Fast Gradient Sign Method (FGSM)

FGSM is a one-shot attack that computes the perturbation in a single backpropagation pass. Unlike iterative methods like Projected Gradient Descent (PGD), it does not refine the perturbation over multiple steps. The adversarial example x' is generated as:

• x' = x + ε * sign(∇x J(θ, x, y))
• This makes it computationally cheap but often less potent than multi-step attacks.

The core mechanism relies on the sign of the gradient rather than its magnitude. By taking the sign of the loss gradient with respect to the input, FGSM applies the maximum allowable perturbation to every pixel simultaneously.

• The sign() function outputs +1, 0, or -1.
• This exploits the local linearity of models trained with methods like ReLU and maxout.

The perturbation magnitude is strictly bounded by the hyperparameter epsilon (ε). This enforces an L∞-norm constraint, ensuring the adversarial noise does not exceed a specific pixel intensity threshold.

• A typical value for CIFAR-10 is ε = 8/255.
• The attack guarantees that ||x' - x||∞ ≤ ε, making the manipulation imperceptible to the human eye.

FGSM operates under a white-box assumption, requiring full access to the model's architecture, weights, and gradients. The attacker must be able to compute the loss gradient ∇x J(θ, x, y) directly.

• This is used primarily for security evaluation and adversarial training.
• It is not a black-box attack; transferability is required to attack unknown models.

FGSM is widely used as a fast regularizer in adversarial training. By injecting FGSM-generated examples into the training loop, models learn to resist worst-case perturbations.

• Goodfellow et al. (2015) demonstrated this reduces error rates on adversarial examples.
• It provides a cheap approximation of the inner maximization problem in min-max optimization.

FGSM is highly susceptible to gradient masking, a defensive phenomenon where the model's gradients are intentionally or unintentionally obfuscated. If the loss surface is shattered or gradients vanish, the sign of the gradient no longer points toward the true decision boundary.

• This can lead to a false sense of security.
• Defenses relying solely on stopping FGSM are often trivially bypassed by Boundary Attacks or multi-step variants.

The primary defensive technique against FGSM attacks. It involves augmenting the training dataset with adversarial examples generated on-the-fly. The model learns to correctly classify these perturbed inputs by minimizing the loss on a mixture of clean and adversarial data. This is formulated as a min-max optimization problem, directly hardening the model against gradient-based manipulation.

A phenomenon where a defense appears robust against FGSM but provides a false sense of security. It occurs when a model's gradients are obfuscated, shattered, or non-existent, preventing the attack from computing a useful direction. However, these defenses are easily bypassed by black-box attacks, transfer attacks, or simply using a differentiable approximation of the model.

An optimization-based attack that directly minimizes the perturbation magnitude required to cause misclassification. Unlike FGSM, which relies on the gradient sign, C&W formulates the attack as an objective function: minimize the Lp-norm of the perturbation subject to a misclassification constraint. It is a powerful tool for evaluating defenses that rely on gradient masking.

A defensive technique that directly counters the FGSM mechanism. It penalizes the magnitude of the loss gradient with respect to the input. By forcing the gradient to be small, the model's output becomes less sensitive to small input variations. This creates a smoother decision boundary, limiting the damage a single-step attack like FGSM can inflict.