\section{Proposed Method}
\label{sec:ProposedMethod}
This paper introduces a simple yet innovative approach to speed up the reliability estimation of Neural Networks by integrating adversarial attacks into the framework of Importance Sampling (IS). This method is built upon the foundations of Statistical Reliability Engineering and especially MPFP-based Importance Sampling~\citep{melchers2018structural}. It leverages the strengths of specific adversarial attacks to construct a biased distribution for more effective sampling. The key lies in using these attacks to shift the focus of the sampling process towards regions in the input space where the NN is most vulnerable, thus allowing for a more accurate estimation of the model's reliability.

% \subsection{Adversarial Attacks as Biased Distribution Drivers}

% The adversarial attacks considered in this methodology are the Carlini-Wagner (CW) attack, the Fast Minimum Norm Attack (FMNA), and the Boundary Projection (BP) attack. Each of these attacks offers unique characteristics that make them suitable for identifying weaknesses in NNs.

% \begin{itemize}
% \item \textbf{Carlini-Wagner Attack \citep{carlini_wagner} :} Known for its effectiveness in generating adversarial examples with minimal perturbation, the CW attack aids in pinpointing areas in the input space that are near the decision boundary. This attribute makes it a powerful tool for creating a biased distribution that emphasizes these critical regions.


% \item \textbf{Fast Minimum Norm Attack (FMNA) \citep{fmna}:} FMNA focuses on finding the shortest path to the decision boundary in the input space. Its efficiency in rapidly identifying the closest adve
% rsarial examples is leveraged to shift the sampling distribution towards these high-probability failure regions.

% \item \textbf{Boundary Projection (BP) Attack \citep{BP} :} The BP attack iteratively refines the input to project it onto the decision boundary. This method is particularly useful in exploring the boundaries of the input space where the NN's performance might be uncertain.

% \end{itemize}

\subsection{Constructing the Biased Distribution}

Utilizing these adversarial attacks, we construct a shifted Gaussian distribution in the U-space (standard normal space), where the mean of the distribution is adjusted based on the insights gained from the attack. This results in a biased distribution that is centered around the region of high failure probability. The steps for constructing this distribution are as follows:

\textbf{Mapping to the U-Space:} Transform the evaluation of~\eqref{eq:DefProbFail} into the estimation of~\eqref{eq:PfailUspace} as explained in Sect.~\ref{sec:Uspace}.
In the U-space, the uncertainties are standard normally distributed.
%these adversarial examples from the input space to the U-space. This transformation involves standardizing the adversarial data based on the distribution of the input data.

\textbf{Generating Adversarial Examples:} Employ attacks described in Sect.~\ref{sec:AdvEx} to find the adversarial example $\vecu^\star$ that highlights the NN's vulnerable point. Select an attack efficient in high-dimensional spaces and designed to find adversarial examples of \textit{minimal} norm, like CW or FMNA.

\textbf{Creating the Biased Distribution:} Formulate a Gaussian distribution in the U-space centered around the adversarial example, ensuring that the sampling process is concentrated around the most vulnerable regions of the NN. Run the Importance Sampling procedure with $\Y_i\overset{i.i.d.}{\sim}\mathcal{N}(\vecu^\star,\mathbf{I})$. This means that the ratio appearing in~\eqref{eq:ImpSamp} equals
\begin{equation}
    \frac{\phi(\Y_i)}{f_Y(\Y_i)} = \exp{(\|\vecu^\star\|^2/2 - \Y_i^\top\vecu^\star)}.
\end{equation}

\subsection{Assumptions}
This method relies on the following assumptions:

\textbf{A1.} The design point is unique. This means that $\vecu^\star$ is a global minimum of $J(\vecu,\lambda^\star)$. If existing, local minima lie further away from the origin. This means that the probability of failure is dominated by the probability of sampling $\U$ around this unique design point s.t. $G(\U)>0$. 

\textbf{A2.} The attack finds this design point.

\textbf{A3.} The frontier locally around the design point $\vecu^\star$ is not so curved.

Once the attack produces a point $\vecu^\star$, it is easy to check that it lies on the boundary, i.e. $G(\vecu^\star)=0$, and it is a local minimum because~\eqref{eq:Cosine} holds.
However, this does not prove that $\vecu^\star$ is the true global minimum.
As for assumption A3, if too many random vectors $\Y_i$ drawn for the IS lead to $G(\Y_i)\geq 0$, it means that the Importance Sampling estimation~\eqref{eq:ImpSamp} will be zero or dominated by too few samples. Statisticians say that the \emph{efficient} number of samples is too small which provokes a non-reliable estimation.
In conclusion, we have means for controlling that assumption A3 holds and assumption A2 is partly fulfilled. Yet, it is impossible to ensure that A1 holds.

% \textbf{Determining the Shifted Mean:} Calculate the mean of the transformed adversarial examples in the U-space. This means serves as the new center for the biased distribution.

% \begin{enumerate}
% \item \textbf{Generating Adversarial Examples:} Employ the CW, FMNA, and BP attacks to generate a set of adversarial examples that highlight the NN's vulnerable points.
% \item \textbf{Mapping to U-Space:} Transform these adversarial examples from the input space to the U-space. This transformation involves standardizing the adversarial data based on the distribution of the input data.
% \item \textbf{Determining the Shifted Mean:} Calculate the mean of the transformed adversarial examples in the U-space. This means serves as the new center for the biased distribution.
% \item \textbf{Creating the Biased Distribution:} Formulate a Gaussian distribution in the U-space centered around the calculated mean, ensuring that the sampling process is concentrated around the most vulnerable regions of the NN.
% \end{enumerate}

% \subsection{Applying Importance Sampling}
% With the biased distribution in place, the important sampling methodology, as detailed above, is applied. Samples are drawn from this distribution to estimate the reliability of the NN more effectively. The biased nature of the distribution ensures that the sampling process is focused on the regions where the NN is most likely to fail, leading to a more accurate and efficient estimation of its reliability.

