8. FGSM

• fast gradient sign method

• expensive to find adversarial example x+d

  • many forward and backward passes needed

• no direct control over size of pertubation d

assumption:

• we have linear model g: R^n -> R^n

  • g(x) = wTx

goal:

• construct x+d so that

  • ||d||_inf <= epsilon

    • limit the distortion

  • |g(x+d) -g(x)| maximized

    • -> maximize impact of distortion / adversarial example

• write out

• kürze wTx

• -> can be maximized by using maximum possible d (-> d = epsilon)

• and assigning d the same sign as w (so that all terms in the sum are positive…)

• => di = epsilon*sign(wi)

-> n times average weight magnitued times epsilon

• the distortion increases linearily with n (size of input to layer)

• but epsilon does not change with it…

=> the more input features the NN has

-> the more effective the attack

• i.e. the less perceptible delta, as smaller is actually required…

• find optimal L_infinity pertubation d for bening sample (x,y)

• in single step

• for untargeted attacks

• single step assumes linear behavior of model and loss funciton

• -> activatin functions are locally linear in epsilon environment

• a defense approach against adversarial attacks

• idea:

  • extend the loss to incorporate untargeted attacks

-> reduce loss to correctly classify even when we have adversarial distortion

-> here, we weight both with the same (1/2)

• improves performance on clean test data

• improves robustness on adversarial test data

• weights of adversarial trained model more localized

• apply FGSM T times, each time with small step size

• after each step, clip adversarial pertubation to epsilon ball (L_infinity distance) around x

• where x0 = x

• useful if FGSM oversteps

  • i.e. if local linearity does not hold…

• w.r.t L_infinity loss