Domain Constraints

## The object that actually holds the range An adversarial-example library never attacks your model directly; it attacks a **wrapper** you build around it. In the Adversarial Robustness Toolbox (ART) that wrapper is an estimator such as `art.estimators.classification.PyTorchClassifier`, and one of its constructor arguments is `clip_values`, a two-element tuple `(min, max)`. Foolbox spells the same idea `bounds=(0, 1)` on `foolbox.PyTorchModel`. torchattacks does not ask at all: it documents that your model must accept inputs already in `[0, 1]` and assumes it. Three spellings, one statement — *one* pair of numbers describing *every* coordinate of the input tensor. ## The mechanism, step by step An iterative attack such as ART's `ProjectedGradientDescent` repeats three moves: compute the gradient of the loss with respect to the input, take a step along it, project back. The projection is two clamps, not one: 1. back inside the **perturbation ball**, so the example stays within `eps` of the original input; 2. back inside **`clip_values`**, so no coordinate leaves the declared input box. Both run on every iteration, not once at the end. That ordering matters. A final-only clamp would return a different and generally weaker example, because the search would have spent its steps optimising in a region the model is never fed. ## What it costs The clamp itself is free — an elementwise minimum and maximum over a tensor, invisible next to a forward and backward pass. What costs money is getting the value wrong, because nothing tells you. `clip_values` is not checked against the data you pass to `generate()`; you can declare `(0, 1)` and hand over 0-255 images and the run completes normally. Order-of-magnitude: a 1,000-example PGD sweep at 40 iterations against a mid-size vision model is tens of minutes to a few GPU-hours; the black-box attacks in the same library spend thousands to hundreds of thousands of billed queries per sweep against a metered endpoint. A unit mismatch throws all of that away, plus the engineer-day of triage that follows a result nobody can defend. ## Where the number misleads This is the paragraph worth memorising. In ART, `eps` and `eps_step` are expressed in **input units, not as a fraction of the declared range**. So the same call means different things depending on the scale your model is actually fed: | data really in | `clip_values` passed | `eps` passed | what you actually measured | |---|---|---|---| | 0-1 | (0, 1) | 0.03 | the intended budget, roughly 8/255 | | 0-255 | (0, 1) | 0.03 | a perturbation ~255x smaller than intended; success near zero | | 0-1 | (0, 255) | 8 | an effectively unbounded attack; success near 100% | Both failure rows produce a *plausible* number. The first reads as "the model is robust at a small budget" and gets written into a report. The second reads as "the model breaks under a trivial perturbation" and gets written into a different report. Neither is a property of the model; both are a property of a mismatch between the wrapper's declared box and the tensor the model receives. The closely related trap is *where normalisation lives*. If mean/standard-deviation normalisation sits inside the callable you wrapped, the attack optimises in raw-pixel space and the declared range should be the raw one. If it sits outside, the attack sees normalised values that legitimately run from roughly -2.5 to +2.5, and a declared `(0, 1)` box crushes every example on the first projection. ## What one global interval cannot say It carries nothing per feature and nothing relational. A tabular row where `age` lives in 18-90 and `amount` in 0-50,000 has no honest single pair: the union permits an age of 50,000, the intersection forbids any amount above 90. Integrality, one-hot exclusivity, a field derived from another field, a checksum — none of it is expressible. The box is a claim about the *tensor*, not about whether the result is a record any system would accept. ## What I would check before believing the output Print the minimum and maximum of the clean batch you are about to attack and confirm they sit inside `clip_values`. Confirm `eps` is quoted in the same units as that range. Confirm `eps_step` is smaller than `eps`, since an equal or larger step collapses the iterations into repeated single steps. Then run the whole pipeline once at a deliberately absurd `eps`: if success does not go to essentially 100%, your wiring is broken and the model is not robust. That is the cheapest sanity check in the toolkit and it costs one run.