Perturb

Every AI model deployed in production carries a hidden vulnerability: adversarial examples. An imperceptible change to a single image can cause a medical imaging model to misclassify a tumor, an autonomous vehicle to ignore a stop sign, or a fraud detection system to approve a fraudulent transaction. The tooling to systematically discover these vulnerabilities before deployment is fragmented, expensive, and — critically — static. It does not improve over time.

Perturb changes this. Built on Bittensor, Perturb is a decentralized adversarial robustness network where miners compete to find adversarial examples — inputs that fool AI models while remaining imperceptible to humans. Every challenge is verified by an LLM-backed semantic check. Every attack is scored with mathematical precision. The network gets stronger every single day.

The result is the world's first financially incentivized, continuously improving adversarial testing infrastructure — something no centralized service can replicate.

AI Models Are Brittle

Modern AI models achieve remarkable accuracy on clean test sets, yet remain catastrophically vulnerable to adversarial perturbations — mathematically crafted modifications to input data that are imperceptible to humans but cause models to fail completely. A ResNet-50 achieving 94% accuracy on ImageNet can be fooled by changing fewer than 0.3% of an image's pixels. An EfficientNet-B5 scoring 83.6% top-1 accuracy can misclassify a tabby cat as a fire truck with a perturbation invisible to any human observer.

This is not a theoretical concern. Adversarial attacks have been demonstrated against:

The Market Opportunity

Three powerful forces are converging to create an urgent, large, and underserved market for adversarial robustness testing:

Why Existing Solutions Fall Short

What Perturb Does

Perturb is a Bittensor subnet that incentivizes a global network of miners to find adversarial examples — images that fool AI classifiers while remaining visually indistinguishable from the original. The network produces two commercially valuable outputs:

Why Bittensor

System Overview

Perturb operates on a challenge-response loop between validators and miners. Validators construct verified challenges, distribute them to a randomly selected pool of miners, and score responses using LLM semantic verification, perturbation minimality, and response speed.

Validator: Challenge Pipeline

The validator constructs each challenge through a verified pipeline ensuring every challenge sent to miners is semantically clean and unambiguous:

def build_challenge() -> Challenge:
    label = random.choice(LABEL_CONSTANTS)
    image = image_hosting_api.fetch(mode="random", label=label)

    while True:
        raw_output = efficientnet_b5(preprocess(image))
        predicted  = raw_output.argmax().item()
        label_str  = IMAGENET_CLASSES[predicted]
        if llm_verify_label_match(label, label_str):
            break
        else:
            image = image_hosting_api.fetch(mode="random", label=label)

    return Challenge(
        model          = "efficientnet_b5",
        image          = image,
        true_label     = label,
        true_label_str = label_str,
    )

Validator: LLM Verification

Perturb uses a lightweight LLM for semantic verification at two points: during challenge construction and during response scoring. This approach handles edge cases where related classes such as tabby cat vs Egyptian cat would incorrectly fail a valid attack under integer class-ID comparison.

Challenge Format

Complete payload sent from validator to all K selected miners:

{
  "task_id":         "string",
  "model":           "efficientnet_b5",
  "llm_model_hint":  "Qwen2.5-1.5B-Instruct",
  "image":           "base64_encoded_RGB_image",
  "true_label":      "string  // e.g. 'tabby_cat'",
  "constraints": {
    "norm":          "Linf",
    "epsilon":       0.06,
    "min_delta":     0.002,
    "max_delta":     0.12,
    "pixel_range":   [0.0, 1.0]
  },
  "scoring_weights": { "perturbation": 0.7, "speed": 0.3 },
  "timeout_ms":      60000
}

Miner: Response

Miners return only the perturbed image. The attack method and parameters are entirely proprietary — the miner's competitive edge. Perturb provides a working default miner implementation so new participants can join immediately. Sophisticated miners replace the default with optimized strategies to compete for higher emission shares.

{ "task_id": "string", "perturbed_image": "base64_encoded_RGB_image" }

Scoring: Per-Challenge

Each miner response passes through strict verification gates. Any hard-fail returns 0.0 immediately:

Scoring formula for responses that pass all verification gates:

perturbation_ratio = norm / epsilon
perturbation_score = 1.0 - min(perturbation_ratio, 1.0)
speed_score        = 1.0 - min(response_time_ms / timeout_ms, 1.0)
score = 0.7 * perturbation_score + 0.3 * speed_score

Scoring: On-Chain Weight Setting

On-chain weights blend each miner's historical average score with a rank-based emission allocation. Only miners with processed_count > 100 are eligible. The emission schedule is differentiated by rank — top miners receive a disproportionately larger share, with inverse-rank decay for all lower positions.

eligible = [uid for uid in miners if processed_count[uid] > 100]
N = len(eligible)

avg_raw = {uid: mean(last_100_scores[uid]) for uid in eligible}

# Top 3: fixed emission percentages
emission[rank_1] = 0.50
emission[rank_2] = 0.30
emission[rank_3] = 0.10

# Ranks 4-10: inverse-rank decay within 5% pool
for k in range(4, 11):
    emission[k] = 0.05 * (1/k) / sum(1/j for j in range(4, 11))

# Ranks 11+: inverse-rank decay within remaining 5% pool
for k in range(11, N + 1):
    emission[k] = 0.05 * (1/k) / sum(1/j for j in range(11, N + 1))

GAMMA = 0.7
raw     = GAMMA * normalize(avg_raw) + (1 - GAMMA) * normalize(emission)
weights = raw / raw.sum()

Phase 1 Model: EfficientNet-B5

Perturb launches with EfficientNet-B5 as the sole target model — a deliberate choice prioritising network stability, miner onboarding, and validation credibility over premature complexity.

EfficientNet-B5 sits at the ideal intersection of attack difficulty, hardware accessibility, and research credibility. It is challenging enough that basic FGSM attacks perform poorly — requiring miners to implement stronger methods — but not so large that participation requires data center hardware.

Expansion Roadmap

Adversarial Training Dataset — Short-Term Revenue

Adversarial training — retraining models on adversarial examples — is the most effective known defense against adversarial attacks. Perturb generates this data continuously as a byproduct of its core operation, creating a dataset that improves every single day. Each entry includes: original image, adversarial image, model name, true label, constraint parameters, perturbation norm, LLM verification status, attack score, and timestamp.

Model Robustness Testing Service — Long-Term Revenue

Organizations submit a model for evaluation and receive a comprehensive robustness report generated by directing the full miner network at the target model. Each report includes:

Target Customers

Phased Launch Plan

Competitive Moat

AI models are increasingly embedded in decisions that affect human safety, financial stability, and personal rights. Yet the vast majority of these models are deployed without systematic adversarial robustness testing — not because organizations don't care, but because the tooling to do so at scale simply doesn't exist.

Perturb changes this. By applying Bittensor's competitive incentive mechanism to adversarial example generation — and adding LLM-backed semantic verification to ensure quality — Perturb creates a network that gets measurably better every day. Miners are financially motivated to become the world's best adversarial attack researchers. Validators verify results with mathematical precision. The network produces two commercially valuable outputs that address a real, growing, regulatory-driven market.

The validation mechanism is airtight. The market is large and accelerating. The Bittensor architecture provides an unfair advantage no centralized competitor can replicate. And with LLM-verified semantic scoring as a differentiator, Perturb produces higher-quality adversarial data than any existing tool.