White-Box Attack

The direct counterpart to the white-box threat model. In a black-box attack, the adversary has zero knowledge of the model's internal architecture, parameters, or training data. Instead, they probe the model by submitting inputs and observing only the output predictions or confidence scores to infer the decision boundary.

• Query-based: Relies on input-output pairs to estimate gradients.
• Transfer-based: Crafts adversarial examples on a local surrogate model and hopes they transfer to the target model.
• Contrasts sharply with white-box attacks, which exploit exact gradient information for precise, minimal perturbations.

The canonical iterative white-box attack and the standard benchmark for evaluating adversarial robustness. PGD extends the single-step Fast Gradient Sign Method (FGSM) by taking multiple small gradient steps, each followed by a projection back onto the epsilon-ball around the original input.

• Iterative optimization: Finds stronger adversaries than single-step methods.
• Random restarts: Often initialized with random noise to escape local maxima.
• PGD is the primary tool for adversarial training, the most effective empirical defense.

A powerful optimization-based white-box attack formulated to find minimally distorted adversarial perturbations. The C&W attack minimizes a custom loss function that jointly optimizes for misclassification and a small Lp-norm distance from the original input.

• L0, L2, L∞ variants: Targets different distance metrics for imperceptibility.
• High success rate: Routinely defeats defensively distilled models.
• Uses the Adam optimizer and a change-of-variables to handle box constraints, making it a precise tool for auditing model vulnerability.

The most empirically robust defense against white-box attacks. Adversarial training augments the training dataset with adversarial examples generated on-the-fly and labeled with the correct class, forcing the model to learn a smoother decision boundary.

• Min-max formulation: Solves an inner maximization (attack) and outer minimization (defense) problem.
• PGD-based: Typically uses PGD to generate the strongest adversaries during training.
• Significantly increases training compute but provides state-of-the-art empirical robustness.

A false sense of security that occurs when a defense causes the model's gradients to become non-informative or numerically unstable, rather than achieving true robustness. White-box attackers can easily circumvent gradient masking by using black-box transfer attacks or alternative loss functions.

• Shattered gradients: Non-smooth or non-differentiable defenses.
• Stochastic gradients: Randomization that averages out over multiple queries.
• Exploding/vanishing gradients: Numerical instability that prevents optimization.
• A critical concept for distinguishing genuine robustness from obfuscation.

A formal, verifiable guarantee that a model's prediction will remain constant for any input perturbation within a specified Lp-norm radius. Unlike empirical defenses, certified robustness provides a mathematical lower bound that no white-box attacker can violate.

• Randomized smoothing: A leading technique that constructs a provably robust classifier by adding Gaussian noise and aggregating predictions.
• Complete vs. incomplete verifiers: Trade off between exactness and scalability.
• Provides the strongest assurance against white-box adversaries.