Chapter 6 — Calculus II
Lesson map
Lesson 06 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Partial derivatives and gradients"]
N2["6.2 The multivariate chain rule"]
N3["6.3 Taylor approximation and worst-case change"]
N4["6.4 Lipschitz constants"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Partial derivatives and gradients"]
N2["6.2 The multivariate chain rule"]
N3["6.3 Taylor approximation and worst-case change"]
N4["6.4 Lipschitz constants"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]
[Learning outcomes]
|
v
[6.1 Partial derivatives and gradients]
|
v
[6.2 The multivariate chain rule]
|
v
[6.3 Taylor approximation and worst-case change]
|
v
[6.4 Lipschitz constants]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) compute partial derivatives and gradients of multivariate functions; (2) use the chain rule through compositions (the basis of backpropagation); (3) apply Taylor approximations to estimate output changes; and (4) relate gradient norms and Lipschitz constants to robustness.
6.1 Partial derivatives and gradients
For f(x₁, …, xₙ), the partial derivative ∂f/∂xᵢ holds other variables fixed. The gradient ∇f collects them into a vector pointing in the direction of steepest increase. For a linear score s = w·x + b, ∇ₓ s = w: the weights are the input gradient, which is why linear models are easy to attack along sign(w).
For a linear model the attack direction is therefore visible in the weights themselves. Anyone who obtains them, for example from a leaked model file, knows exactly which features to push and in which direction. For non-linear models the gradient changes from input to input, but the same reasoning applies locally around each one.
6.2 The multivariate chain rule
Neural networks are compositions f = f_L ∘ … ∘ f₁. The chain rule multiplies Jacobian matrices layer by layer; backpropagation computes this product efficiently from the output backwards. The same algorithm gives gradients with respect to inputs, which white-box attacks use.
Backpropagation saves work by reusing intermediate products, so computing the gradient for all inputs costs about as much as one forward pass. That efficiency is why white-box attacks are cheap: an attacker with the model file can compute the most damaging direction for any input in milliseconds. Protecting model weights is therefore part of defending against evasion, not only a matter of intellectual property.
6.3 Taylor approximation and worst-case change
First-order Taylor: f(x + δ) ≈ f(x) + ∇f(x)·δ. If an attacker may change each feature by at most ε (an L∞ budget), the largest first-order change is ε·‖∇f(x)‖₁, achieved by δ = ε·sign(∇f(x)) — exactly the FGSM step (Goodfellow et al., arXiv:1412.6572). Under an L2 budget, the worst change is ε·‖∇f(x)‖₂. Norms matter: a gradient with many small components can still have a large L1 norm in high dimensions, which is one explanation for adversarial vulnerability of high-dimensional models.
The approximation is accurate only for small ε, so engineers use it as a quick estimate and then test the real model with actual perturbations.
6.4 Lipschitz constants
A function is L-Lipschitz if |f(x) − f(y)| ≤ L‖x − y‖. If a classifier's margin at x is m and its score is L-Lipschitz, no perturbation smaller than m/L can flip the decision — a certificate. Computing tight L for deep networks is hard, which is why certified methods such as randomized smoothing (Cohen et al., arXiv:1902.02918) use probabilistic arguments instead.
A certificate is stronger than a test result: it guarantees that no attack within the radius can succeed, however clever. Loose bounds still give valid certificates, but the guaranteed radius may become too small to matter.
6.5 Worked example (synthetic NRS case)
Pulse's bearing anomaly score is s = 0.9·t + 0.4·v − 0.2·h + c (temperature, vibration, humidity, normalised). With ε = 0.1 per feature, the worst first-order change is 0.1 × (0.9 + 0.4 + 0.2) = 0.15. Sam compares this to the typical margin (0.3) and concludes that a sensor-spoofing attacker limited to ±0.1 cannot hide a clearly hot bearing, but can hide borderline ones.
The weights give the worst direction directly: raise humidity and lower temperature and vibration, each by 0.1. A margin of 0.3 is twice the worst change, so clearly hot bearings stay flagged, but any bearing whose score lies within 0.15 of the threshold could be hidden. Sam records that band as the residual risk and suggests cross-checking borderline readings with a second sensor.
6.6 Errors and limits
- Using first-order estimates far from the point where they are accurate.
- Confusing L1, L2 and L∞ budgets.
- Treating a local gradient as a global bound.
First-order estimates work near the measured point and become unreliable for larger changes, where curvature dominates. Mixing norms produces bounds that are wrong by a factor that grows with the number of features. A local gradient says nothing about distant inputs, so Sam always pairs estimates with tests using real perturbations and states the budget's norm in every result he reports.
Exercises
- EX016 — Gradient. Compute ∇f for f(x, y) = x²y + 3y. Rubric: 3 = (2xy, x² + 3); 2 = one component; 1 = attempt; 0 = none.
- EX017 — Worst case. For s = 2x₁ − x₂ + 0.5x₃ and ε = 0.2 (L∞), give the worst-case first-order increase and δ. Rubric: 3 = 0.7, δ = (0.2, −0.2, 0.2); 2 = one; 1 = method; 0 = none.
- EX018 — Certificate. A score has margin 0.6 and Lipschitz constant 3 (L2). What perturbation size is certified safe? Rubric: 3 = < 0.2 in L2 with reasoning; 2 = number only; 1 = wrong norm; 0 = none.
Synthesis
Gradients and norms turn "small change" into a number. They explain why attacks work, how worst cases are bounded, and why certificates are possible but difficult for deep models.
Continue studying — chapter 06 of 50
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →