Perturb

Abstract

We propose a decentralized adversarial robustness network built on Bittensor. Miners compete to find adversarial examples — imperceptible input perturbations that cause state-of-the-art image classifiers to fail. Validators construct challenges from a fixed, auditable image corpus (the full ImageNet-100 train split, ~126K images), run a reference classifier to establish ground truth, and verify every miner response deterministically: exact class-index comparison, strict perturbation-norm bounds, and perceptual quality gates (SSIM and PSNR) that guarantee every accepted attack is genuinely imperceptible.

Responses are scored on perturbation minimality — smaller, cleaner attacks earn more — with bonuses for decision-margin strength and spatial novelty, and exact-duplicate submissions are zeroed so only original work is rewarded. On-chain weights follow a rank-based emission schedule assigned to miners who accumulate a full history of verified results. Every verified adversarial example is exported with complete provenance metadata into a continuously growing dataset.

The result is the world's first financially incentivized, continuously improving adversarial testing infrastructure. The network produces two commercially valuable outputs — an adversarial training dataset and on-chain model robustness certificates — addressing a $1.43B market growing at 26.1% annually.

Executive Summary

Every AI model deployed in production carries a hidden vulnerability: adversarial examples. An imperceptible change to a single image can cause a medical imaging model to misclassify a tumor, an autonomous vehicle to ignore a stop sign, or a fraud detection system to approve a fraudulent transaction. The tooling to systematically discover these vulnerabilities before deployment is fragmented, expensive, and — critically — static. It does not improve over time.

Perturb changes this. Built on Bittensor, Perturb is a decentralized adversarial robustness network where miners compete to find adversarial examples — inputs that fool AI models while remaining imperceptible to humans. Every response is verified deterministically against the target model itself, and imperceptibility is enforced mathematically with SSIM and PSNR perceptual gates. Every attack is scored with mathematical precision. The network gets stronger every single day.

The result is the world's first financially incentivized, continuously improving adversarial testing infrastructure — something no centralized service can replicate.

The Problem We Solve

AI Models Are Brittle

Modern AI models achieve remarkable accuracy on clean test sets, yet remain catastrophically vulnerable to adversarial perturbations — mathematically crafted modifications to input data that are imperceptible to humans but cause models to fail completely. A ResNet-50 achieving 94% accuracy on ImageNet can be fooled by changing fewer than 0.3% of an image's pixels. An EfficientNetV2-L scoring 85.8% top-1 accuracy can misclassify a tabby cat as a fire truck with a perturbation whose maximum pixel change is bounded at 3% of the color range — invisible to any human observer.

This is not a theoretical concern. Adversarial attacks have been demonstrated against:

• Medical imaging classifiers used for cancer detection and diagnostic triage
• Facial recognition systems controlling physical access to secure facilities
• Autonomous vehicle perception systems for object and sign recognition
• Content moderation models protecting platforms from harmful material
• Financial fraud detection systems processing millions of transactions daily

The Market Opportunity

Three powerful forces are converging to create an urgent, large, and underserved market for adversarial robustness testing:

Regulatory Mandates: The EU AI Act classifies AI systems in healthcare, autonomous vehicles, critical infrastructure, and hiring as high-risk, requiring mandatory conformity assessments including robustness testing before deployment. Non-compliance carries fines of up to €30 million or 6% of global annual revenue.

Enterprise Procurement Requirements: Large enterprises increasingly require AI vendors to demonstrate robustness certifications before purchase. A verified robustness certificate is becoming table stakes for selling AI products into regulated industries.

AI Proliferation: As AI moves from research to production across every industry, the attack surface grows exponentially. Every new model deployment is a new vulnerability. Organizations deploying AI without systematic adversarial testing are accepting unknown, unquantified risk.

Why Existing Solutions Fall Short

Introducing Perturb

What Perturb Does

Perturb is a Bittensor subnet that incentivizes a global network of miners to find adversarial examples — images that fool AI classifiers while remaining visually indistinguishable from the original. The network produces two commercially valuable outputs:

Why Bittensor

Competitive Improvement: TAO emissions reward the best-performing miners. Applied to adversarial attacks, this creates the first financially incentivized adversarial research network. Miners earn real money for finding better attacks — driving continuous improvement no salaried team can match.

Perfect Verification Symmetry: Finding an adversarial example is computationally hard. Verifying one is trivially cheap: run the model, compare the predicted class index, measure the perturbation norms and perceptual similarity. Every check is deterministic and reproducible. This asymmetry makes Perturb's incentive mechanism clean, objective, and manipulation-resistant.

Decentralized Trust: On-chain records of adversarial evaluations create cryptographically verifiable proof of robustness testing — more credible than any centralized company's self-reported certificate, directly relevant to regulatory bodies seeking auditable compliance records.

Technical Architecture

System Overview

Perturb operates on a challenge-response loop between validators and miners. Validators sample images from a persisted random traversal of the full ImageNet-100 train split, establish ground truth by running the target classifier itself, broadcast identical challenges to a randomly selected pool of up to 150 miners, and score responses using deterministic verification: class-change checks, perturbation-norm bounds, SSIM and PSNR perceptual gates, and exact-duplicate detection.

Validator: Challenge Pipeline

The validator constructs each challenge from a fixed, auditable corpus: the full ImageNet-100 train split (clane9/imagenet-100, ~126K images), downloaded once from Hugging Face into a local cache. Images are traversed in a seed-derived random order that persists across restarts — no image repeats until the entire split has been used, after which the traversal reshuffles for the next epoch. Ground truth requires no external labeling service: the target model's own prediction on the clean image becomes true_label, so a successful attack is defined unambiguously as changing the model's output.

def generate_challenge(block) -> Challenge:
    # Deterministic per-block seed → reproducible epsilon in [0.06, 0.20)
    seed    = sha256(f"perturb:{netuid}:{block}")[:16]
    epsilon = 0.06 + (seed % 1400) / 10000.0

    # Next image from the persisted no-repeat random traversal
    image_id, image_b64 = sample_imagenet100_image()

    # Ground truth = the target model's own prediction
    predicted_label = predict_label(efficientnet_v2_l, decode(image_b64))
    mark_image_used(image_id); save_state()

    return Challenge(
        model_name = "EfficientNetV2-L",
        clean_image_b64 = image_b64,
        true_label = predicted_label,   # exact class label string
        epsilon    = epsilon,
        norm_type  = "Linf",
        timeout_seconds = 20,
    )

Challenges are broadcast every ~20 seconds to up to K = 150 randomly selected miners. Selection blends exploitation with exploration: roughly 80% of each pool is drawn from miners with a full verified score history, and 20% from newcomers, so new participants receive challenges immediately while established miners are evaluated continuously.

Deterministic Verification & Perceptual Gates

Perturb v2 replaces external verification services with a fully deterministic, self-contained verification stack. Labels are normalized (strip → lowercase → "_" → " ") and resolved to model class indices — including comma-separated ImageNet label aliases — so success is judged by exact class-index comparison, never fuzzy string matching. On top of the norm bounds, two perceptual gates mathematically enforce imperceptibility:

Because both the clean image and the miner's submission are quantized to the uint8 grid used by base64 PNG transport before any norm is measured, every reported L∞ value is an exact multiple of 1/255 and every result is reproducible bit-for-bit by any third party running the same open-source code.

Challenge Format

Complete AttackChallenge synapse sent from validator to all K selected miners:

{
  "task_id":         "string  // {block}-{seed}",
  "model_name":      "EfficientNetV2-L",
  "clean_image_b64": "base64_encoded_RGB_image",
  "true_label":      "string  // exact model class label, e.g. 'tabby'",
  "epsilon":         0.06–0.20,   // deterministic per challenge
  "norm_type":       "Linf",
  "min_delta":       0.003,
  "timeout_seconds": 20
}

Miner: Response

Miners return only the perturbed image. The attack method and parameters are entirely proprietary — the miner's competitive edge. Perturb ships a working baseline miner (a small-step untargeted PGD attack against the local EfficientNetV2-L) so new participants can join immediately. Sophisticated miners replace the baseline with optimized strategies to compete for higher emission shares.

{ "task_id": "string", "perturbed_image_b64": "base64_encoded_RGB_image" }

Scoring: Per-Challenge

Each miner response passes through strict verification gates. Any hard-fail returns 0.0 immediately:

Scoring for responses that pass all verification gates rewards perturbation minimality — the smaller and cleaner the perturbation, the higher the score. Both components are squared, so improvements near the minimal end of the range are rewarded super-linearly:

effective_max = min(epsilon, 0.03)

linf_ratio = clamp((norm − 0.003) / (effective_max − 0.003), 0, 1)
linf_score = (1 − linf_ratio) ** 2

rmse_ratio = clamp(rmse / effective_max, 0, 1)
rmse_score = (1 − rmse_ratio) ** 2

perturbation_score = 0.7 * linf_score + 0.3 * rmse_score

margin_score  = clamp((best_non_true_logit − true_logit) / 10, 0, 1)
novelty_score = clamp(changed_pixels / 8, 0, 1)

score = 1.0 * perturbation_score + 0.03 * margin_score + 0.01 * novelty_score

# Anti-copy: identical submissions (exact hash of decoded image bytes)
# are zeroed for everyone except the fastest responder.
apply_fastest_wins(results, response_hashes)

Scoring: On-Chain Weight Setting

On-chain weights follow a rank-based emission schedule. Eligibility is strict: a miner must accumulate a full rolling history of 300 verified scores and hold a positive average before receiving any emission — newcomers and free-riders earn nothing until they have proven sustained performance. The schedule is steeply differentiated: the best miner takes the majority of emissions, with a rank-weighted decay across all remaining positions.

eligible = [uid for uid in miners if len(score_history[uid]) >= 300]
ranked   = sort_by_avg_score_desc(eligible, window=300)
ranked   = [uid for uid in ranked if avg_score[uid] > 0.0]

# Rank-based emission: 70 / 15 / 15 with rank-weighted tail
emission[ranked[0]] = 0.70
emission[ranked[1]] = 0.15
tail = ranked[2:]
rank_weights = range(len(tail), 0, −1)          # N−2, …, 2, 1
for uid, w in zip(tail, rank_weights):
    emission[uid] = 0.15 * w / sum(rank_weights)

set_weights(normalize(emission))

Leaderboard Reporting & Dataset Export

Two production subsystems connect the incentive loop directly to Perturb's commercial outputs — both live in the validator today, not on a roadmap:

Signed leaderboard reporting. After every scoring round, validators submit a report to the Perturb API covering network-wide metrics (miner counts, average score, average L∞ norm, average RMSE, success counts) and per-miner results for every registered UID — each classified as Valid, Invalid, Duplicate, or Inactive. Reports are authenticated by signing the exact JSON request bytes with the validator hotkey, and are queued in a background thread so API latency can never affect scoring. This powers the public leaderboard at perturbai.io in near real time.

R2 adversarial dataset export. Every verified adversarial example is exported to object storage with a complete provenance record: source image ID and dataset row, task ID and block, validator hotkey, model name, true and adversarial labels, score, L∞ norm, RMSE, epsilon, SSIM, PSNR, response time, and the SHA-256 hash of the image itself. This is the adversarial training dataset described in Section 05 — generated, verified, and packaged automatically as a byproduct of network operation, with presigned URLs surfacing the freshest examples on the leaderboard.

Phase 1 Model: EfficientNetV2-L

Perturb operates with EfficientNetV2-L as the sole target model — a deliberate choice prioritising network stability, miner onboarding, and validation credibility over premature complexity.

EfficientNetV2-L sits at the ideal intersection of attack difficulty, hardware accessibility, and research credibility. At 118.5M parameters it is a genuinely modern production-scale classifier — hard enough that naive single-step attacks perform poorly within the strict 0.03 L∞ ceiling and perceptual gates, requiring miners to implement stronger iterative methods — yet still attackable on a single consumer GPU within the 20-second challenge window.

Expansion Roadmap

Revenue Model

Adversarial Training Dataset — Short-Term Revenue

Adversarial training — retraining models on adversarial examples — is the most effective known defense against adversarial attacks. Perturb generates this data continuously as a byproduct of its core operation: the validator's export pipeline writes every verified example to object storage the moment it is scored, creating a dataset that improves every single day. Each record includes: source image ID, adversarial image, model name, true label, adversarial label, attack score, L∞ norm, RMSE, epsilon budget, SSIM, PSNR, response time, SHA-256 content hash, and timestamp.

Model Robustness Testing Service — Long-Term Revenue

Organizations submit a model for evaluation and receive a comprehensive robustness report generated by directing the full miner network at the target model. Each report includes:

• Overall robustness score (0.0–1.0) benchmarked against industry standards
• Attack success rate across epsilon budgets and image categories
• Worst-case adversarial examples, visualized and downloadable
• Perceptual failure analysis — SSIM, PSNR, and norm profiles, not just pixel statistics
• On-chain cryptographic certificate of evaluation — immutable and auditable
• Comparison against published AutoAttack benchmarks for the same architecture

Go-To-Market Strategy

Target Customers

Phased Launch Plan

Competitive Moat

Self-Improving Attack Quality: Every day miners compete, the network gets better. The dataset becomes more valuable. The certificates become more credible. No centralized service has this compounding property.

Perceptually Gated Precision: Unlike tools that only measure pixel norms, every Perturb example must simultaneously clear an L∞ ceiling, an SSIM floor, and a PSNR floor while flipping the model's exact class index — producing genuinely imperceptible, higher-quality data and more credible certificates than norm-only pipelines.

Deterministic, Reproducible Verification: Every score can be independently recomputed bit-for-bit from open-source code, with responses quantized to a canonical 8-bit grid. There is no oracle to dispute, no subjective judge — just mathematics that any auditor, regulator, or customer can rerun.

On-Chain Immutability: Robustness certificates on Bittensor cannot be altered, backdated, or selectively disclosed — categorically different from any vendor's self-reported compliance documentation.

Architecture Diversity: As Perturb adds target models, miners who specialize build irreplaceable expertise. A miner optimizing attacks for six months outperforms any general-purpose tool.

Market Analysis

Conclusion

AI models are increasingly embedded in decisions that affect human safety, financial stability, and personal rights. Yet the vast majority of these models are deployed without systematic adversarial robustness testing — not because organizations don't care, but because the tooling to do so at scale simply doesn't exist.

Perturb changes this. By applying Bittensor's competitive incentive mechanism to adversarial example generation — and enforcing quality with deterministic class-index verification and mathematical perceptual gates — Perturb creates a network that gets measurably better every day. Miners are financially motivated to become the world's best adversarial attack researchers. Validators verify results with mathematical precision that any third party can reproduce. The network produces two commercially valuable outputs that address a real, growing, regulatory-driven market — and the pipelines that generate them, from live leaderboard reporting to automated dataset export, are already running inside every validator.

The validation mechanism is airtight. The market is large and accelerating. The Bittensor architecture provides an unfair advantage no centralized competitor can replicate. And with perceptually gated, fully reproducible scoring as a differentiator, Perturb produces higher-quality adversarial data than any existing tool.