WGU BSAISEC E178 Implementing Adversarial Training - Section 2

Welcome to the WGU BSAISEC E178 Implementing Adversarial Training - Section 2 hands-on lab!

Introduction

A classifier that performs well on ordinary inputs can still be pushed into the wrong answer by an attacker who perturbs those inputs deliberately. There is more than one way to defend it, and the three in this lab act in three different places: on the model's weights, on the traffic reaching the model, and on the data the model was trained from.

Adversarial training generates the attacker's examples, labels them with the answer the model should have given, and retrains on them. The detail that makes it a defense rather than an attack is the label: attach the label the attack was trying to force and the same procedure becomes clean-label poisoning. A detection-based defense leaves the model alone and puts a detector in front of it, flagging a suspicious transaction and stopping it before the model decides. Defensive data augmentation uses a pre-trained GAN to expand a training set that has too few examples of the class the model most needs to recognize, provided the synthetic examples survive validation against real data.

Each one is cheap to claim and harder to justify. This lab asks you to act as a defender for a financial services fraud detection classifier, build all three against the same system and the same attack, and report honestly on what each is worth, what it costs, and what it fails to cover.

You will work in a Jupyter notebook environment with the Adversarial Robustness Toolbox (ART), PyTorch, and standard data science libraries preinstalled, together with a preconfigured fraud detection dataset, a trained baseline classifier, and a pre-trained GAN.

By completing this lab you will:

• Define the threat model a defense is built against, and measure how much fraud an evasion attack pushes past an undefended classifier.
• Retrain the classifier on adversarial examples that keep their original, correct labels, and measure the robustness gained against the clean-performance cost.
• Demonstrate why that labeling choice separates a defense from a clean-label poisoning attack, by building both and comparing them.
• Build and train an ART evasion detector, assemble it with the classifier into a gate that flags and stops suspicious transactions, and choose its coverage and operating point against a stated false-decline budget.
• Distinguish a detection defense from the input-preprocessing alternative by building both and measuring what each costs on ordinary traffic.
• Measure a defense against an attacker who knows it is there, at increasing attack strength, and report what survives.
• Validate GAN-generated synthetic transactions against real transaction patterns before using them, and compare the result against naive oversampling.
• Compare all three defenses on the same two measures and recommend what the bank should deploy.

Scenario

Cardinal Trust Financial's fraud detection classifier is the system under test. The dataset, the baseline classifier, and the pre-trained GAN supplied in the lab environment are preloaded; refer to the task notebook for details on each and for the instructions for every section.

Deliverable

Submit the executed notebook, including:

• Recorded clean accuracy and adversarial accuracy for the undefended classifier, establishing the before measurements.
• The same two measures for all three defenses, so they can be compared directly.
• The labeling comparison that separates adversarial training from clean-label poisoning.
• The adaptive-attacker measurement for the detection gate, with the attack-strength sweep behind it.
• The GAN validation pass rates and the comparison against naive oversampling.
• A written analysis ranking the three defenses against a stated threat model, and your recommendation to Cardinal Trust Financial.

Your submission should include the executed notebook and exported reports, along with any supporting evidence generated in the lab environment, such as figures and metrics tables.

Intended audience

• WGU Students

Prerequisites

• Machine Learning
• PyTorch