使用对抗性攻击破坏模型

AdversarialImage = OriginalImage + \epsilon \times sign(\nabla_x Loss)

1# --- Setup and Model Load ---
2device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
3model = models.resnet50(weights=models.ResNet50_Weights.IMAGENET1K_V1).to(device)
4model.eval()
5
6# --- Image Preparation (Assumes image path is valid) ---
7image_path = "../Giant_Panda_in_Beijing_Zoo_1.jpeg" 
8#... (Image loading and preprocessing code omitted for brevity)
9
10# Create the input tensor, enable gradient tracking for the attack
11input_tensor = preprocess(img).unsqueeze(0).to(device).requires_grad_(True)
12labels = get_imagenet_labels() # Load the class names
13
14# --- Initial Prediction (Before Attack) ---
15pred_initial = model(input_tensor)
16probabilities_initial = F.softmax(pred_initial, dim=1)
17top_prob_initial, top_catid_initial = torch.max(probabilities_initial, 1)
18
19original_confidence = top_prob_initial.item()
20target_id_for_attack = top_catid_initial.item()
21original_label = labels.get(target_id_for_attack, f"ID {target_id_for_attack} (Unknown)")
22
23print("\n--- Model Prediction: BEFORE ATTACK ---")
24print(f"Top Prediction: {original_label} (ID: {target_id_for_attack})")
25print(f"Confidence: {original_confidence*100:.2f}%")

1def fgsm_attack(image, epsilon, model, target_id):
2    """Performs FGSM attack, targets the original prediction to maximize loss."""
3    output = model(image)
4
5    # Calculate Loss against the correct label (the one we want to maximize error for)
6    target = torch.tensor([target_id]).to(image.device)
7    loss = nn.CrossEntropyLoss()(output, target)
8
9    # Backward Pass: Calculate the Gradient of the Loss w.r.t. the Input
10    model.zero_grad()
11    loss.backward()
12
13    # Collect the Gradient and take the sign() to get the Direction
14    data_grad = image.grad.data
15    sign_data_grad = data_grad.sign()
16
17    # Perturb the Image (Original + Epsilon * Direction)
18    perturbed_image = image + epsilon * sign_data_grad
19
20    # Clip to maintain valid image range 
21    perturbed_image = torch.clamp(perturbed_image, 0, 1)
22
23    return perturbed_image

1# --- Execute FGSM Attack ---
2epsilon = 0.05 
3adv_image = fgsm_attack(input_tensor, epsilon, model, target_id_for_attack)
4
5# --- Adversarial Prediction (After Attack) ---
6new_pred = model(adv_image)
7probabilities_adv = F.softmax(new_pred, dim=1)
8
9top_pred_conf_adv, top_pred_idx_adv = torch.max(probabilities_adv, 1)
10top_pred_idx_adv = top_pred_idx_adv.item()
11top_pred_conf_adv = top_pred_conf_adv.item()
12
13adv_label = labels.get(top_pred_idx_adv, f"ID {top_pred_idx_adv} (Unknown)")
14attack_success = '✅ SUCCESS' if top_pred_idx_adv!= target_id_for_attack else '❌ FAIL'
15
16print("\n--- Model Prediction: AFTER ATTACK ---")
17print(f"Attack Epsilon: {epsilon}")
18print(f"New Prediction: {adv_label} (ID: {top_pred_idx_adv})")
19print(f"Confidence: {top_pred_conf_adv*100:.2f}%")
20print(f"Result: {attack_success}")

1import torch
2import torch.nn as nn
3import torchvision.models as models
4import torchvision.transforms as transforms
5from PIL import Image
6import matplotlib.pyplot as plt
7import torch.nn.functional as F
8import numpy as np
9import requests
10
11# --- 0. Helper Functions and Data ---
12
13def get_imagenet_labels():
14    """
15    Downloads the full 1000 ImageNet class labels from the PyTorch Hub URL
16    and returns them as a dictionary mapping index (int) to label (str).
17    """
18    class_index_url = "https://raw.githubusercontent.com/pytorch/hub/master/imagenet_classes.txt"
19
20    try:
21        # Use requests to download the file contents
22        response = requests.get(class_index_url)
23        response.raise_for_status() # Check for HTTP errors (404, 403, etc.)
24
25        # Read the raw text content
26        text_content = response.text
27
28        # Split the content into lines
29        # Each line is the class name, starting from index 0
30        labels_list = text_content.strip().split('\n')
31
32        # Create a dictionary mapping index (0-999) to the label
33        labels_dict = {i: label for i, label in enumerate(labels_list)}
34
35        return labels_dict
36
37    except requests.exceptions.RequestException as e:
38        print(f"❌ Error fetching ImageNet labels from URL: {e}")
39        # Fallback to a dictionary with the known Panda label to allow execution to continue
40        return {388: 'giant panda, panda, panda bear, Ailuropoda melanoleuca',
41                0: 'tench',
42                999: 'toilet tissue'}
43    except Exception as e:
44        print(f"❌ An unexpected error occurred while processing labels: {e}")
45        return {}
46
47def denormalize(tensor):
48    """Reverses the ImageNet normalization for visualization."""
49    # Standard ImageNet mean and std
50    mean = torch.tensor([0.485, 0.456, 0.406]).view(1, 3, 1, 1).to(tensor.device)
51    std = torch.tensor([0.229, 0.224, 0.225]).view(1, 3, 1, 1).to(tensor.device)
52
53    # Reverse the normalization: (tensor * std) + mean
54    tensor = tensor * std + mean
55
56    # Clip the values to [0, 1] range and convert to CPU numpy array
57    return torch.clamp(tensor, 0, 1).squeeze().permute(1, 2, 0).cpu().numpy()
58
59def fgsm_attack(image, epsilon, model, target_id):
60    """Performs FGSM attack, targets the original prediction to maximize loss."""
61    output = model(image)
62
63    # Create a tensor with the single target class ID
64    target = torch.tensor([target_id]).to(image.device)
65    loss = nn.CrossEntropyLoss()(output, target)
66
67    model.zero_grad()
68    loss.backward()
69
70    data_grad = image.grad.data
71    sign_data_grad = data_grad.sign()
72
73    # Create the perturbed image
74    perturbed_image = image + epsilon * sign_data_grad
75
76    # Clip to maintain valid image range [0, 1]
77    perturbed_image = torch.clamp(perturbed_image, 0, 1)
78
79    return perturbed_image
80
81# --- 1. Setup and Model Load ---
82device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
83# Use the modern weights= parameter to avoid UserWarnings
84model = models.resnet50(weights=models.ResNet50_Weights.IMAGENET1K_V1).to(device)
85model.eval()
86
87# --- 2. Image Preparation ---
88image_path = "/udata/G4GvJEvBL2W/Giant_Panda_in_Beijing_Zoo_1.jpeg"
89try:
90    img = Image.open(image_path).convert("RGB")
91    print(f"✅ Successfully loaded the image: {image_path}")
92except:
93    print(f"❌ Error: Could not load the image. Check file path.")
94    exit()
95
96preprocess = transforms.Compose([
97    transforms.Resize(256),
98    transforms.CenterCrop(224),
99    transforms.ToTensor(),
100    transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225]),
101])
102
103# Create the input tensor, enable gradient tracking for the attack
104input_tensor = preprocess(img).unsqueeze(0).to(device).requires_grad_(True)
105labels = get_imagenet_labels() # Load the class names
106
107# --- 3. Initial Prediction (Before Attack) ---
108pred_initial = model(input_tensor)
109probabilities_initial = F.softmax(pred_initial, dim=1)
110top_prob_initial, top_catid_initial = torch.max(probabilities_initial, 1)
111
112original_confidence = top_prob_initial.item()
113target_id_for_attack = top_catid_initial.item() # Should be 388 (Panda)
114original_label = labels.get(target_id_for_attack, f"ID {target_id_for_attack} (Unknown)")
115
116print("\n--- Model Prediction: BEFORE ATTACK ---")
117print(f"Top Prediction: {original_label} (ID: {target_id_for_attack})")
118print(f"Confidence: {original_confidence*100:.2f}%")
119
120# --- 4. Execute FGSM Attack ---
121epsilon = 0.05 # The strength of the noise
122adv_image = fgsm_attack(input_tensor, epsilon, model, target_id_for_attack)
123
124# --- 5. Adversarial Prediction (After Attack) ---
125new_pred = model(adv_image)
126probabilities_adv = F.softmax(new_pred, dim=1)
127
128# Get the new top prediction and its confidence
129top_pred_conf_adv, top_pred_idx_adv = torch.max(probabilities_adv, 1)
130top_pred_idx_adv = top_pred_idx_adv.item()
131top_pred_conf_adv = top_pred_conf_adv.item()
132
133adv_label = labels.get(top_pred_idx_adv, f"ID {top_pred_idx_adv} (Unknown)")
134attack_success = '✅ SUCCESS' if top_pred_idx_adv != target_id_for_attack else '❌ FAIL'
135
136print("\n--- Model Prediction: AFTER ATTACK ---")
137print(f"Attack Epsilon: {epsilon}")
138print(f"New Prediction: {adv_label} (ID: {top_pred_idx_adv})")
139print(f"Confidence: {top_pred_conf_adv*100:.2f}%")
140print(f"Result: {attack_success}")
141
142# --- 6. Visualization ---
143original_denorm = denormalize(input_tensor.data)
144adv_denorm = denormalize(adv_image.data)
145
146# Calculate the perturbation (noise)
147perturbation = adv_denorm - original_denorm
148
149# Setup plot for 3 images
150fig, ax = plt.subplots(1, 3, figsize=(18, 6))
151
152# Plot 1: Original Image
153ax[0].imshow(original_denorm)
154ax[0].set_title(f"Original Image\nPred: {original_label}\nConf: {original_confidence*100:.1f}%", fontsize=10)
155ax[0].axis('off')
156
157# Plot 2: Perturbation (Noise)
158# We scale the perturbation to make the subtle noise visible
159im = ax[1].imshow(perturbation * 10, cmap='bwr', vmin=-1, vmax=1)
160ax[1].set_title(r"Perturbation (Noise $\eta$) x10" "\n(Imperceptible to Human Eye)", fontsize=10)
161ax[1].axis('off')
162
163# Plot 3: Adversarial Image
164ax[2].imshow(adv_denorm)
165ax[2].set_title(f"Adversarial Image\nPred: {adv_label}\nConf: {top_pred_conf_adv*100:.1f}%", fontsize=10, color='red')
166ax[2].axis('off')
167
168plt.tight_layout()
169filename = "panda.png"
170plt.savefig(filename, dpi=800, bbox_inches='tight')
171plt.show()

1def pgd_attack(model, image, label, epsilon=0.07, alpha=0.01, num_steps=40):
2    """
3    Projected Gradient Descent (PGD) Attack: Iteratively finds the worst-case noise.
4    """
5    # Detach to create a new tensor that we can modify
6    image = image.clone().detach() 
7    adversarial_image = image.clone().detach()
8
9    # PGD starts with random noise for a better search of max error (the "worst-case")
10    random_noise = torch.rand_like(image).uniform_(-epsilon, epsilon)
11    adversarial_image = torch.clamp(image + random_noise, 0, 1)
12
13    # --- The Iterative Loop starts here ---
14    for i in range(num_steps):
15        adversarial_image.requires_grad = True
16        
17        # A. Forward pass, Loss Calculation, and Backward Pass (omitted for brevity)
18        # B. Gradient Step (omitted for brevity)
19        # C. Projection (omitted for brevity)
20            
21    return adversarial_image

Gradient step and move

1#... inside the 'for i in range(num_steps):' loop...
2        
3        # A. Forward pass and Loss Calculation
4        output = model(adversarial_image)
5        target = torch.tensor([label]).to(image.device)
6        loss = nn.CrossEntropyLoss()(output, target)
7        
8        # B. Backward Pass (Calculate the Gradient)
9        model.zero_grad()
10        loss.backward()
11        
12        # C. Take a step (step size is alpha)
13        with torch.no_grad():
14            # Calculate the direction of max error and move the image in that direction
15            perturbation = alpha * adversarial_image.grad.sign()
16            adversarial_image += perturbation 
17            
18            #... Projection step follows...

1#... continuation of the 'with torch.no_grad():' block...
2            
3            # D. PROJECT (Clip the noise back into the epsilon ball)
4            # 1. Calculate the difference (delta) from the original clean image
5            delta = adversarial_image - image
6            # 2. Clip that difference so it stays within [-epsilon, epsilon]
7            delta = torch.clamp(delta, min=-epsilon, max=epsilon)
8            # 3. Add the clipped noise back to the original image
9            adversarial_image = torch.clamp(image + delta, min=0, max=1)

1# --- EXECUTE THE PGD TEST ---
2
3epsilon_pgd = 0.07  
4adv_image_pgd = pgd_attack(model, input_tensor, target_id_for_attack, epsilon=epsilon_pgd, alpha=0.01)
5
6# Adversarial Prediction (After PGD Attack)
7pred_pgd = model(adv_image_pgd)
8probabilities_pgd = F.softmax(pred_pgd, dim=1)
9
10# Get the new top prediction and its confidence
11top_pred_conf_pgd, top_pred_idx_pgd = torch.max(probabilities_pgd, 1)
12adv_label_pgd = labels.get(top_pred_idx_pgd.item(), f"ID {top_pred_idx_pgd.item()} (Unknown)")
13attack_success_pgd = '✅ SUCCESS' if top_pred_idx_pgd.item()!= target_id_for_attack else '❌ FAIL'
14
15print("\n--- Model Prediction: AFTER PGD ATTACK (Worst-Case Test) ---")
16print(f"Attack Epsilon: {epsilon_pgd}")
17print(f"New Prediction: {adv_label_pgd} (ID: {top_pred_idx_pgd.item()})")
18print(f"Confidence: {top_pred_conf_pgd.item()*100:.2f}%")
19print(f"Result: {attack_success_pgd} (PGD is the 'Gold Standard' for breaking robustness)")

1import torch
2import torch.nn as nn
3import torchvision.models as models
4import torchvision.transforms as transforms
5from PIL import Image
6import matplotlib.pyplot as plt
7import torch.nn.functional as F
8import numpy as np
9import requests # Required for downloading class names
10
11# --- 0. Helper Functions and Data ---
12
13def get_imagenet_labels():
14    """Downloads ImageNet class labels for human-readable output."""
15    class_index_url = "https://raw.githubusercontent.com/pytorch/hub/master/imagenet_classes.txt"
16    try:
17        response = requests.get(class_index_url)
18        response.raise_for_status() 
19        labels_list = response.text.strip().split('\n')
20        labels_dict = {i: label for i, label in enumerate(labels_list)}
21        print("✅ Successfully fetched all 1000 ImageNet labels.")
22        return labels_dict
23    except requests.exceptions.RequestException as e:
24        print(f"❌ Error fetching ImageNet labels from URL: {e}")
25        # Fallback for demonstration
26        return {388: 'giant panda, panda', 346: 'cougar, puma, catamount', 0: 'tench', 999: 'toilet tissue'}
27    except Exception as e:
28        print(f"❌ An unexpected error occurred while processing labels: {e}")
29        return {}
30
31def denormalize(tensor):
32    """Reverses the ImageNet normalization for visualization."""
33    # Standard ImageNet mean and std
34    mean = torch.tensor([0.485, 0.456, 0.406]).view(1, 3, 1, 1).to(tensor.device)
35    std = torch.tensor([0.229, 0.224, 0.225]).view(1, 3, 1, 1).to(tensor.device)
36    
37    # Reverse the normalization: (tensor * std) + mean
38    tensor = tensor * std + mean
39    
40    # Clip the values to [0, 1] range and convert to CPU numpy array
41    return torch.clamp(tensor, 0, 1).squeeze().permute(1, 2, 0).cpu().numpy()
42
43def pgd_attack(model, image, label, epsilon=0.07, alpha=0.01, num_steps=40):
44    """
45    Projected Gradient Descent (PGD) Attack: Iteratively finds the worst-case noise.
46    """
47    # Detach and clone to ensure clean tensor operations
48    image = image.clone().detach() 
49    adversarial_image = image.clone().detach()
50
51    # Start with random noise within the epsilon boundary for better robustness
52    random_noise = torch.rand_like(image).uniform_(-epsilon, epsilon)
53    # Clip the initial image + noise to the valid [0, 1] range
54    adversarial_image = torch.clamp(image + random_noise, 0, 1)
55
56    for i in range(num_steps):
57        adversarial_image.requires_grad = True
58        
59        # A. Forward pass and Loss Calculation
60        output = model(adversarial_image)
61        target = torch.tensor([label]).to(image.device)
62        # Loss calculated against the true label (untargeted attack: maximize loss)
63        loss = nn.CrossEntropyLoss()(output, target)
64        
65        # B. Backward Pass: Calculate the Gradient
66        model.zero_grad()
67        loss.backward()
68        
69        # C. Take a step (step size is alpha)
70        with torch.no_grad():
71            # Get the sign of the gradient (direction of maximum increase in loss)
72            perturbation = alpha * adversarial_image.grad.sign()
73            # Step in the direction of the gradient
74            adversarial_image += perturbation
75            
76            # D. PROJECTION/CLIPPING (Ensures noise stays within epsilon of original image)
77            # Calculate difference (delta) from the original clean image
78            delta = adversarial_image - image 
79            # Project delta back into the L-infinity ball (max change of epsilon)
80            delta = torch.clamp(delta, min=-epsilon, max=epsilon)
81            # Reconstruct the adversarial image and clip to valid pixel range [0, 1]
82            adversarial_image = torch.clamp(image + delta, min=0, max=1)
83            
84    return adversarial_image
85
86
87# --- 1. Setup and Model Load ---
88device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
89# Load ResNet-50 model weights pre-trained on ImageNet
90model = models.resnet50(weights=models.ResNet50_Weights.IMAGENET1K_V1).to(device)
91model.eval()
92
93# --- 2. Image Preparation (Panda Example) ---
94image_path = "/content/Giant_Panda_in_Beijing_Zoo_1.jpeg" 
95try:
96    img = Image.open(image_path).convert("RGB")
97    print(f"✅ Successfully loaded the image: {image_path}")
98except:
99    print(f"❌ Error: Could not load the image. Please verify the file path.")
100    exit() 
101
102# FIX: Corrected transforms.Compose list
103preprocess = transforms.Compose([
104    transforms.Resize(256),
105    transforms.CenterCrop(224),
106    transforms.ToTensor(),
107    transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225]),
108])
109
110# Create the input tensor and enable gradient tracking
111input_tensor = preprocess(img).unsqueeze(0).to(device).requires_grad_(True)
112labels = get_imagenet_labels() 
113
114# --- 3. Initial Prediction (To define the target for the attack) ---
115pred_initial = model(input_tensor)
116probabilities_initial = F.softmax(pred_initial, dim=1)
117top_prob_initial, top_catid_initial = torch.max(probabilities_initial, 1)
118
119original_confidence = top_prob_initial.item()
120target_id_for_attack = top_catid_initial.item() 
121original_label = labels.get(target_id_for_attack, f"ID {target_id_for_attack} (Unknown)")
122
123print("\n--- Model Prediction: INITIAL BASELINE ---")
124print(f"Top Prediction: {original_label} (ID: {target_id_for_attack})")
125print(f"Confidence: {original_confidence*100:.2f}%")
126
127# --- 4. EXECUTE THE PGD ATTACK ---
128epsilon_pgd = 0.07 
129adv_image_pgd = pgd_attack(model, input_tensor, target_id_for_attack, epsilon=epsilon_pgd, alpha=0.01)
130
131# --- 5. Adversarial Prediction (After PGD Attack) ---
132pred_pgd = model(adv_image_pgd)
133probabilities_pgd = F.softmax(pred_pgd, dim=1)
134
135top_pred_conf_pgd, top_pred_idx_pgd = torch.max(probabilities_pgd, 1)
136adv_label_pgd = labels.get(top_pred_idx_pgd.item(), f"ID {top_pred_idx_pgd.item()} (Unknown)")
137attack_success_pgd = '✅ SUCCESS' if top_pred_idx_pgd.item()!= target_id_for_attack else '❌ FAIL'
138
139print("\n--- Model Prediction: AFTER PGD ATTACK (Worst-Case Test) ---")
140print(f"Attack Epsilon: {epsilon_pgd}")
141print(f"New Prediction: {adv_label_pgd} (ID: {top_pred_idx_pgd.item()})")
142print(f"Confidence: {top_pred_conf_pgd.item()*100:.2f}%")
143print(f"Result: {attack_success_pgd}")
144
145# --- 6. Visualization and Saving ---
146original_denorm = denormalize(input_tensor.data)
147adv_denorm_pgd = denormalize(adv_image_pgd.data)
148
149perturbation_pgd = adv_denorm_pgd - original_denorm
150
151# FIX: Corrected indexing: ax is an array of 3 axes
152fig, ax = plt.subplots(1, 3, figsize=(18, 6))
153
154# Plot 1: Original Image
155ax[0].imshow(original_denorm)
156ax[0].set_title(f"Original Image\nPred: {original_label}\nConf: {original_confidence*100:.1f}%", fontsize=10)
157ax[0].axis('off')
158
159# Plot 2: Perturbation (Noise)
160# Use raw string for title to avoid SyntaxWarning with \n
161im = ax[1].imshow(perturbation_pgd * 10, cmap='bwr', vmin=-1, vmax=1)
162ax[1].set_title(r"PGD Perturbation (Noise $\eta$) x10" f"\nEpsilon={epsilon_pgd}", fontsize=10)
163ax[1].axis('off')
164
165# Plot 3: Adversarial Image
166ax[2].imshow(adv_denorm_pgd)
167ax[2].set_title(f"PGD Attacked Image\nNew Pred: {adv_label_pgd}\nConf: {top_pred_conf_pgd.item()*100:.1f}%", fontsize=10, color='red')
168ax[2].axis('off')
169
170plt.tight_layout()
171filename = "pgd_panda_attack.png"
172plt.savefig(filename, dpi=800, bbox_inches='tight')
173print(f"\nFigure saved successfully as: {filename}")
174plt.show()

AI Safety Case Excerpt (Part 1)

Module: Robustness and adversarial defense

This section documents the results of the Red Team evaluation conducted to test the system's resilience against worst-case, imperceptible input perturbations. Robustness is a core pillar of AI Safety, directly mitigating the risk of system Malfunctions (accidents) in deployment.

Claim: Lack of sufficient adversarial robustness

Argument: The model lacks the necessary robustness to operate safely in any real-world environment where inputs may be noisy, perturbed, or unintentionally misleading. The system is fundamentally brittle and susceptible to catastrophic misclassification by exploiting mathematical flaws, even when the input image is visually unchanged for a human observer.

Evidence: PGD worst-case failure data

The PGD iterative stress test (the "Gold Standard" for robustness) confirms a profound structural weakness in the model, demonstrating a confident failure mode that must be addressed before deployment.

The PGD algorithm successfully maximized the loss function within the allowed budget ($\epsilon=0.07$). The model not only failed to maintain its classification but also shifted its confidence to an absolute certainty ($100.00$) in an incorrect class (bison). This demonstrates that the model relies on fragile, easily manipulated mathematical patterns and is vulnerable to systemic failure, which is a clear deficiency in the model's safety profile.

Mitigation: Required defense strategy

The demonstrated failure cannot be resolved with simple input filters or output monitoring. The lack of robustness is an intrinsic flaw that must be addressed at the model level.

• Required mitigation: Implement a robust fine-tuning technique, specifically adversarial training.
• Action plan: The model must be retrained using the set of adversarial examples generated during this PGD Red Team exercise. The new training loop will force the model to correctly classify these worst-case inputs, effectively strengthening the model's internal weights and significantly expanding its safe operational range (improving robustness).

AI Safety Case Excerpt (Part 1)

Module: Robustness and adversarial defense

This section documents the results of the Red Team evaluation conducted to test the system’s resilience against worst-case, imperceptible input perturbations. Robustness is a core pillar of AI Safety, directly mitigating the risk of system Malfunctions (accidents) in deployment.

Claim: Lack of sufficient adversarial robustness

Argument: The model lacks the necessary robustness to operate safely in any real-world environment where inputs may be noisy, perturbed, or unintentionally misleading. The system is fundamentally brittle and susceptible to catastrophic misclassification by exploiting mathematical flaws, even when the input image is visually unchanged for a human observer.

Evidence: PGD worst-case failure data

The PGD iterative stress test (the “Gold Standard” for robustness) confirms a profound structural weakness in the model, demonstrating a confident failure mode that must be addressed before deployment.

The PGD algorithm successfully maximized the loss function within the allowed budget ($\epsilon=0.07$). The model not only failed to maintain its classification but also shifted its confidence to an absolute certainty ($100.00$) in an incorrect class (bison). This demonstrates that the model relies on fragile, easily manipulated mathematical patterns and is vulnerable to systemic failure, which is a clear deficiency in the model’s safety profile.

Mitigation: Required defense strategy

The demonstrated failure cannot be resolved with simple input filters or output monitoring. The lack of robustness is an intrinsic flaw that must be addressed at the model level.

• Required mitigation: Implement a robust fine-tuning technique, specifically adversarial training.
• Action plan: The model must be retrained using the set of adversarial examples generated during this PGD Red Team exercise. The new training loop will force the model to correctly classify these worst-case inputs, effectively strengthening the model’s internal weights and significantly expanding its safe operational range (improving robustness).