Fundamentals · Module 2: Robustness
Module 2: Robustness & Adversarial Attacks
Train your own traffic-sign classifier, measure how well it generalises, then try to fool it. Every step talks to the shared backend; with an access code the training and the one-pixel search run on an H100 instead of the standard lane.
📖 What are adversarial examples?
An adversarial example is an input that has been subtly modified — often imperceptibly to humans — to cause an AI model to make a confident but incorrect prediction. First shown by Szegedy et al. (2013), these vulnerabilities are not limited to toy models: they affect state-of-the-art systems across vision, audio, and text.
In safety-critical settings — autonomous vehicles, medical imaging, access control — adversarial examples are a genuine threat. A stop sign with a small sticker (Eykholt et al., 2018) caused a classifier to predict "speed limit 45". This module lets you experience the vulnerability directly by attacking your own trained model.
1 Dataset Preparation
The German Traffic Sign Recognition Benchmark (GTSRB) contains 39,000+ training images and 12,000+ test images across 43 traffic sign classes. Images are resized to your chosen resolution at training time (default 32×32 px — see Model Training below).
Loading the dataset summary…
Data Augmentation (optional)
Augmentations apply to the training set only; the test set is never augmented.
Visualizing Samples
Three test-set images per class, resized to 32×32 and shown at 2× zoom.
2 Model Management
Every model you train in this session is kept on the backend under a name, so you can switch between models — including models trained at different image sizes. A pre-trained baseline-32 model is always available, so you can skip straight to evaluation and attacks.
Used by evaluation and the attacks below.
| Name | Image size | Epochs | Val. accuracy | Source | Created |
|---|
Training History of Active Model
3 Model Training
Train a new traffic sign classifier. The convolutional network is small on purpose so it trains in minutes; the settings below are the same ones a practitioner would tune.
Standard lane: training uses a subset of 8,000 images, 32×32 px, at most 3 epochs, batch size up to 128. Enter an access code in the header to train on the full dataset, with larger images and up to 30 epochs, on an H100.
Percentage of the 'train' split used for training; the remainder is used for validation during training.
Controls random initialization and the train/val split for reproducibility.
Images are resized to this square resolution before training. Changes the model's architecture. 48 and 64 need the H100 lane.
💡 Recommended Settings (for a robust model)
It's useful to experiment and learn what makes a robust classifier, but if you want to skip to trying to break a generally robust classifier you can use these settings:
Data Settings:
- Image Size: 32x32
- Apply Random Rotation: Yes (10 degrees)
- Apply Random Translation (Affine): Yes (0.1 fraction)
- Apply Color Jitter: Yes (Brightness: 0.2, Contrast: 0.2, Saturation: 0.2, Hue: 0.1)
Training Settings:
- Epochs: 10
- Training Set Percentage: 90%
- Dropout Rate: 0.5
- Learning Rate: 0.0001
- Optimizer: Adam
- Batch Size: 64
- Early Stop Patience (epochs): 5
- Weight Decay (L2 Penalty): 0.0001
- LR Scheduler: ReduceLROnPlateau (Factor: 0.1, Patience: 3)
On the standard lane the epoch count is capped at 3; the other settings apply as listed.
4 Model Evaluation
The model is evaluated on the separate GTSRB 'test' set. If a loaded model used different image dimensions, the test set will be transformed accordingly for that evaluation.
Class-wise Accuracy
| Class | Name | Accuracy |
|---|
Confusion Matrix
Rows are true classes, columns are predicted classes. Darker cells mean more predictions in that cell — hover or focus a cell for details.
5 Adversarial Examples
Select a traffic sign class, get a sample test image, then try the attack methods below to fool the model. Images are 32×32 px (displayed at 4× zoom).
Samples are drawn from test images the active model classifies correctly, so every attack starts from a correct prediction.
Model's Prediction:
Top 3 Predictions (Original):
Adds a coloured patch at a specified location. Simulates physical-world stickers or graffiti.
6 Key Takeaways & Implications
Core Lessons on AI Robustness
- ⚡ Vulnerability: Deep learning models can be fooled by tiny, often imperceptible, input changes.
- 🧬 Inherent Nature: Adversarial vulnerability seems to be an inherent property of high-dimensional models.
- 📊 Beyond Accuracy: Standard accuracy metrics are insufficient; robustness testing is vital.
- 🛡️ Defense Challenges: Developing effective and generalizable defenses is an ongoing research area.
- 🔄 Robustness Transferrability: Robustness to one type of error does not guarantee robustness to others.
← Module 1 · Bias–Variance Next: Module 3 · Red Teaming LLMs →