Adversarial Training Robustness

Adversarial Training and Robustness is the defense methodology that trains networks on adversarial examples (perturbed inputs designed to fool models) — improving robustness against distribution shifts and intentional attacks while maintaining clean accuracy on unperturbed data.

Adversarial Examples Phenomenon:
- Imperceptible perturbations: small human-imperceptible pixel changes flip model predictions; reveals adversarial vulnerability
- Distribution shift: adversarial examples expose brittleness of networks trained on clean data; lack of learned robustness
- Universal perturbations: some perturbations fool model across many images; suggests models learn non-robust spurious correlations
- Transferability: adversarial examples transfer across models; suggests shared adversarial directions in high-dimensional space

Adversarial Attack Methods:
- FGSM (Fast Gradient Sign Method): single-step gradient-based attack; perturb input in direction of gradient sign by ε
- PGD (Projected Gradient Descent): multi-step iterative attack; maximize loss by taking steps in gradient direction with projection
- Attack strength: ε controls perturbation magnitude (typically 8/255 for 8-bit images); larger ε → harder problem
- Threat model: ℓ∞ norm (pixel-wise), ℓ2 norm (Euclidean distance), ℓ0 (sparsity); different threat models require different robustness

Adversarial Training Objective:
- Min-max optimization: minimize loss over clean+adversarial examples; max over perturbations within ε-ball: min_θ E[max_{δ≤ε} L(θ, x+δ, y)]
- PGD adversarial training: generate PGD adversarial examples; train on adversarial examples like standard training
- Robust and standard accuracy tradeoff: increasing robustness often decreases clean accuracy; fundamental tradeoff observed
- Computational cost: adversarial training requires generating attacks per batch; 2-10x slowdown vs standard training

Certified Robustness:
- Provable robustness: guarantee model correct on all inputs within ε-ball of given example; not just empirical attack resistance
- Randomized smoothing: add Gaussian noise during inference; prediction aggregated over noisy samples
- Certification via smoothing: Neyman-Pearson lemma provides certified radius from noisy predictions; provably robust
- Certified robustness radius: certified for ℓ2 perturbations; quantifies worst-case robustness guarantee
- Limitations: certified robustness typically weaker than empirical; large ε→ poor certified radius; computational overhead

Robustness Evaluation and Benchmarks:
- RobustBench: standardized benchmark for adversarial robustness; compares methods on ImageNet, CIFAR datasets
- Strong attack evaluation: adaptive attacks exploit model defenses; white-box attacks more reliable than black-box
- AutoAttack: ensemble of diverse attacks; reliable evaluation without manual attack tuning
- Robustness metrics: adversarial accuracy at various ε levels; certified radius for provable robustness

Factors Affecting Robustness:
- Model capacity: larger models achieve better robust accuracy; capacity necessary for learning robust features
- Training data: more data helps robustness; robust features require larger dataset than standard learning
- Architectural choices: residual networks more robust; batch norm beneficial; architectural design affects robustness ceiling
- Regularization: larger weight decay helps; prevents overconfidence on adversarial examples

Adversarial training defends against malicious inputs by training on generated adversarial examples — improving robustness at cost of clean accuracy tradeoff and substantial computational overhead.