Adversarial Attack Detection

A reproducible defensive framework that detects adversarial CIFAR-10 images before they reach a CIFAR-adapted ResNet-18. It generates attacks with ART, extracts statistical and model-behaviour features, trains a leakage-safe stacked detector, evaluates C&W L2 as a strictly unseen attack, and serves an interactive Streamlit dashboard.

Setup

Python 3.10–3.12 is required. On this machine, use Python 3.12:

uv venv --python 3.12
uv sync --extra dev

Activate the environment with .venv\Scripts\Activate.ps1, or prefix commands with uv run.

Reproducible workflow

uv run aad train-target
uv run aad generate-attacks --split train
uv run aad generate-attacks --split validation
uv run aad generate-attacks --split test
uv run aad generate-attacks --split unseen
uv run aad train-detector
uv run aad evaluate
uv run aad repeat-final
uv run aad app

Use --limit N during attack generation for a smoke test. Full DeepFool and C&W runs are computationally expensive; the default settings are sized for a modest CUDA GPU and also fall back to CPU.

Reproducibility and leakage controls

• The global seed, resolved configuration, model weights, source-image indices, metadata, and metrics are persisted under artifacts/ and reports/.
• CIFAR source images are assigned to a split once. Every clean/adversarial variant inherits that split, and metadata validation rejects cross-split reuse.
• Successful and unsuccessful attack attempts are both retained.
• The convolutional autoencoder sees benign training images only.
• Meta-classifier inputs are out-of-fold RF/XGBoost probabilities grouped by source image, plus reconstruction error.
• The operating threshold is selected on validation data by maximum F1; the threshold corresponding to 5% benign false positives is saved alongside it.
• C&W L2 is absent from training and validation configuration and evaluated only from the unseen artifact.

Outputs

artifacts/inference_bundle.joblib is the single deployable bundle. It includes the target and autoencoder weights, exact feature schema, trained base detectors, meta-classifier, resolved configuration, and both thresholds.

reports/detection_metrics.json reports precision, recall, F1, ROC-AUC, PR-AUC, detection rate, false-positive rate, confusion matrices, and per-attack results for known attacks and the unseen C&W set.

repeat-final uses the three configured seeds, saves each run independently, and writes reports/three_run_summary.json with mean and standard deviation for all shared numeric metrics.

Tests

uv run pytest
uv run ruff check .

Tests cover normalization, source separation, perturbation bounds, feature dimensions, metadata and detector serialization, and uploaded-image handling.