Chapter 1 — Calculus I
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Derivatives as sensitivity"]
N2["1.2 Rules you will use constantly"]
N3["1.3 Checking derivatives numerically"]
N4["1.4 Why security engineers care"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Derivatives as sensitivity"]
N2["1.2 Rules you will use constantly"]
N3["1.3 Checking derivatives numerically"]
N4["1.4 Why security engineers care"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Derivatives as sensitivity]
|
v
[1.2 Rules you will use constantly]
|
v
[1.3 Checking derivatives numerically]
|
v
[1.4 Why security engineers care]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) compute derivatives of the functions used in machine learning (polynomials, exponentials, logarithms, the logistic function); (2) interpret a derivative as sensitivity; (3) check derivatives numerically; and (4) explain why the same derivative that trains a model also guides an attacker.
1.1 Derivatives as sensitivity
The derivative f′(x) measures how much f changes when x changes a little: f(x + h) ≈ f(x) + h f′(x). Engineers use this as a sensitivity: if a bearing's temperature model has a large derivative with respect to an input, small sensor errors cause large output changes. Machine-learning models are functions of inputs and parameters, so derivatives tell us how outputs respond to both.
The approximation holds only for small h, so a derivative describes the neighbourhood of one point, not the whole function. Sam therefore always states where a sensitivity was measured, for example at a typical daytime image, and checks it again at other operating points before drawing conclusions about the model as a whole.
1.2 Rules you will use constantly
Power rule (xⁿ)′ = n xⁿ⁻¹; exponential (eˣ)′ = eˣ; logarithm (ln x)′ = 1/x; product, quotient and chain rules. The logistic function σ(z) = 1/(1 + e⁻ᶻ) maps any real number to (0, 1) and satisfies σ′(z) = σ(z)(1 − σ(z)). The logistic loss for a label y ∈ {−1, +1} and score z = w·x is L = ln(1 + e^(−y z)); by the chain rule, ∂L/∂w = −y x / (1 + e^(y w x)).
The logistic derivative is worth remembering because it is largest at z = 0, where σ′ = 0.25, and shrinks towards zero as the score becomes confident in either direction. Inputs near the decision boundary are therefore where small changes move the output most, which is exactly where an attacker starts.
1.3 Checking derivatives numerically
A central finite difference (f(x + h) − f(x − h)) / 2h approximates f′(x) with error proportional to h². Comparing it with your analytic formula is the standard test for gradient code; mismatch means a bug. The lab does exactly this, then takes six gradient-descent steps that lower the loss.
"""Lab G: gradients by calculus and by finite differences (stdlib only).
For logistic loss L(w) = log(1 + exp(-y * w * x)) the derivative is
dL/dw = -y * x / (1 + exp(y * w * x)). The same gradient drives both
training (descend) and evasion attacks (ascend with respect to the input)."""
import math
x, y = 2.0, 1.0
L = lambda w: math.log(1 + math.exp(-y * w * x))
dL = lambda w: -y * x / (1 + math.exp(y * w * x))
for w in (-1.0, 0.0, 0.5, 2.0):
h = 1e-5
fd = (L(w + h) - L(w - h)) / (2 * h)
print(f"w={w:5.2f} loss={L(w):.4f} analytic={dL(w):.6f} finite_diff={fd:.6f}")
w = -1.0
for step in range(6):
w -= 0.5 * dL(w)
print(f"step {step+1}: w={w:.4f} loss={L(w):.4f}")
Expected output:
w=-1.00 loss=2.1269 analytic=-1.761594 finite_diff=-1.761594
w= 0.00 loss=0.6931 analytic=-1.000000 finite_diff=-1.000000
w= 0.50 loss=0.3133 analytic=-0.537883 finite_diff=-0.537883
w= 2.00 loss=0.0181 analytic=-0.035972 finite_diff=-0.035972
step 1: w=-0.1192 loss=0.8194
step 2: w=0.4401 loss=0.3469
step 3: w=0.7332 loss=0.2076
step 4: w=0.9207 loss=0.1472
step 5: w=1.0576 loss=0.1139
step 6: w=1.1652 loss=0.0928
In the printed table the two columns agree to six decimal places at all four test points, including w = 2, where the gradient is small. The descent steps show the loss falling from 2.1269 to 0.0928, and the shrinking step sizes follow from the gradient flattening as w grows and the example is classified with more confidence.
1.4 Why security engineers care
Training moves parameters against the gradient of the loss. An evasion attacker moves the input along the gradient of the loss with respect to the input, to make the loss larger — the idea behind the fast gradient sign method (Goodfellow et al., arXiv:1412.6572). So derivatives are both the engine of learning and a map for the attacker. Defences that hide or break gradients without changing the model's behaviour give a false sense of security (Athalye et al., arXiv:1802.00420).
For a security reviewer, a gradient is an attacker's tool as much as a trainer's.
1.5 Worked example (synthetic NRS case)
Sam computes the derivative of TrackEye's final logistic score with respect to one pixel-intensity feature and finds 0.8 per unit, while most features are below 0.05. A dirty lens that shifts that feature by 0.5 changes the score by about 0.4 — enough to flip a borderline decision. Sam records the feature as a high-sensitivity input for later robustness testing.
The arithmetic is the first-order approximation at work: 0.8 × 0.5 = 0.4. It holds only near the point where the derivative was measured, so Sam later checks the real score change on images with simulated dirt, which shows whether the linear estimate understates or overstates the effect. The feature joins the robustness test plan with that caveat recorded.
1.6 Errors and limits
- Forgetting the chain rule's inner derivative.
- Using too small an h in finite differences (rounding error) or too large (truncation error).
- Treating a small gradient as proof that no small change can flip the output (functions can be non-linear).
Each mistake has a simple guard. Writing the inner function explicitly before differentiating catches a missing chain-rule factor. Trying several step sizes, such as 1e-3, 1e-5 and 1e-7, shows where finite differences are stable, since the error first falls and then rises again. For the third mistake, a small gradient is treated as a reason to test larger changes directly, never as a guarantee that the output cannot flip.
Exercises
- EX001 — Logistic derivative. Show that σ′(z) = σ(z)(1 − σ(z)) and evaluate it at z = 0. Rubric: 3 = derivation and 0.25; 2 = value without derivation; 1 = partial; 0 = none.
- EX002 — Lab reading. In Lab G, what are the loss and gradient at w = 0, and why does the loss fall over the six steps? Rubric: 3 = 0.6931, −1.0; moving against the gradient reduces loss; 2 = numbers only; 1 = vague; 0 = wrong.
- EX003 — Attacker's view. Explain in two sentences how an attacker uses the same derivative differently from training. Rubric: 3 = derivative w.r.t. input, step to increase loss; 2 = partial; 1 = vague; 0 = wrong.
Synthesis
Derivatives quantify sensitivity. They train models and they also show attackers which small input changes matter most — the first link between mathematics and AI security.