Adversarial ML Best Practices Advanced

This final lesson consolidates the course into actionable best practices for evaluating adversarial robustness, benchmarking defenses correctly, conducting responsible adversarial ML research, and deploying robust models in production environments.

Robustness Evaluation Protocol

Follow this protocol to rigorously evaluate a model's adversarial robustness:

1. Define the threat model

   Specify the perturbation norm (L-inf, L2, L0), epsilon budget, and attacker knowledge (white-box, black-box).

2. Use multiple attacks

   Never evaluate against just one attack. Use at minimum: FGSM, PGD-50, C&W, and AutoAttack.

3. Test against adaptive attacks

   If you are evaluating a defense, the attacker must be aware of the defense and adapt their strategy accordingly.

4. Use standardized benchmarks

   Compare against RobustBench leaderboards for CIFAR-10, CIFAR-100, and ImageNet.

5. Report both clean and robust accuracy

   Always report accuracy on clean data alongside adversarial accuracy to quantify the trade-off.

Common Evaluation Mistakes

AutoAttack: The Standard Evaluation

from autoattack import AutoAttack

# AutoAttack combines four complementary attacks:
# 1. APGD-CE (Auto-PGD with cross-entropy loss)
# 2. APGD-DLR (Auto-PGD with difference of logits ratio)
# 3. FAB (Fast Adaptive Boundary attack)
# 4. Square Attack (black-box, score-based)

adversary = AutoAttack(model, norm='Linf', eps=8/255)
x_adv = adversary.run_standard_evaluation(x_test, y_test)

# This gives the most reliable robustness estimate
# If your model achieves high accuracy against AutoAttack,
# it is likely genuinely robust

Production Deployment Checklist

BEFORE DEPLOYMENT:
  [ ] Adversarial robustness evaluated with AutoAttack
  [ ] Clean accuracy vs robust accuracy trade-off documented
  [ ] Threat model defined (what perturbation budget to defend against)
  [ ] Input validation and preprocessing pipeline in place
  [ ] Confidence thresholds set with fallback mechanism
  [ ] Monitoring for adversarial inputs configured

DEFENSE LAYERS:
  [ ] Adversarial training applied (if accuracy trade-off acceptable)
  [ ] Input preprocessing (JPEG compression, feature squeezing)
  [ ] Rate limiting to prevent model extraction
  [ ] Output sanitization (reduce confidence precision)
  [ ] Ensemble or multi-model verification for critical predictions

CONTINUOUS MONITORING:
  [ ] Input distribution drift detection
  [ ] Prediction confidence distribution monitoring
  [ ] Adversarial regression test suite maintained
  [ ] Model retrained periodically with latest adversarial techniques

Responsible Research and Disclosure

• Responsible disclosure - Report vulnerabilities in production AI systems to the vendor before publishing
• Dual-use awareness - Consider whether attack research could be misused; include defenses in publications
• Reproducibility - Share code, models, and evaluation protocols for others to verify and build upon
• Honest evaluation - Do not cherry-pick results; report both successes and failures of defenses