Deep learning models excel across many application domains. However, given an input \(x\) that is initially classified correctly, carefully crafted perturbations of the input can cause the model to misclassify the sample.
Now, how can this be achieved? If the adversary has white-box access to the model, i.e., knows the deep learning architecture and its parameters, then the input can be moved in a direction that is likely to induce misclassification. That direction can be obtained from the gradient of the loss with respect to the input, \( \frac {\partial \mathbf l(f_\theta (x),y)}{\partial x} \), since the gradient indicates the direction of steepest increase of the loss.
Consider a targeted attack, where the goal is to force the model to predict a target label of our choice. In this case, we compute the loss using the desired target label and update the input in the direction that decreases this loss. Because the model was trained to minimize the loss, decreasing the loss with respect to the chosen target modifies the input such that the network assigns a higher probability to that target class. To see this more formally, consider the binary cross-entropy loss:
where
Suppose the original prediction is class \(0\), but we wish to force the model to predict class \(1\). Setting the target label to \(y=1\) gives
Minimizing this loss is therefore equivalent to maximizing \(p_\theta (y=1\mid x)\). Consequently, updating the input so as to decrease this objective increases the model’s probability assigned to the desired target class. This type of attack is referred to as a targeted attack.
On the other hand, if the objective is simply to induce a misclassification, there is no need to specify a target class. Instead, the adversary uses the true label \(y\) and updates the input in the direction that increases the corresponding loss, thereby pushing the sample away from the region associated with the correct class. This is referred to as an untargeted attack.
One of the simplest gradient-based attacks is FGSM (Fast Gradient Sign Method). FGSM is a white-box attack that perturbs an input sample by taking a step in the direction that maximizes the loss. The sign of the gradient is used to determine the perturbation direction while ensuring that each input component is modified by at most \(\epsilon \):
More generally, an untargeted adversarial attack can be formulated as the following constrained optimization problem:
The adversarial sample is then
In practice, torch.clamp (or per-component clipping) can be used to ensure that the perturbation remains bounded and that the perturbed sample remains within the valid input domain. After updating the input as \(x+\delta \) under the \(\ell _\infty \) constraint, the perturbed sample must satisfy
For example, for images whose pixel values belong to \([0,1]\), clipping can be used to enforce this constraint.
To reduce the memory footprint and avoid unnecessary gradient computation, the model parameters are typically frozen since they are not updated during the attack. Freezing the parameters is not strictly required, as long as no optimizer update is performed, the model parameters remain unchanged. Nevertheless, one can place the model in evaluation mode and disable gradient computation for the model parameters. The input \(x\), however, must require gradients, since the attack relies on computing \(\frac {\partial \mathbf l(f_\theta (x),y)} {\partial x}\) to generate the adversarial perturbation.
For a targeted attack toward a target class \(y^*\), the FGSM update instead becomes
since the objective is now to decrease the loss associated with the target class. The targeted attack can be formulated as
Using FGSM, or iterative attacks such as PGD (Projected Gradient Descent), does not necessarily guarantee that a sample will be misclassified. In some cases, the classifier may remain sufficiently confident in the correct class, and the generated perturbation may therefore fail to induce misclassification (however, it generally performs well).