# Defended Model Artifacts - Book 3

Companion artifacts for *The Applied AI Universe: Adversarial Defenses*. Book 1
published the models and Book 2 the attacked ones; these are the **hardened**
versions, with the undefended baselines needed to reproduce each comparison.

| Artifact | Victim | Defense applied | Digest shipped |
|---|---|---|---|
| `capsnet.weights.h5` | Capsule network | undefended baseline | - |
| `capsnet_defended.weights.h5` | Capsule network | Batched adversarial training through routing | - |
| `cnn_mnist_defended.weights.h5` | CNN on MNIST | PGD adversarial training | - |
| `dnn_cifar_defended.weights.h5` | DNN on CIFAR-10 | PGD adversarial training | - |
| `gan_discriminator.weights.h5` | GAN discriminator | undefended baseline | - |
| `gan_discriminator_defended.weights.h5` | GAN discriminator | DP-SGD (per-example clipping + noise) | - |
| `hybrid_qnn.npz` | Hybrid quantum-classical NN | Adversarial training | yes |
| `mamba.weights.h5` | Selective state-space (Mamba) | undefended baseline | - |
| `mamba_defended.weights.h5` | Selective state-space (Mamba) | Curriculum adversarial training | - |
| `mlp_mnist_defended.weights.h5` | MLP on MNIST | PGD adversarial training | - |
| `qaoa_maxcut.npz` | QAOA MaxCut, 4-cycle | SHA-256 parameter integrity + checkpoint recovery | yes |
| `qgan_generator.npz` | Quantum GAN generator | SHA-256 parameter integrity + checkpoint recovery | yes |
| `qsvm_kernel.npz` | Quantum-kernel SVM | Distance-based anomaly rejection (demonstrably weak) | yes |
| `transfer_cifar.weights.h5` | MobileNetV2 transfer | undefended baseline | - |
| `transfer_cifar_defended.weights.h5` | MobileNetV2 transfer | Adv. training on the head; backbone frozen | - |
| `vqc_iris.npz` | Variational quantum classifier | PGD adversarial training | yes |
| `vqe_ising.npz` | VQE, transverse-field Ising | SHA-256 parameter integrity + energy cross-check | yes |

## Verifying what you downloaded

```python
import hashlib
d = hashlib.sha256(open('models/qaoa_maxcut.npz','rb').read()).hexdigest()
assert d == open('models/qaoa_maxcut.sha256').read().strip()
```

The same control Chapters 29, 34 and 35 apply to their own parameters. A digest
proves the file is unaltered since publication, **not** that what was published
was clean. For a variational circuit the parameters *are* the model.

## Scope

These weights reproduce the book's **measured** results. Across 29 defenses,
**71% of the naive gain survived an adaptive attacker and 29% did not** -
integrity controls retained 100%, detection defenses 24-28%. A defense that
improved a naive figure may still fail an adaptive attack; the book reports both.