adv-robust-pgd

total 101
drwxr-xr-x  4 user user  4096 Jun 30 22:30 .
drwxr-xr-x 21 root root  4096 Jun 30 22:30 ..
-rw-r--r--  1 user user 14238 Jun 30 22:30 PROMPT.txt
-rw-r--r--  1 user user     5 Jun 30 22:30 agent.pid
-rw-r--r--  1 user user     0 Jun 30 22:30 agent.stderr
-rw-r--r--  1 user user  4530 Jun 30 22:30 agent_trajectory.jsonl
drwxr-xr-x  2 user user    60 Jun 30 22:30 data
-rw-r--r--  1 user user     0 Jun 30 22:30 run.log
-rwxr-xr-x  1 user user 57740 Jun 30 11:01 run_checks.py
drwxr-xr-x  2 user user   128 Jun 30 22:30 submission
-rwxr-xr-x  1 user user   998 Jun 30 11:01 test.sh
-rwxr-xr-x  1 user user   629 Jun 30 11:01 timer.sh
---SUBMISSION---
total 80
drwxr-xr-x 2 user user   128 Jun 30 22:30 .
drwxr-xr-x 4 user user  4096 Jun 30 22:30 ..
-rw-r--r-- 1 user user  5490 Jun 30 11:01 advtrain.py
-rw-r--r-- 1 user user  8776 Jun 30 11:01 attack.py
-rw-r--r-- 1 user user 18341 Jun 30 11:01 autograd.py
-rw-r--r-- 1 user user  2167 Jun 30 11:01 data.py
-rw-r--r-- 1 user user 15988 Jun 30 11:01 nn.py
-rw-r--r-- 1 user user  8853 Jun 30 11:01 optim.py
-rw-r--r-- 1 user user  3742 Jun 30 11:01 train.py
---DATA---
total 2904
drwxr-xr-x 2 user user      60 Jun 30 22:30 .
drwxr-xr-x 4 user user    4096 Jun 30 22:30 ..
-rw-r--r-- 1 user user 2967336 Jun 30 11:01 train.npz
---RUNCHECKS head---
#!/usr/bin/env python3
"""PUBLIC component check runner for the from-scratch numpy framework + the adversarial machinery.

Run this AS OFTEN AS YOU LIKE while you implement to get a per-check 
…[truncated 2606 chars]

1	"""Reverse-mode automatic differentiation over numpy arrays (IMPLEMENT THIS).
2	
3	A ``Tensor`` wraps a single ``numpy.ndarray`` (``float64``) and records the operation that
4	produced it so that ``.backward()`` can walk the graph in reverse-topological order and
5	accumulate ``.grad`` (the gradient of the scalar on which ``.backward()`` was called w.r.t.
6	this tensor) into every leaf.
7	
8	This task is ADVERSARIAL ROBUSTNESS: the model is a small convolutional classifier and the
9	attacks (PGD/FGSM/MI-FGSM/PGD-L2/CW) ascend on the gradient of an attack loss w.r.t. the INPUT
10	image, so the autograd engine must (a) flow gradients back to PARAMETERS (for training) AND
11	(b) flow gradients back to the INPUT tensor (for the attack). BOTH directions are exercised by the
12	verifier's finite-difference gradient checks, so the convolution's input-gradient (the ``_col2im``
13	adjoint) is load-bearing.
14	
15	Contract (the verifier's conformance suite differentiates your analytic backward against finite
16	differences and checks your forward against its own reference, so match this exactly):
17	
18	* ``Tensor(data, requires_grad=False)`` -- ``data`` is array-like, stored as ``float64`` in
19	  ``self.data``; ``self.grad`` starts as ``None`` and becomes a same-shape ``float64`` array after
20	  backward. ``requires_grad`` leaves accumulate grad; non-requiring leaves do not.
21	* Every op returns a NEW ``Tensor`` whose ``requires_grad`` is the OR of its differentiable inputs.
22	 
…[truncated 18629 chars]

1	"""Neural-network layers + a small convolutional classifier, built on the autograd engine
2	(IMPLEMENT THE FORWARDS).
3	
4	Every module exposes ``params()`` -> list[Tensor] (the leaf tensors with ``requires_grad=True``)
5	and ``named_params()`` -> dict[str, Tensor] with STABLE names that match the checkpoint format the
6	verifier loads. ``SmallCNN.state_dict()`` / ``load_state_dict()`` round-trip a plain
7	``dict[str, np.ndarray]`` (saved as an ``.npz``); the verifier loads YOUR checkpoint into its OWN
8	reference SmallCNN via these names, so the names + shapes below are part of the contract.
9	
10	Naming contract for SmallCNN (do not change -- the verifier indexes by these exact keys):
11	  conv1.weight   (C1, C_in, 3, 3)        conv1.bias   (C1,)
12	  conv2.weight   (C2, C1, 3, 3)          conv2.bias   (C2,)
13	  fc1.weight     (C2*(H/4)*(W/4), F)      fc1.bias     (F,)
14	  fc2.weight     (F, n_classes)           fc2.bias     (n_classes,)
15	
16	Architecture (pinned): for an (N, C_in, H, W) input image batch,
17	  conv1 (C_in->C1, 3x3, pad 1) -> relu
18	  maxpool 2x2                   (H,W -> H/2,W/2)
19	  conv2 (C1->C2, 3x3, pad 1)   -> relu
20	  maxpool 2x2                   (H/2,W/2 -> H/4,W/4)
21	  flatten -> fc1 (-> F) -> relu -> fc2 (-> n_classes)   logits.
22	``Linear`` computes ``x @ weight + bias`` (weight is (in, out)). No BatchNorm inside SmallCNN (so
23	the attack runs a single deterministic eval-mode forward with no running-stat dependence).
24	
25	The other
…[truncated 15896 chars]

1	"""Optimizers + LR schedulers over a flat list of autograd ``Tensor`` parameters (IMPLEMENT THESE).
2	
3	Every optimizer operates IN PLACE on ``param.data`` using ``param.grad`` (the gradient accumulated
4	by ``Tensor.backward``). ``zero_grad()`` resets every grad to None. The EXACT update formula each
5	optimizer must match (the verifier checks one and several steps against its own reference) is in
6	its docstring.
7	
8	The adversarial-training loop uses AdamW (decoupled decay, with ``no_decay_ndim`` excluding 1-D
9	params/biases) + global grad-norm clipping; the rest of the optimizer zoo + the four LR schedulers
10	are part of the from-scratch framework the conformance suite audits.
11	"""
12	from __future__ import annotations
13	
14	import math
15	from typing import List
16	
17	import numpy as np
18	
19	from autograd import Tensor
20	
21	
22	class Optimizer:
23	    def __init__(self, params: List[Tensor]):
24	        self.params = list(params)
25	
26	    def zero_grad(self):
27	        for p in self.params:
28	            p.grad = None
29	
30	
31	class SGD(Optimizer):
32	    """SGD + momentum + optional Nesterov + (coupled/L2) weight decay:
33	        g = grad + wd*param;  v = mu*v + g;  step = (g + mu*v) if nesterov else v;  param -= lr*step."""
34	
35	    def __init__(self, params, lr=0.1, momentum=0.0, weight_decay=0.0, nesterov=False):
36	        super().__init__(params)
37	        self.lr = lr
38	        self.momentum = momentum
39	        self.weight_decay = weight
…[truncated 8125 chars]

1	"""White-box evasion attacks built on the from-scratch autograd engine (IMPLEMENT THESE).
2	
3	An adversary perturbs each input within a norm budget (L-inf eps in the [0,1] pixel domain by
4	default) and tries to make the classifier WRONG. Every attack ascends on the gradient of an attack
5	loss with respect to the INPUT image, which is exactly the gradient the autograd engine produces
6	when the input is wrapped in a ``requires_grad=True`` Tensor and the loss is backpropagated -- so a
7	correct ``conv2d`` input-gradient (the ``_col2im`` adjoint) is load-bearing.
8	
9	THE PRIMITIVE
10	  input_grad(model, x, y)                  d/dx of mean cross-entropy of model(x) vs y (ndarray).
11	  loss_input_grad(model, x, y, loss_fn)    d/dx of an ARBITRARY scalar attack loss loss_fn(logits,y).
12	
13	L-INF ATTACKS
14	  fgsm(model, x, y, eps)                    clip(x + eps*sign(input_grad)).
15	  pgd_attack(model, x, y, eps, steps, alpha)  iterated FGSM with random start + project to the
16	                                            L-inf eps-ball around x AND the [0,1] box each step.
17	  mi_fgsm(model, x, y, eps, steps, alpha, mu) momentum-iterative FGSM: accumulate a decaying
18	                                            momentum of the L1-NORMALIZED gradient, step on its sign,
19	                                            project each step.
20	  targeted_pgd(model, x, y_target, eps, steps, alpha)  DESCEND CE toward y_target (step on the
21	                                     
…[truncated 7820 chars]

1	"""Adversarial-training objectives built on the from-scratch autograd engine (IMPLEMENT THESE).
2	
3	Several standard recipes turn a fragile classifier into a robust one. Each crafts adversarial
4	inputs per minibatch with the model's own attack, then takes a gradient step on a robustness-aware
5	loss; the recipes differ in the loss. All run a single forward+backward; the caller does grad-clip
6	+ the optimizer step. ``x_clean`` / ``x_adv`` are ndarrays (N, C, H, W); ``y`` is an int (N,).
7	
8	  pgd_at_loss(model, x_adv, y)                  Madry PGD-AT: CE on the ADVERSARIAL batch.
9	  trades_loss(model, x_clean, x_adv, y, beta)   TRADES: CE(clean) + beta*KL(stopgrad(clean)||adv).
10	                                                The clean branch INSIDE the KL is a STOP-GRADIENT
11	                                                target (detached): the KL backprops only through
12	                                                the adversarial branch.
13	  mart_loss(model, x_clean, x_adv, y, beta)     MART: boosted-CE on the adversarial batch
14	                                                ( CE(adv,y) - mean log(1 - max_{j!=y} p_adv_j) ) +
15	                                                beta * mean_i[ (1 - p_clean_i[y_i]) *
16	                                                KL_i(softmax(adv)||stopgrad softmax(clean)) ].
17	  alp_loss(model, x_clean, x_adv, y, lam)       Adversarial Logit Pairing:
18	                                                0.5*(CE(clean)+CE(ad
…[truncated 4278 chars]

1	"""Adversarial-training loop for the small CNN, using the from-scratch numpy framework
2	(IMPLEMENT THIS).
3	
4	Standard (clean) training reaches ~99% CLEAN accuracy but ~chance ROBUST accuracy -- it is broken
5	by the verifier's STRONG multi-restart L-inf PGD attack. WEAK robust training is not enough either:
6	single-step (FGSM) adversarial training suffers "catastrophic overfitting" and is shattered by the
7	multi-step / multi-restart eval attack, and adversarial training at a SMALLER perturbation budget
8	than the eval budget leaves the model fragile exactly where it is attacked. The effective recipe is
9	full multi-step PGD ADVERSARIAL TRAINING (Madry et al. 2018) with the perturbation budget MATCHED
10	to the (larger) eval budget:
11	
12	  * on every minibatch, craft an inner k-step L-inf PGD adversarial batch against the CURRENT model
13	    (attack.pgd_attack), at the eps the eval uses, then take the AdamW step on advtrain.pgd_at_loss
14	    (cross-entropy on the adversarial batch);
15	  * train long enough for robustness to converge (a few epochs is not enough at this eps);
16	  * stability details that materially raise the achieved robust accuracy and make it reproducible:
17	    (a) exclude biases (1-D params) from weight decay (AdamW no_decay_ndim=1); (b) clip the global
18	    gradient norm (the adversarial loss surface is sharp); (c) keep the BEST-by-robust-accuracy
19	    checkpoint, evaluated each epoch with the model's own multi-step PGD on a held-BACK slic
…[truncated 2473 chars]

1	"""Data loading + minibatching for the shape-classification set (IMPLEMENT THESE).
2	
3	The visible train split ships as ``/app/data/train.npz`` with arrays ``X`` (N, C, H, W) float
4	pixels in [0,1] and ``y`` (N,) int labels. The SEALED held-out split is NOT in the image -- the
5	verifier regenerates it from a secret feature seed and runs its own attack on it.
6	
7	Contract:
8	  load_npz(path) -> (X float64 (N,C,H,W), y int64 (N,))
9	  train_val_split(X, y, val_frac, rng) -> ((Xtr,ytr),(Xval,yval))   random disjoint split (val slice
10	        is a held-BACK slice of the VISIBLE train data you may use for best-checkpoint selection --
11	        it is NOT the verifier's sealed held-out set)
12	  iter_batches(X, y, batch_size, rng) -> yields (xb, yb) random-permutation minibatches
13	  get_batch(X, y, batch_size, rng) -> a single random minibatch
14	  to_onehot(y, n_classes) -> (N, n_classes) one-hot float matrix
15	  clip01(X) -> X clamped into the [0,1] pixel domain
16	"""
17	from __future__ import annotations
18	
19	from typing import Iterator, Tuple
20	
21	import numpy as np
22	
23	
24	def load_npz(path: str) -> Tuple[np.ndarray, np.ndarray]:
25	    raise NotImplementedError("implement load_npz")
26	
27	
28	def train_val_split(X: np.ndarray, y: np.ndarray, val_frac: float,
29	                    rng: np.random.Generator):
30	    raise NotImplementedError("implement train_val_split")
31	
32	
33	def iter_batches(X: np.ndarray, y: np.ndarray, batch_size: int,
34	           
…[truncated 814 chars]