Adversarial Attacks & Robustness

Fooling deep neural networks using imperceptible input perturbations and building robust models using adversarial training.

🔴 advanced5 min readsecurity

Adversarial Attacks and Robustness explores security vulnerabilities in machine learning models. Adding tiny, human-imperceptible noise perturbations to input images or text can cause high confidence misclassifications in deep neural networks. Attack methods like Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) compute adversarial perturbations, while Adversarial Training enhances model robustness against security exploits.

What is an Adversarial Attack?

Deep neural networks do not perceive images the way humans do.

By calculating the gradient of the model loss with respect to input pixels, an attacker can compute a tiny Adversarial Noise Perturbation $\delta$:

Clean Image (Panda) + Tiny Imperceptible Noise (delta) ──► Adversarial Image (Looks like Panda to Humans!)
                                                                     │
                                                                     ▼
                                                   Model Predicts: GIBBON (99.3% Confidence!)

To the human eye, the image looks completely unchanged. To the neural network, the input features have been shifted across decision boundaries!

Attack Algorithms

┌──────────────────────────┬──────────────────────────┬──────────────────────────┐
│ 1. FGSM (Fast Gradient)  │ 2. PGD (Iterative)       │ 3. C&W ATTACK            │
├──────────────────────────┼──────────────────────────┼──────────────────────────┤
│ Single-step attack. Moves│ Multi-step iterative FGSM│ Optimization-based       │
│ input pixels in direction│ constrained within an    │ attack minimizing noise  │
│ of sign of loss gradient.│ epsilon norm ball.       │ while forcing error.     │
└──────────────────────────┴──────────────────────────┴──────────────────────────┘

1. Fast Gradient Sign Method (FGSM - Goodfellow et al., 2014)

Computes adversarial noise in a single step using the gradient of loss $\mathcal{L}$ with respect to input $x$:

$$x_{\text{adv}} = x + \epsilon \cdot \text{sign}\left( \nabla_x \mathcal{L}(\theta, x, y) \right)$$

2. Projected Gradient Descent (PGD - Madry et al., 2017)

Iteratively applies FGSM with small step sizes $\alpha$, projecting back into an $\epsilon$-bounded neighborhood after every step. Considered the strongest first-order adversarial attack.

Building Adversarial Robustness

How do we defend neural networks against adversarial exploits?

Adversarial Training: Train the model on adversarial examples dynamically generated during training iterations:

$$\min_{\theta} \sum_{i} \max_{|\delta| \le \epsilon} \mathcal{L}(\theta, x_i + \delta, y_i)$$

Randomized Smoothing: Add random Gaussian noise to inputs at inference time and take majority predictions across noisy samples.

Say this out loud

Adversarial attacks manipulate neural network predictions using imperceptible input noise perturbations. Fast Gradient Sign Method and Projected Gradient Descent compute noise using input loss gradients. Adversarial training generates adversarial samples dynamically during training to build model robustness against security exploits.

Followups to expect

What is White-Box vs Black-Box Adversarial Attack? White-Box attacks assume full access to model architecture and weights to compute gradients. Black-Box attacks query API outputs without weight access, leveraging attack transferability.
What is Universal Adversarial Perturbation? A single fixed noise pattern that, when added to any arbitrary image in a dataset, fools a neural network classifier into misclassifying most images.

Check yourself

Question 1 of 3

What is an Adversarial Example in computer vision neural network evaluation?

More in Responsible AI & Behavioural

See all →

Telling Your ML Project Story5 min Bias & Fairness in ML5 min Explainability: SHAP & LIME4 min