Fast Gradient Sign Method (FGSM)

FGSM is a one-shot attack that requires only a single forward and backward pass through the model. The perturbation is computed as:

η = ε * sign(∇x J(θ, x, y))

• ε (epsilon): A hyperparameter controlling perturbation magnitude
• sign(∇x J): The direction of the loss gradient with respect to the input
• No iterative refinement: Unlike PGD or BIM, FGSM does not take multiple small steps

This makes it computationally cheap but less powerful than multi-step variants.

FGSM was introduced by Goodfellow, Shlens, and Szegedy (2014) to challenge the hypothesis that adversarial examples stem from model nonlinearity. The core insight:

• Neural networks are designed to behave locally linear for gradient-based optimization to work
• In high-dimensional input spaces, many small perturbations accumulate into a large output change
• The sign function discards magnitude, keeping only direction — enough to flip predictions

This linearity hypothesis explains why adversarial examples transfer across architectures.

The ε (epsilon) parameter defines the L∞ norm bound of the perturbation — the maximum change allowed to any single pixel or feature.

• Small ε (e.g., 0.007): Perturbations are imperceptible to humans but still effective
• Large ε (e.g., 0.3): Visible noise, higher attack success rate
• Normalization matters: ε values assume input data scaled to [0, 1] or [-1, 1]

Choosing ε involves a trade-off between attack stealth and attack potency. Defenders benchmark model robustness across a range of ε values.

FGSM can operate in two modes depending on the attacker's objective:

Untargeted Attack (most common):

• Maximize loss for the true class
• x_adv = x + ε * sign(∇x J(θ, x, y_true))
• Goal: Cause any misclassification

Targeted Attack:

• Minimize loss for a chosen target class
• x_adv = x - ε * sign(∇x J(θ, x, y_target))
• Goal: Force classification as a specific incorrect label

Targeted FGSM is harder to execute successfully and typically requires larger ε.

FGSM is the canonical attack used in adversarial training due to its computational efficiency:

• Adversarial training loop: Generate FGSM examples on-the-fly during each training batch
• Min-max formulation: The model minimizes loss on both clean and FGSM-perturbed samples
• Limitation: Models trained only on FGSM examples may remain vulnerable to iterative attacks like PGD

Modern adversarial training uses multi-step PGD for stronger robustness, but FGSM remains a fast baseline for initial hardening.

The sign function is the defining operation of FGSM — it discards gradient magnitude and retains only direction (+1, -1, or 0). This has key implications:

• Uniform perturbation: Every input dimension is modified by exactly ±ε
• Maximum L∞ efficiency: FGSM saturates the L∞ budget across all pixels simultaneously
• Perceptibility trade-off: L∞-bounded perturbations appear as uniform grain, unlike L2-bounded attacks

The sign operation makes FGSM an L∞-optimal single-step attack, maximizing disruption within the allowed pixel budget.

The core output of FGSM—a subtle, often imperceptible modification to input data specifically crafted to cause a model to misclassify. FGSM generates this by adding the sign of the gradient of the loss function, scaled by epsilon, to the original input. The perturbation magnitude is bounded by an L∞ norm constraint to ensure the attack remains invisible to human observers while completely flipping the model's prediction.

The primary defense against FGSM attacks. This technique augments the training dataset with adversarial examples generated on-the-fly, forcing the model to learn correct classifications for manipulated inputs. Ian Goodfellow demonstrated that models trained with FGSM-generated examples exhibit significantly improved robustness. The process can be formalized as a min-max optimization problem where the inner maximization crafts the strongest perturbation and the outer minimization updates model weights.

FGSM is a classic white-box evasion attack occurring at inference time. The adversary modifies a malicious sample—such as malware or a stop sign image—to bypass a security classifier without altering its semantic meaning. Unlike poisoning attacks that corrupt training data, evasion attacks exploit the model's learned decision boundaries. FGSM's single-step nature makes it fast but potentially less effective against models hardened with adversarial training.

A formal guarantee that a model's prediction remains constant for any input within a mathematically defined Lp-norm ball. While FGSM provides an empirical lower bound on robustness, certified defenses using techniques like randomized smoothing offer provable upper bounds. A model with a certified radius of 0.3 under L∞ norm is guaranteed to resist any FGSM attack with epsilon ≤ 0.3, providing a stronger security posture than empirical evaluation alone.

A more powerful iterative extension of FGSM that applies the gradient sign step multiple times with a smaller step size, projecting the result back onto the epsilon-ball after each iteration. PGD is widely considered a first-order universal adversary and serves as the standard benchmark for evaluating adversarial robustness. Unlike FGSM's single-step approach, PGD's multi-step optimization finds stronger perturbations, making it a more rigorous test of a model's defensive capabilities.

A failed defense that FGSM readily exposes. Gradient masking occurs when a model's gradients are intentionally or unintentionally obfuscated—through non-differentiable layers, shattered gradients, or stochastic transformations—giving a false sense of security. FGSM's reliance on true gradient information means it will fail against masked models, but attackers can easily bypass this with black-box transfer attacks or by substituting a differentiable approximation.