\section{BACKGROUND}

\subsection{Statistical Reliability Engineering}
The problem stated in~\eqref{eq:DefProbFail} is exactly the core issue in Statistical Reliability Engineering, a domain born in the 70s. Here, $h$ is a state function of a physical system described by parameters stored in $\vecx$. The system is reliable when $h(\vecx)\leq0$, which is the case around the nominal state $\vecx_0$.
The state $\X$ deviates from $\vecx_0$ due to some random uncertainties.
The number of parameters is usually small and the state function has a close form inherited from the rules of physics. However, the computation of~\eqref{eq:DefProbFail} is difficult because $\pi$ or the region $\{h(\vecx)\geq0\}$ is complicated.

\subsubsection{Most Probable Failure Point in the U-space}
\label{sec:Uspace}
To get an abstraction from the distribution $\pi$, one usually considers that there exists a bijective isoprobabilistic transformation $\transform$ that pushes forward the normal distribution to $\pi$. In other words, $\X = \transform(\U)\sim \pi$ when $\U\sim\mathcal{N}(\mathbf{0};\mathbf{I})$. Examples are the ~\cite{nataf} and ~\cite{rosenblatt} transformations. This rephrases the problem into
\begin{equation}
    \label{eq:PfailUspace}
    \pfail(\pi) = \E[\ind{G(\U)\leq 0}]
\end{equation}
where $G \defeq - h \circ \transform^{-1}$.
%and $\X = T(\U)$. 

%\subsubsection{With design point}
The following methods approximate the failure event around the Most Probable Failure Point (MPFP), also called the design point. It is defined as the point in the U-space with the highest probability density on the frontier $G(\vecu) = 0$. Formally:
\begin{equation}
    \label{eq:DesignPoint}
    \mpp \defeq \arg \max_{\vecu: G(\vecu)=0} \phi(u)= \arg \min_{\vecu: G(\vecu)=0} \|\vecu\|^2.
\end{equation}
In classical applications of Statistical Reliability Engineering, finding this point is usually not difficult because it has a closed form or a numerical solution like the HL-RF algorithm (\cite{HasoferLind}, \cite{hlrf})  quickly converges in a low dimensional space.
Sect.~\ref{sec:exp} shows this is still possible on small-scale images.

\subsubsection{FORM and SORM}
The First (resp. Second) Order Reliability Method FORM (resp. SORM) models $G(\vecu)$ by a linear (resp. quadratic) function in the neighborhood of $\mpp$.
This leads to the following approximations:
\begin{align}
    \pfail^{\FORM} &\defeq \Phi(-\|\mpp\|_2),\\
    \pfail^{\SORM} &\defeq \Phi(-\|\mpp\|_2) \prod_{i=1}^{d-1}(1+\kappa_i)^{-1/2}.
\end{align}
where $(\kappa_i)_{i=1}^{d-1}$ are the eigenvalues of the Hessian matrix of $G$ at point $\mpp$ restricted to the subspace orthogonal to $\mpp$, denoted $\mathsf{span}(\mpp)^\bot$. The product accounts for the curvatures of the frontier around $\mpp$, thereby refining the probability of failure estimate compared to FORM. We illustrate this phenomenon in section \ref{sec:exp},  for small-scale images, as it is not possible to apply form to larger images due to its computational complexity in $O(d^2)$.

\subsubsection{Line Sampling (LS)}
LS also accounts for curvature, though, without using the Hessian matrix~\citep{line_sampling}. It is a random simulation that has advantages for complex and high-dimensional systems. In a nutshell, it draws random normal vectors $\U_i$, projects them onto hyperplane $\mathcal{H}= \mathsf{span}(\mpp)^\bot$ and finds the minimum $\beta_i$ s.t. $G(\U_i^\bot + \beta_i \mpp / \|\mpp\|) = 0$. See also Figure \ref{fig:ls}. The final estimator is given by:
\begin{equation}
\label{eq:LineSampling}
\pfail^{\LS} \defeq \frac{1}{N} \sum_{i=1}^N \Phi(-\beta_i).
\end{equation}

\begin{figure}[htb!]
    \centering
    \includegraphics[scale=0.4]{figures/illustrations/2D_plot_line_sampling.pdf}
    \caption{Illustration of Line Sampling in $ \R^2$. }
    \label{fig:ls}
\end{figure}

\subsubsection{Importance Sampling (IS)}
The methods above assume that the design point $\mpp$ is easily computed.
Without this assumption, the Crude Monte Carlo estimator
\begin{equation}
    \pfail^{\CMC} \defeq \frac{1}{N} \sum_{i=1}^{N} \ind{G(\U_i)\leq0}
\end{equation}
is a possibility only if the true probability $\pfail$ is not small because the relative estimator variance scales as $1/N\pfail$.

Importance Sampling is an alternative estimator:
\begin{equation}
    \label{eq:ImpSamp}
    \pfail^{\IS} \defeq \frac{1}{N} \sum_{i=1}^{N} \ind{G(\Y_i)\leq0}\frac{\phi(\Y_i)}{f_Y(\Y_i)},
\end{equation}
where $\Y_i$ are i.i.d. random vectors whose p.d.f. is denoted $f_Y$ and $\phi$ is the p.d.f. of the standard normal law. It may bring a variance reduction if the p.d.f. of $\Y$ is similar to the optimal $f_Y^\star(\Y)\propto \phi(\Y)\ind{G(\Y)\leq0}$.

Without any prior knowledge about $G$, it is difficult to figure out where the region $\{\U| G(\U)\leq 0\}$ is located in the U-space, hence the shape of the optimal density $f_Y^\star$. The Cross-Entropy method makes a progressive exploration of the space by iteratively sampling random vectors of density $f_Y^{(j)}$ and exploit the variables $\left(\ind{G\left(\Y_i^{(j)}\right)\leq\tau_j}\right)_i$ to refine the density $f_Y^{(j+1)}$ and the threshold $\tau_{j+1}$ for the next iteration~\citep[Chap.~8]{rubinstein_kroese}.
For instance, if we restrict to the un-centered normal laws family $\mathcal{N}(\boldsymbol{\theta},\mathbf{I})$, then $f_Y^{(j+1)}$ is characterized by its mean value
\begin{equation}
\label{eq:CE}
\boldsymbol{\theta}^{(j+1)} \defeq \frac{\sum_{i=1}^N \ind{G\left(\Y_i^{(j)}\right)\leq\tau_{j}}\frac{\phi(\Y_i)}{f_Y(\Y_i)}\Y_i^{(j)}}{\sum_{i=1}^N \ind{G\left(\Y_i^{(j)}\right)\leq\tau_{j}}\frac{\phi(\Y_i)}{f_Y(\Y_i)}}. 
\end{equation}

\subsection{Adversarial Examples}
\label{sec:AdvEx}
Adversarial examples are considered a vulnerability of machine learning classifiers.
Given an input $\vecx_0$ well classified by classifier $c(\cdot)$, the adversarial example is the nearest misclassified input:
\begin{equation}
    \label{eq:AdvEx}
    \vecx^\star = \arg\min_{\vecx\in[0,1]^d: c(\vecx)\neq c(\vecx_0)} d(\vecx,\vecx_0),
\end{equation}
where $d(\vecx,\vecx_0)$ is a distance between $\vecx$ and $\vecx_0$.
For the case where the classifier is a neural network, the event $c(\vecx)\neq c(\vecx_0)$ can be rephrased as $h(\vecx)\geq0$ (see~\eqref{eq:h_function}).

If distance $d$ is the Euclidean norm of $\vecx-\vecx_0$, then the adversarial example \eqref{eq:AdvEx} \emph{in the U-space} is indeed the design point~\eqref{eq:DesignPoint}.
As far as we know, this connection between adversarial examples and statistical reliability engineering has never been made before.
This implies that algorithms from this later domain, like HL-RF designed in the 70s, could find $\ell_2$ adversarial examples. This is indeed not the case due to the high dimensionality of the input space in modern classification problems.
The recent attacks finding adversarial examples are more efficient.

The \cite{carlini_wagner} (CW) attack is known for its precision in scouting adversarial examples with minimal perturbation.
It amounts to solve the Lagrangian formulation of~\eqref{eq:DesignPoint}:
Define $J(\vecu,\lambda) \defeq \|\vecu\|^2 + \lambda G(\vecu),\forall \lambda\leq 0$ and
\begin{equation}
    \vecu^\star_\lambda \defeq \arg\min_{\vecx\in[0,1]^d} J(\vecu,\lambda).
\end{equation}
This is done with a numerical solver. On top of it, a line search finds $\lambda^\star$ s.t. $G(\vecu^\star_{\lambda^\star})=0$.
This attack requires a fair amount of function $G$ gradient computations. 
Of note, we have the following property: $2 \vecu^\star_\lambda + \lambda\nabla G(\vecu^\star_\lambda) = \mathbf{0}$, or:
\begin{equation}
    \label{eq:Cosine}
    \cos\left(\vecu^\star_\lambda, \nabla G(\vecu^\star_\lambda)\right) = -1.
\end{equation}

% \begin{equation}
%     \lambda\nabla G(\vecu^\star_\lambda) = - 2 \vecu^\star_\lambda,
% \end{equation}
% which means that the cosine between vectors $\nabla G(\vecu^\star_\lambda)$ and $\vecu^\star_\lambda$ equals -1.

The FMNA attack~\citep{fmna} (abbreviation for "Fast Minimum-norm Adversarial Attack"), focuses on finding the shortest path to the decision boundary, iteratively refining the input to project it onto the decision boundary. This method is much faster and almost as precise as CW.

% The adversarial attacks considered in this methodology are the Carlini-Wagner (CW) attack, the Fast Minimum Norm Attack (FMNA), and the Boundary Projection (BP) attack. Each of these attacks offers unique characteristics that make them suitable for identifying weaknesses in NNs.

% \begin{itemize}
% \item \textbf{Carlini-Wagner Attack  :} Known for 


% \item \textbf{Fast Minimum Norm Attack (FMNA) \citep{fmna}:} FMNA focuses on finding the shortest path to the decision boundary in the input space. Its efficiency in rapidly identifying the closest adve
% rsarial examples is leveraged to shift the sampling distribution towards these high-probability failure regions.

% \item \textbf{Boundary Projection (BP) Attack \citep{BP} :} The BP attack iteratively refines the input to project it onto the decision boundary. This method is particularly useful in exploring the boundaries of the input space where the NN's performance might be uncertain.

% \end{itemize}


% An image $x$ is represented by a vector in $[0,255]^d$ where $d$ is the image size. The neural network $f$ returns a vector of $[0,1]^C$ where $C$ is the number of classes in the classification task. To find the closest adversarial, we define G as
% \begin{equation}
%     G(x) \defeq f_c(x) - \max_{i\in [1:C] } f_i(x),
% \end{equation}


% where $c$ is the ground truth of $x$, and $f_i$ denotes the $i$-th coordinate of the predicted probability returned by $f$. It is assumed that $G$ is continuous and differentiable.
% $G(x)$ is negative if $x$ is adversarial. The goal of an attack is to find the minimal perturbation $u$ such as:
% \begin{equation}
%     \label{eq:minimization}
%     \min_{G(x + u) \leq 0} \lVert u \rVert^2.   
% \end{equation}



