Editing Adversarial Ml (section)

== <span style="color: #FFFFFF;">Applying</span> ==
'''FGSM and PGD attacks with foolbox:'''
<syntaxhighlight lang="python">
import torch
import foolbox as fb
from torchvision.models import resnet50, ResNet50_Weights

model = resnet50(weights=ResNet50_Weights.IMAGENET1K_V2).eval()
fmodel = fb.PyTorchModel(model, bounds=(0, 1))

# Load a clean image
images, labels = fb.utils.samples(fmodel, dataset='imagenet', batchsize=4)

# FGSM attack (L∞ perturbation ε=8/255)
attack = fb.attacks.FGSM()
raw, clipped, success = attack(fmodel, images, labels, epsilons=8/255)
print(f"FGSM success rate: {success.float().mean():.1%}")

# PGD attack (stronger, iterative)
pgd = fb.attacks.LinfPGD()  # L∞ PGD, 40 steps
raw_pgd, clipped_pgd, success_pgd = pgd(fmodel, images, labels, epsilons=8/255)
print(f"PGD-40 success rate: {success_pgd.float().mean():.1%}")

# Adversarial training loop (simplified)
def adversarial_training_step(model, x, y, epsilon=8/255, alpha=2/255, n_steps=10):
    x_adv = x.clone().detach().requires_grad_(True)
    for _ in range(n_steps):
        loss = torch.nn.CrossEntropyLoss()(model(x_adv), y)
        grad = torch.autograd.grad(loss, x_adv)[0]
        x_adv = x_adv + alpha * grad.sign()
        x_adv = torch.clamp(x_adv, x - epsilon, x + epsilon).clamp(0, 1).detach()
        x_adv.requires_grad_(True)
    return x_adv.detach()
</syntaxhighlight>

; Adversarial attack taxonomy
: '''Image, white-box''' → FGSM (fast), PGD (strong), C&W (high-quality), AutoAttack (benchmark)
: '''Image, black-box''' → Square Attack (query-efficient), transfer attacks from surrogate
: '''NLP''' → TextFooler (word substitution), BERT-Attack, LLM jailbreaking
: '''Physical world''' → Adversarial patches (printable), adversarial glasses, adversarial T-shirts
: '''Training time''' → Backdoor attacks, data poisoning, model poisoning
</div>

<div style="background-color: #8B4500; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">