Lecture 3 — Adversarial Robustness

(a)  Where the errors sit on the cubeMass of the uniform cube by Hamming distance from the center of the worst-case error set: a bump of width ½√n around n/2. By Harper's inequality the error set that expands least is a ball (carmine); r is that ball's radius. It sits just left of n/2 because almost every string lies at distance ≈ n/2 ± √n from the ball's center: a ball holding only an α fraction of the cube must stop cα√n short of the peak — so its radius is already almost n/2. Allowing d extra flips grows it layer by layer; because all the mass is concentrated in an O(√n) band, a few √n layers swallow nearly everything. Blue: inputs with no error within d flips.

dimension n 1000
error rate α 1.0%
flips d 47
–

(b)  Fraction of inputs with a nearby errorThe coverage curve: the fraction of all inputs lying within d bit flips of the worst-case error set, plotted against d in units of √n. It rises from α to essentially 1 over a constant number of √n steps — the “nearby errors” theorem. (Shown is the exact Harper lower bound, discarding at most one partial layer.)

… coverage – d = –

(a)  The input plane and the threat model Δ(x)A two-hidden-layer network trained in your browser on a 2-D two-moons task; tinted regions are its decision regions. The gold shape around the chosen input is the threat model: an ℓ∞ ball is a square, an ℓ2 ball is a disk, of radius ε. The attack follows the gradient of the loss in input space, projected back into Δ(x) after every step (PGD). The dashed blue circle, when shown, is the randomized-smoothing certificate: no perturbation inside it can change the smoothed prediction.

norm
radius ε 0.28

(b)  Score along the attack, and the defensesThe classifier's score f(xt) at each PGD step; crossing zero flips the prediction. The faint curve is the same attack against the other network. Adversarial training bakes the attack into training (min over θ of the max over δ ∈ Δ of the loss) and sharply lowers the attack's success rate over the test set — the lecture quotes roughly 90% against standard vision models versus 25% after adversarial training. The certificate is the strongest statement: inside the certified radius, no attack exists at all.

weights
accuracy – attack success – certified ℓ2 radius –

(a)  A pair of inputs, and their featuresEach strip shows the 48 coordinates of one input (blue positive, carmine negative); below, the 36 coordinates of its features Ax after the Gaussian projection. For a random pair the feature strips differ visibly, and over 190 random pairs every distance is preserved to the stated tolerance — Johnson–Lindenstrauss for points chosen independently of A. The adaptive attacker sees A first, picks v ∈ ker A, and shows the pair (x, x+tv): the inputs are far apart, yet the feature strips are pixel-identical — the classifier g(Ax) cannot tell them apart. The third mode shows the best integer vector found by the search in (b) under the rounded map: the inputs live on {−1,0,1}48 and their rounded features still differ in several cells — no collision.

show
190 random pairs preserved to –

(b)  The fix: bounded integers + roundingRestrict inputs to the hypergrid, here {−1, 0, 1}48, and round: HA(x) = ⌊Ax⌋ε. A colliding pair now needs a nonzero bounded integer vector v with ‖Av‖ < κ√m‖v‖ — the CHV problem. The histogram is the attacker’s log: the ratio ρ(v) for every candidate tried so far, and each press of the search button adds 900 random plus 10 greedily-improved integer vectors. A successful attack would put a bar left of κ — a v so contracted that two far-apart hypergrid inputs get equal rounded features. Everything found stays well to the right: the search keeps failing. Theorem 3: an efficient algorithm that finds such a v (at cryptographic parameters) solves CLWE. Reference: Bogdanov, Rosen, Vafa & Vaikuntanathan, STOC 2026.

candidates – smallest ρ found –