversarial examples like standard training
• Robust and standard accuracy tradeoff: increasing robustness often decreases clean accuracy; fundamental tradeoff observed
• Computational cost: adversarial training requires generating attacks per batch; 2-10x slowdown vs standard training

Certified Robustness:

• Provable robustness: guarantee model correct on all inputs within ε-ball of given example; not just empirical attack resistance
• Randomized smoothing: add Gaussian noise during inference; prediction aggregated over noisy samples
• Certification via smoothing: Neyman-Pearson lemma provides certified radius from noisy predictions; provably robust
• Certified robustness radius: certified for ℓ2 perturbations; quantifies worst-case robustness guarantee
• Limitations: certified robustness typically weaker than empirical; large ε→ poor certified radius; computational overhead

Robustness Evaluation and Benchmarks:

• RobustBench: standardized benchmark for adversarial robustness; compares methods on ImageNet, CIFAR datasets
• Strong attack evaluation: adaptive attacks exploit model defenses; white-box attacks more reliable than black-box
• AutoAttack: ensemble of diverse attacks; reliable evaluation without manual attack tuning
• Robustness metrics: adversarial accuracy at various ε levels; certified radius for provable robustness

Factors Affecting Robustness:

• Model capacity: larger models achieve better robust accuracy; capacity necessary for learning robust features
• Training data: more data helps robustness; robust features require larger dataset than standard learning
• Architectural choices: residual networks more robust; batch norm beneficial; architectural design affects robustness ceiling
• Regularization: larger weight decay helps; prevents overconfidence on adversarial examples

Adversarial training defends against malicious inputs by training on generated adversarial examples — improving robustness at cost of clean accuracy tradeoff and substantial computational overhead.