Adversarial Robustness: Attacks and Defenses

Module: Machine Learning | Difficulty: Advanced

FGSM Attack

PGD Attack

TRADES

Certified Defense (Randomized Smoothing)

import torch

def fgsm_attack(model, x, y, epsilon=0.03):
    x.requires_grad = True
    loss = torch.nn.functional.cross_entropy(model(x), y)
    loss.backward()
    x_adv = x + epsilon * x.grad.sign()
    return torch.clamp(x_adv, 0, 1).detach()

def pgd_attack(model, x, y, epsilon=0.03, alpha=0.007, steps=10):
    x_adv = x.clone().detach()
    for _ in range(steps):
        x_adv.requires_grad = True
        loss = torch.nn.functional.cross_entropy(model(x_adv), y)
        loss.backward()
        x_adv = x_adv + alpha * x_adv.grad.sign()
        delta = torch.clamp(x_adv - x, -epsilon, epsilon)
        x_adv = torch.clamp(x + delta, 0, 1).detach()
    return x_adv

| Attack | Perturbation | Queries | Success Rate | |--------|-------------|---------|--------------| | FGSM | 8/255 | 1 | 70% | | PGD-10 | 8/255 | 10 | 95% | | AutoAttack | 8/255 | 100 | 99% | | C&W | 8/255 | 1000 | 99.5% |

Research Insight: Adversarial training improves robustness to PGD attacks by 40-60%, but reduces clean accuracy by 2-5%. The fundamental trade-off between accuracy and robustness is a theoretical limit, not just a practical limitation.