Fast Gradient Sign Method (FGSM)

Fast Gradient Sign Method (FGSM)

FGSM is a kind of white-box Adversarial Attack designed to be fast, not optimal (may not compute minimal perturbation). It assume the local linearity of the underlying function.

Targeted

Compute the perturbation as:

$\eta =ϵ\times sign({\nabla }_{x}los{s}_t(x))$

where

• $ϵ$ is a small constant
• $los{s}_t(x)$ is the loss function w.r.t. target label t

Then the adversarial example is $x^{\prime }=x-\eta$

I. J. Goodfellow, J. Shlens and C. Szegedy, Explaining and harnessing adversarial examples, 2014.

Untargeted

Compute the perturbation as:

$\eta =ϵ\times sign({\nabla }_{x}los{s}_s(x))$

with $x^{\prime }=x+\eta$, where s is the correct label.

Variants of FGSM

Iterative FGSM (I-FGSM)

A. Kurakin, I. Goodfellow and S. Bengio, Adversarial examples in the physical world, 2016.

\begin{equation*} x_{i}^{\prime}=x_{i-1}^{\prime}-\text{clip}_{\epsilon}(\alpha. \text{sign}(\nabla 1\text{oss}_{F, t}(x_{i-1}^{\prime}))) \end{equation*}

(untargeted?)

Iterative gradient sign was found to produce superior results to fast gradient sign

Others

• Momentum Iterative Fast Gradient Sign Method (MI-FGSM)
• Nesterov Iterative Fast Gradient Sign Method (NI-FGSM)
• Variance tuning Method (VMI-FGSM)