White-Box Attack

A foundational one-step attack that computes the optimal perturbation by taking the sign of the gradient of the loss function with respect to the input. FGSM maximizes the loss in a single step, creating adversarial examples with minimal computational cost.

• Mechanism: x_adv = x + ε · sign(∇_x J(θ, x, y))
• Epsilon (ε) controls perturbation magnitude—larger values increase attack success but reduce imperceptibility
• Introduced by Goodfellow et al. (2015) as a demonstration of linear behavior in high-dimensional spaces
• Often used for adversarial training to improve model robustness

An iterative extension of FGSM that applies multiple small gradient steps with projection back onto an epsilon-ball around the original input. PGD is widely considered the strongest first-order adversary and a standard benchmark for robustness evaluation.

• Multi-step variant: repeatedly applies FGSM with small step size α, projecting onto L∞ or L2 norm ball after each iteration
• Random restarts prevent the attack from getting stuck in poor local maxima
• Defeating PGD-based adversaries typically requires certified defenses or adversarial training with PGD examples
• Standard configuration: 40 steps with step size α = ε/4

An optimization-based attack that formulates adversarial example generation as a constrained minimization problem using a custom loss function. C&W attacks are highly effective against defensive distillation and many gradient-masking defenses.

• L2, L∞, and L0 variants target different distance metrics for perturbation minimization
• Uses the logit-based objective: minimize ||δ||_p + c · f(x+δ) where f(x+δ) ≤ 0 only when misclassification occurs
• Employs change-of-variables (tanh transform) to enforce box constraints without clipping
• Consistently defeats adversarially trained models when properly tuned

An iterative attack that computes minimal perturbations by iteratively projecting the input onto the closest linearized decision boundary. DeepFool produces smaller perturbations than FGSM while achieving comparable misclassification rates.

• Linear approximation: assumes decision boundaries are locally linear hyperplanes
• Iteratively moves the input toward the nearest boundary until class label changes
• Produces tighter perturbation norms than gradient-sign methods
• Useful for estimating model robustness and understanding decision geometry

A targeted attack that modifies a minimal number of input features by computing a saliency map from the forward derivative of the model. JSMA prioritizes pixels that most strongly influence the target class while minimally affecting other classes.

• L0-optimized: focuses on minimizing the number of perturbed features rather than perturbation magnitude
• Constructs an adversarial saliency map using the Jacobian matrix of output scores
• Iteratively selects and modifies pixel pairs until target misclassification is achieved
• Particularly effective for image domains where sparse perturbations are less detectable

A flexible optimization attack that balances L1 and L2 regularization to produce adversarial examples with both small total perturbation and sparse feature modification. EAD generalizes the C&W formulation by adding an L1 penalty term.

• Objective: minimize f(x, t) + λ₁||δ||₁ + λ₂||δ||₂² where f enforces misclassification
• The L1 term encourages sparse perturbations affecting fewer input dimensions
• Enables fine-grained control over the trade-off between perturbation magnitude and sparsity
• Effective against defenses that detect dense, widespread perturbations