Foundation Lab

Adversarial Examples & Robustness

Reveals that neural networks are "right for the wrong reasons"—decision boundaries are brittle

Concept 44 of 100TheoryPhase 8

#44AdversarialTheory

key equationx_{\text{adv}} = x + \epsilon \cdot \text{sign}(\nabla_x L)

Selected Foundation Object

Keep the equation fixed; move through the evidence.

Concept 44 of 100AdversarialTheory / Phase 8: Scaling, theory & multimodal

Current question

Adversarial examples exist because of high dimensionality: many directions to push decision boundaries

x_{\text{adv}} = x + \epsilon \cdot \text{sign}(\nabla_x L)

PredictionCommit before the demo.

Ask what should change when the equation is manipulated, then let the visualization test that expectation.

EvidenceCompare local witness and source.

Use the runnable panel, the key equation, and canonical papers as separate forms of evidence for the same object.

InvariantName what survives notation changes.

The useful learning product is the reusable mechanism you can carry into another model, paper, or engineering tradeoff.

Next moveContinue through the atlas.

Use prerequisites, dependents, and semantic links to repair the next gap without leaving the object behind.

Reveals that neural networks are "right for the wrong reasons"—decision boundaries are brittle
Foundation for understanding model robustness, jailbreaks, and AI safety
Adversarial training remains the most reliable defense—robust models generalize better to distribution shift

What is still poorly explained in textbooks and papers:

Adversarial examples exist because of high dimensionality: many directions to push decision boundaries
Linear hypothesis: even linear models are vulnerable due to high-dimensional dot products
Robustness-accuracy tradeoff: adversarial training typically hurts clean accuracy by 2-10%

If you want intuition first, start with the key equation and the visualization. Come back here for the full walkthrough.

Key Equation

x_{\text{adv}} = x + \epsilon \cdot \text{sign}(\nabla_x L)

FGSM (Fast Gradient Sign Method) generates adversarial examples:

x_{\text{adv}} = x + \epsilon \cdot \text{sign}(\nabla_x L(\theta, x, y))

PGD (Projected Gradient Descent) iterates:

x^{(t+1)} = \Pi_{\mathcal{B}_\epsilon(x)} \left( x^{(t)} + \alpha \cdot \text{sign}(\nabla_x L) \right)

Adversarial training min-max objective:

\min_\theta \mathbb{E}_{(x,y)} \left[ \max_{\|\delta\| \leq \epsilon} L(\theta, x + \delta, y) \right]

Small perturbations $\delta$ cause large changes in model predictions.

Goodfellow, Shlens, Szegedy2015ICLR

Choose the next question to carry this object forward.