Fast Gradient Sign Method (FGSM)

FGSM generates an adversarial example in a single forward and backward pass through the network. Unlike iterative methods such as Projected Gradient Descent (PGD), it does not refine the perturbation over multiple steps.

• Mechanism: Computes the sign of the gradient of the loss function with respect to the input.
• Efficiency: Extremely fast to compute, making it suitable for real-time adversarial training during model fitting.
• Trade-off: The single-step nature often results in lower attack success rates against robust models compared to multi-step attacks.

The adversarial example x' is constructed by moving the original input x in the direction that maximizes the loss J.

• Formula: x' = x + ε * sign(∇x J(θ, x, y))
• ε (Epsilon): A hyperparameter controlling the maximum perturbation magnitude per pixel or feature.
• sign(): The element-wise sign operator ensures the perturbation magnitude is uniform but the direction is strictly gradient-aligned.
• L∞ Norm: FGSM is fundamentally an L∞ bounded attack, restricting the maximum change to any single input feature.

FGSM was introduced by Goodfellow et al. (2014) to disprove the notion that adversarial vulnerability stems purely from nonlinearity. The attack exploits the local linear behavior of high-dimensional deep networks.

• Core Insight: Even a linear model can be fooled if the input dimensionality is high enough and small perturbations accumulate.
• Perturbation Accumulation: A change of ε applied to n dimensions results in a total activation change of ε * n.
• Implication: The dot product accumulation makes the model highly sensitive to precise directional noise, even if the per-feature change is imperceptible.

FGSM is a white-box attack, meaning it requires full access to the model's architecture, parameters, and gradients. This distinguishes it from query-based black-box attacks.

• Gradient Calculation: The attacker must backpropagate the loss from the output layer to the input space.
• Defense Evaluation: It serves as a minimal baseline test; if a defense fails against FGSM, it is fundamentally broken.
• Transferability: Despite being white-box, FGSM examples often exhibit transferability, fooling other independently trained models without direct gradient access.

FGSM is widely used as a fast regularization technique during training to improve model robustness. By injecting FGSM examples into the training batch, the model learns to smooth its decision boundaries.

• Computational Cost: Adds only ~30% overhead to standard training, compared to the significant cost of multi-step PGD training.
• Catastrophic Overfitting: A known failure mode where the model suddenly loses robustness against multi-step attacks if trained only on single-step FGSM examples.
• Mitigation: Techniques like random initialization of the perturbation before FGSM calculation help prevent this collapse.

The perturbation budget ε defines the trade-off between attack success and human imperceptibility. Standard values are calibrated to pixel intensity scales.

• ImageNet Standard: ε = 1/255 to 8/255 on normalized pixel values in [0, 1].
• Visual Impact: At ε = 8/255, the noise becomes slightly visible as a high-frequency "static" pattern.
• Feature Scaling: For non-image tabular data, epsilon must be carefully normalized per feature to avoid dominating the signal in sparse columns.

The strongest first-order adversary and the standard benchmark for empirical robustness. PGD is a multi-step iterative variant of FGSM that projects perturbations onto an Lp-norm ball to ensure the adversarial example remains within a defined threat model.

• Mechanism: Repeatedly applies FGSM with a small step size, projecting back to the epsilon-ball after each iteration.
• Key Distinction: Unlike single-step FGSM, PGD overcomes gradient masking defenses.
• Usage: The primary attack used in adversarial training to create robust models.

The most empirically effective defense against adversarial examples. This technique augments the training dataset with adversarial examples generated on-the-fly, forcing the model to learn a robust decision boundary.

• Process: For each batch, generate adversarial examples (usually via PGD) and train on the perturbed inputs with correct labels.
• Trade-off: Significantly increases training time and may reduce accuracy on clean data.
• Min-Max Formulation: Solves a saddle point problem minimizing loss against a maximized perturbation.

A brittle defense phenomenon that provides a false sense of security by obscuring the model's gradients rather than removing the underlying vulnerability. Models exhibiting gradient masking appear robust to gradient-based attacks but remain susceptible to black-box attacks or adaptive attacks.

• Causes: Non-differentiable layers, numerical instability, or saturating activation functions.
• Detection: A model with gradient masking often shows higher robustness to white-box attacks than to transfer-based black-box attacks.
• Consequence: Defenses relying on gradient masking are considered broken by the research community.

A parameter-free, ensemble attack that serves as the gold standard for reliable robustness evaluation. AutoAttack combines four diverse attack methods to circumvent gradient masking and provide a trustworthy lower bound on model vulnerability.

• Ensemble Components: Includes APGD-CE, APGD-DLR, FAB, and Square Attack.
• Standardization: Used by RobustBench to rank defenses, eliminating the risk of weak attack evaluations.
• Adaptive Nature: Automatically tunes hyperparameters, removing researcher degrees of freedom that can inflate robustness claims.

A formal mathematical guarantee that a model's prediction remains constant for all inputs within a defined perturbation bound. Unlike empirical defenses that can be broken by stronger attacks, certified robustness provides a provable lower bound on adversarial accuracy.

• Leading Technique: Randomized Smoothing constructs a certifiably robust classifier by adding Gaussian noise and aggregating predictions via majority vote.
• Limitation: Current certification methods provide loose bounds and are computationally expensive.
• Contrast: Empirical defenses (like adversarial training) offer no formal guarantees.

The property by which adversarial examples crafted against one surrogate model also fool other independently trained target models. This phenomenon enables black-box attacks without query access to the victim model.

• Cause: Different models learn similar decision boundaries and feature representations.
• Attack Vector: An adversary trains a local substitute model, generates white-box attacks, and transfers them to the target API.
• Mitigation: Ensemble adversarial training and input randomization reduce transferability rates.