$ cd ../
Adversarial robustness: FGSM, PGD and adversarial training — bash

user@devops:~$ cat README.md

Adversarial robustness: FGSM, PGD and adversarial training

# Description

Adversarial robustness from scratch in PyTorch, no Foolbox/ART. SmallCNN 8→16 channels (26,698 params) on Fashion-MNIST (4,000/1,000/1,500, seed 42, CPU ~40 s). Part 1: train the clean CNN — test acc 78.13%. Part 2: untargeted FGSM x + ε·sign(∇x L). Part 3: PGD-7 with random start inside the L∞ ball (α = ε/4). Part 4: uniform U(−ε, ε) noise control with the same budget. Part 5: FGSM adversarial training at ε=0.15 (clean + attack per batch, 8 epochs). Results at ε=0.15 (n=500): FGSM 13.40%, PGD 9.20%, noise 77.20% (almost the attack-set clean 78.80%). PGD hardens with more steps (1→53.60%, 7→9.00%, 10→8.00%). Adv-train: clean 68.87% (−9.27 pp) and PGD 37.00% (+27.80 pp). Findings: the attack is not noise; PGD is a stronger iterated FGSM; FGSM training is not PGD-proof (37.0% vs 41.8% FGSM); at ε=0.30 both collapse. 7 visualizations.

$ ./deploy.sh $ git clone

# Key features

$ SmallCNN 8→16 ch + FC 32: 26,698 params, Fashion-MNIST 4k/1k/1.5k, seed 42, CPU ~40 s

$ Untargeted FGSM (Goodfellow 2015) and PGD-7 (Madry 2018) in the L∞ ball, clip [0,1]

$ Uniform L∞ noise control: at ε=0.15 noise 77.20% vs FGSM 13.40% vs PGD 9.20%

$ Clean CNN test 78.13%; at ε=0.15 PGD drops to 9.20% (−68.93 pp vs noise)

$ PGD vs steps: 1→53.60%, 3→27.60%, 5→12.40%, 7→9.00%, 10→8.00% (ε=0.15)

$ FGSM adv-training ε=0.15: clean 68.87% (−9.27 pp) and PGD 37.00% (+27.80 pp)

$ FGSM-training is not PGD-proof: on the robust model, PGD 37.0% vs FGSM 41.8%

$ 7 visualizations: examples, ε-curve, PGD steps, confusion, adv-train, perturbation, summary

# Gallery

Project terminal
Adversarial robustness: FGSM, PGD and adversarial training - Project terminal
Original vs FGSM vs PGD vs noise
Adversarial robustness: FGSM, PGD and adversarial training - Original vs FGSM vs PGD vs noise
Accuracy vs ε: FGSM / PGD / noise
Adversarial robustness: FGSM, PGD and adversarial training - Accuracy vs ε: FGSM / PGD / noise
PGD hardens with more steps
Adversarial robustness: FGSM, PGD and adversarial training - PGD hardens with more steps
Clean vs PGD ε=0.15 confusion
Adversarial robustness: FGSM, PGD and adversarial training - Clean vs PGD ε=0.15 confusion
Clean CNN vs adv-train under PGD
Adversarial robustness: FGSM, PGD and adversarial training - Clean CNN vs adv-train under PGD
PGD perturbation map (x_pgd − x)
Adversarial robustness: FGSM, PGD and adversarial training - PGD perturbation map (x_pgd − x)
Adversarial robustness summary
Adversarial robustness: FGSM, PGD and adversarial training - Adversarial robustness summary

# Technologies used

Python PyTorch NumPy Pandas scikit-learn Matplotlib