Robustness and Security in Vision
Vision models meet attackers and accidents alike. This map separates crafted attacks from natural corruptions and points each to its defense.
Why Does This Exist?
Two failures share the word robustness and nothing else. An attacker crafts invisible pixel changes to flip a stop sign into a speed limit, which is malice with a budget and a threat model. Rain blur and sensor noise cut accuracy from 0.89 to 0.58 with nobody attacking, which is accident with a distribution. Defenses for one do little for the other, and mixing them up wastes both budgets.
This page routes the security wave. Crafted evasion lives in adversarial attacks with its instances FGSM, PGD, C and W, patch attacks, and physical-world attacks. Protection lives in adversarial defenses, guarantees in certified robustness and randomized smoothing. Supply-chain malice is backdoor and poisoning, model theft is covered with the core-ml parent, and accidents are natural corruption robustness. Forensics for generated images is deepfake detection, image forensics, and watermarking.
Think of It Like This
Break-ins versus burst pipes
A building faces burglars who study its locks and storms that flood its basement, and one insurance policy covers neither both nor well. Locks, alarms, and guards answer burglars; drainage, elevation, and pumps answer water. Adversarial defenses are locks, corruption coverage is drainage. The analogy stops at adaptation: burglars learn from your locks, while rain never studies your pumps.
How It Actually Works
Residual only: the split and the price list. Evasion attacks assume an attacker with query or gradient access and a perturbation budget, and defenses trade clean accuracy for resistance plus heavy training cost. Backdoors assume poisoned training data and need supply-chain controls, not test-time tricks. Theft assumes API access and needs response limits plus monitoring. Corruptions assume no adversary and need diverse training plus evaluation on corruption suites. Each child states its threat model, its condition, and its defense trade before any claim.
The numbers that separate them
A perturbation budget of 0.03 flips a demo classifier on 87 of 100 images with no visible change, while the same model loses 0.31 to heavy blur with everybody watching. Adversarial training recovers the first at a cost of 0.04 clean accuracy and tripled training time here; corruption augmentation recovers the second at a cost of extra data variety with no training-time blowup. Different failures, different receipts.
Watch Out For
Claiming one defense covers both families
An adversarially trained model still drops on unseen corruptions, and a corruption-hardened model still falls to small crafted perturbations. The symptom is a robustness badge that fails the other suite the week after the audit. Evaluate and report both suites separately, and never let one certificate imply the other.
The Quick Version
- Attacks assume an adversary with access and a budget; corruptions assume none.
- Children teach each path with its threat model and trade stated.
- Adversarial training costs clean accuracy and compute; corruption coverage costs data variety.
- Backdoors need supply-chain controls, theft needs API limits.
- Report evasion and corruption suites separately, always.