4.2.1 FGSM and Variants

The Logic of Gradient Exploitation

At its core, FGSM exploits the most fundamental part of how a neural network learns: the gradient. During training, a model calculates the gradient of the loss function with respect to its weights to figure out how to adjust them to become *more* accurate. In an adversarial attack, you flip this concept on its head. Instead of adjusting the weights, you adjust the *input data* to make the model *less* accurate.

The gradient of the loss with respect to the input image tells you which pixels to change, and in which direction (brighter or darker), to cause the largest possible increase in the model’s error. FGSM calculates this direction and then pushes the input image a small, fixed amount in that direction.

The mathematical formulation is direct and revealing:

Let’s break this down:

• x_adv is the new, adversarial input you are creating.
• x is the original, benign input.
• ε (epsilon) is a small scalar value that controls the magnitude of the perturbation. It’s the “attack budget”—how much you’re allowed to alter the original input. A larger epsilon makes the attack stronger but also more perceptible.
• J(θ, x, y) is the model’s loss function, where θ are the model parameters, x is the input, and y is the true label.
• ∇_x is the gradient operator with respect to the input x.
• sign() is the sign function. This is the “fast” part of FGSM. Instead of using the precise gradient values, you only take their sign (+1, -1, or 0). This simplifies the calculation and creates a uniform perturbation across all modified pixels.

Visualizing the Attack

Imagine the model’s decision boundary as a line separating two classes. Your original input, x, sits comfortably on the correct side. The gradient points in the direction of steepest ascent for the loss. FGSM simply adds a vector in that direction to push x just over the line, causing it to be misclassified as x_adv.

_x J
ε · sign(∇_x J)


x_adv

Implementation in Pseudocode

The implementation is as straightforward as the theory. Here is a high-level view of how you would generate an FGSM example using a modern deep learning framework.

def fgsm_attack(model, loss_fn, image, label, epsilon):
    # We need to compute gradients with respect to the input image
    image.requires_grad = True

    # Get the model's prediction
    prediction = model(image)
    loss = loss_fn(prediction, label)

    # Zero out any existing gradients
    model.zero_grad()

    # Calculate the gradient of the loss w.r.t. the image
    loss.backward()

    # Create the perturbation based on the sign of the gradient
    perturbation = epsilon * image.grad.sign()

    # Add the perturbation to the original image
    adversarial_image = image + perturbation
    
    # Ensure the image values remain in a valid range (e.g., [0,1])
    adversarial_image = torch.clamp(adversarial_image, 0, 1)

    return adversarial_image

A Tool of Trade-offs: Strengths and Weaknesses

FGSM is a foundational tool, but like any tool, it has specific uses. Its primary trade-off is speed versus subtlety.

Evolution: Key FGSM Variants

The limitations of the one-shot FGSM naturally led to more sophisticated variants that trade some of its speed for greater effectiveness.

The Iterative Approach: Basic Iterative Method (BIM)

Also known as I-FGSM, this is the most direct evolution. Instead of taking one large step of size ε, you take many small steps. In each step, you re-calculate the gradient and move a small amount, α, in that direction. This process is repeated for a set number of iterations or until a misclassification occurs, while ensuring the total perturbation never exceeds the original ε budget.

BIM is far more likely to find a successful adversarial example within the ε constraint because it can navigate the loss landscape more carefully. It’s the conceptual bridge to even more powerful attacks like PGD.

The Targeted Attack

Sometimes, you don’t just want the model to be wrong; you want it to be wrong in a specific way. A targeted FGSM attack aims to make the model classify the input as a specific target class, y_target.

The logic is simple: instead of moving in the direction that *maximizes* the loss for the true label, you move in the direction that *minimizes* the loss for the target label. This is achieved by simply flipping the sign of the update.

Notice the change from `+` to `−`. You are now performing gradient *descent* on the target class’s loss, effectively pushing your input image closer to how the model perceives that target class.